Is WhatsApp GDPR-Compliant? What Shops May and May Not Do

The GDPR regulates processing, not products. No supervisory authority issues a seal that makes a messaging app lawful, and none declares one unlawful either. So the question as it is usually asked has no answer, which is why any article that replies with a flat yes or no is selling something.

The question underneath it is answerable. A shop owner asking it wants to know three things: may I message my customers on this channel, what would I have to be able to show if someone asked, and where exactly does the risk sit. All three turn on decisions you make rather than on properties of the app — and the first decision is which WhatsApp you are actually running.

They share a name and very little else, and the difference is the whole data-protection story.

• The WhatsApp Business app runs on a phone and works from that phone's address book. Everyone stored on the device is in scope, including people who never contacted your shop at all, and the app is built around one person on one handset.
• The WhatsApp Business Platform sends through an API. Your contacts live in your own system, you decide what is stored and for how long, and there is no address-book sync to explain to anyone.

Above a few hundred orders a month, most shops move to the Platform for operational reasons anyway — several people answering one number, messages that fire on Shopify events, a record of what went out. The data-protection argument points the same way, which does not happen often and is worth taking. Our overview of the flows and growth tools a Shopify shop actually runs shows what the Platform side looks like in practice.

Once you are on the Platform, what remains is ordinary data protection applied to a newer channel. The principles are the familiar ones:

1. A lawful basis before the first message. For promotional messages that is normally consent.
2. A purpose stated at the moment you ask, rather than reconstructed afterwards.
3. Only the data you actually need — a phone number and an order history, not a profile.
4. A retention period you can say out loud without checking first.
5. A way to withdraw that is no harder than joining was.

These sit in the General Data Protection Regulation itself (Regulation (EU) 2016/679, EUR-Lex, 2016), and on the consent question specifically the European Data Protection Board's Guidelines 05/2020 on consent (EDPB, 2020) are the reference most supervisory authorities work from (both retrieved 14 October 2026). These are principles. How they apply to your shop is a question for your own counsel, not for a blog post.

Meta runs a second rulebook alongside the law, and passing one test does not pass the other.

Meta's own documentation states that businesses are required to obtain opt-in before messaging people on WhatsApp, that they must clearly state the person is opting in to receive communication from the business, that they must name the business, and that they must comply with applicable law (Meta, WhatsApp Business Platform documentation, retrieved 14 October 2026). Meta deliberately leaves the method open — a website form, SMS, a phone flow or a signed sheet of paper all qualify as far as the policy is concerned.

That last clause is the one shops skim past. Meta's policy defers to local law rather than replacing it, so an opt-in that satisfies Meta can still be far too thin for a European supervisory authority. The reverse is also true: a consent record your lawyer is happy with still has to name your business to satisfy Meta. Our reference page on Meta's platform rules, dated and sourced keeps the policy side with retrieval dates, because Meta changes it without announcement.

If someone asked tomorrow, five things per contact would settle it:

1. Where the number came from — checkout, pop-up, QR code, import.
2. When consent was given, to the minute.
3. The exact wording shown at that moment, not the wording on the site today.
4. What it covered: order updates only, or campaigns as well.
5. Whether it has since been withdrawn, and when.

In Keaz that record is the opt-in level stored on the contact, and a flow's starting point can require a minimum level so nobody below it ever enters — see how opt-in levels control subscribing and unsubscribing. The post-checkout widget has a Safe mode for shops that want the stricter reading applied before a number is captured at all, described in collecting phone numbers after checkout.

For the collection side — what a valid opt-in has to look like and which sources produce one — our guide to collecting WhatsApp opt-ins the GDPR-compliant way goes through the mechanics step by step.

• Treating the phone number in a Shopify order as consent to market. It was given so a parcel could arrive.
• Importing an old list because those people bought once. A past purchase is not an opt-in for promotion.
• One blanket opt-in for everything. An order update and a Friday campaign are not the same ask, and bundling them makes the weaker consent the one that counts.
• Running the Business app from a personal handset and treating the address book as somebody else's problem.
• Making withdrawal harder than joining. A form to join and a single reply word to leave is the right way round, not the reverse.
• Relying on a vendor's compliance claim instead of your own record. The record is yours to produce, whoever built the software.

Most of these surface at once the first time a shop sends a broadcast rather than a notification. Setting up a WhatsApp newsletter covers the send side, including how the opt-in you collected limits what you may put in it.