A trade association dinner, somewhere between the main course and coffee. Someone at the table mentions a friend of a friend who got hit with a legal warning for sending marketing messages nobody had agreed to. Everyone nods. And you think about your own plan to finally get started with WhatsApp marketing. Maybe better not?
No, definitely do it. The story going round the table has a grain of truth in it, but the conclusion attached to it is wrong. WhatsApp marketing is not the risk. Sloppy WhatsApp marketing is. Follow a handful of clear rules and you are on safe ground, with a real advantage on top: a list made up entirely of people who actually want to hear from you.
This article hands you those rules as a checklist, in plain language, without the legal jargon. One note before we start: this is practical guidance, not legal advice. For anything unusual, ask a solicitor.
The basic rule: no marketing without consent
Everything in WhatsApp marketing rests on one principle. You may only message people who have explicitly told you beforehand that you can send them marketing messages. Having someone’s mobile number is not enough. The fact that someone is already a customer is not enough either.
Consent has to be given freely and for a clearly stated purpose, and the person has to be able to withdraw it at any time. If it is ever questioned, you need to be able to prove you had it. That is exactly where the cases you hear about at dinner fall apart: either there was no consent, or there was no record of it.
GDPR is not an obstacle to good marketing. It makes sure your list contains only people who want your messages.
The checklist, point by point
Work through this list once before you send your first campaign:
- Consent before the first message. Every contact signed up of their own accord, through a form, a QR code or a landing page. Nobody was simply added to the list.
- Double opt-in in place. After signing up, every contact confirms their number a second time. Only then do they start receiving messages.
- Purpose clearly stated. The sign-up says what the person is getting: offers, news and appointment reminders by WhatsApp, for example.
- Privacy policy linked. Your landing page links to your privacy policy, and that policy lists WhatsApp marketing as one of the purposes you process data for.
- Consent documented. The time and the method of every sign-up are stored and can be produced if anyone ever asks.
- Opt-out always available. A single “Stop” is enough, and that person stops receiving messages. No argument, no delay.
- Deletion requests you can act on. If someone asks you to delete their data, you can remove it in full.
- Data processing agreement signed. You have a written agreement with your software provider covering how they handle your contacts’ data.
- No bought or scraped lists. Numbers from third-party sources, old spreadsheets or business cards you have typed up stay out.
If you can tick all nine, your WhatsApp marketing stands on solid ground.
Double opt-in: your clean proof
The most important item on the list deserves a closer look. With double opt-in, someone signs up and then confirms that sign-up a second time, for example with a short reply to a confirmation message.
That protects you twice over. First, nobody can enter someone else’s number and land you with complaints you never earned. Second, it creates exactly the record you need: this number gave active consent on this date, at this time. In SmartChat the whole sequence runs automatically. There is nothing extra to build.
There is a pleasant side effect too. Anyone who takes the second step means it. Your list may grow a little more slowly, but it fills up with genuinely interested people instead of dead numbers.
Opting out has to be as easy as opting in
Plenty of businesses treat every opt-out as a defeat and quietly hide the option. That is wrong on two counts. Legally, withdrawing consent has to be as simple as giving it. Practically, a clean opt-out is far better than an irritated contact who blocks your number or reports you as spam.
So mention now and again that a simple “Stop” is all it takes. It comes across as confident and it builds trust. Your contact management should process opt-outs automatically, so that nothing goes out to someone who has left, not even by accident on your next big campaign.
The bottom line: set it up properly once, then get on with it
GDPR-compliant WhatsApp marketing is not a permanent building site. It is a one-off setup job: a clean sign-up, double opt-in, an easy opt-out, documented consent, a data processing agreement with your provider. After that you can concentrate on what you actually want to say, and the fear of a warning letter can stay where you heard it, at the dinner table.
SmartChat is GDPR-compliant, with double opt-in built in, and ready to go in under 60 seconds. You can see the plans on our pricing page.