WhatsApp Marketing Rules by Country: Opt-In, Templates and the 24-Hour Window

Sending marketing on WhatsApp means satisfying two sets of rules at once. The first is Meta's, which applies to every business on the WhatsApp Business Platform regardless of country and is enforced by the platform itself: break it and your number's quality rating drops, your messaging limits shrink, and eventually the account is restricted. The second is the law where your recipients live, which varies by country and is enforced by regulators and courts.

In practice Meta's rules are stricter than most national laws on the points that matter for marketing, so a business that follows Meta's policy carefully is usually most of the way to legal compliance as well. This post explains the platform rules that apply everywhere, then the main differences in India, the European Union, the United States and the United Kingdom. It is general guidance, not legal advice, and Meta's policies change: check the current Business Messaging Policy and Commerce Policy before you launch, and a lawyer where the stakes justify it.

• Opt-in before the first message. Meta requires that a business obtain a person's agreement to receive messages on WhatsApp before sending, and that the opt-in make clear which business is messaging and that it is on WhatsApp. A checkbox on a form, a reply to a text, a QR code scan, or an in-store signup all work, provided the person actively agreed. A phone number collected for a delivery is not opt-in for marketing.
• Templates for anything you start. A business cannot send free-form text to someone out of the blue. Any conversation the business opens must use a message template that Meta has reviewed and approved, categorized as marketing, utility or authentication. Templates have variables for names and order details, but the structure is fixed.
• The 24-hour customer service window. When a person messages you, a window opens in which you can reply with anything, including free text, for 24 hours after their last message. Once it closes, you are back to approved templates. This is why replies should be answered quickly, and why Brainito's inbox shows whether a contact's window is open.
• Opt-out must work. People must be able to stop messages easily, usually by replying with a word such as STOP, and the business must honor it.
• Quality rating and tiers. Meta scores each number on how recipients react, blocks and reports in particular, and sets a daily limit on how many new conversations you can start. Poor quality lowers the tier. Brainito shows both and paces sends within the tier.
• Prohibited content. Meta's Commerce Policy bans certain goods and services from being promoted on the platform at all. Check it if you sell anything regulated.

India is WhatsApp's largest market and the country where WhatsApp marketing is most established. Meta's platform rules apply in full, and Meta has at times added India-specific controls on marketing template volume when users reported fatigue, so check the current policy for any limits in force. On the legal side, the Telecom Regulatory Authority of India's rules on commercial communication are built around SMS and voice, including the DLT registration regime that governs SMS sender IDs and templates, and the Digital Personal Data Protection Act of 2023 sets consent requirements for personal data that apply to phone numbers used for marketing.

Practically: collect explicit opt-in, keep a record of it, use utility templates for order updates and marketing templates only for promotions, and watch your quality rating closely. If you also text in India, note that the DLT registration your SMS needs does not cover WhatsApp, and WhatsApp's template approval does not cover SMS.

In the EU, two laws sit on top of Meta's rules. The General Data Protection Regulation governs the phone number itself as personal data: you need a lawful basis to hold and use it, which for marketing is almost always consent, and the person has rights to access, correct and erase it. The ePrivacy Directive, implemented differently in each member state, governs direct marketing by electronic means and generally requires prior consent for marketing messages to individuals, with a narrow exception for existing customers being marketed similar products, and always with an easy way to object.

The result is that in the EU you should treat WhatsApp marketing as consent-only. Record when and how consent was given, make the opt-out as easy as the opt-in, and keep marketing separate from service messages so that a person who withdraws marketing consent still receives their order confirmations. Several national regulators have taken an interest in messaging apps specifically, so check the guidance from the data protection authority in each country you sell into.

The US has no general data protection law, but it has the Telephone Consumer Protection Act, which regulates calls and texts to mobile phones and has been applied to messaging apps in some disputes. Whether a WhatsApp message is a "text message" under the TCPA is not settled in every court, and a careful business does not rely on the answer being no. Prior express written consent, clear disclosure of what the person is agreeing to, and a working opt-out are the safe standard, which is the same standard the TCPA sets for marketing SMS. Our post on SMS consent rules in the US covers it in detail.

State laws add to this. Florida, Oklahoma and several others have their own telemarketing statutes with quiet-hour and consent provisions, and state privacy laws in California and elsewhere give consumers rights over their data. WhatsApp usage in the US is lower than in most other markets, so for many US businesses SMS is the primary channel and WhatsApp is secondary. Brainito keeps consent per channel so a person who agreed to texts is not assumed to have agreed to WhatsApp.

The UK kept the EU framework at Brexit, so the UK GDPR and the Privacy and Electronic Communications Regulations, known as PECR, apply. PECR requires consent for marketing by electronic message to individuals, with a soft opt-in for existing customers who were offered a chance to refuse at the point their details were collected and who are being marketed similar products or services. The Information Commissioner's Office enforces both, publishes detailed direct marketing guidance, and has fined businesses for unsolicited messages. The Data (Use and Access) Act 2025 has made changes to the UK regime, so check the ICO's current guidance rather than older summaries.

In practice the UK approach matches the EU one: consent, recorded, with an easy opt-out, and marketing kept separate from service messages. Businesses selling into both the UK and the EU can run one consent standard that satisfies both.

• Collect opt-in that names WhatsApp. "Send me offers by WhatsApp" with a checkbox, not a pre-ticked box or a buried clause.
• Store consent per channel. Email, SMS and WhatsApp consent are separate facts about a person. Brainito stores each on the contact, and a campaign or flow step checks the right one before sending.
• Use the right template category. Order updates are utility; promotions are marketing. Mislabeling to save on fees is a policy violation Meta checks for.
• Honor STOP within the conversation. Record the opt-out against the contact so no later campaign reaches them.
• Answer within the window. A reply inside 24 hours can be free text; after that you need a template. Staff the inbox.
• Watch the quality rating. A falling rating means recipients are blocking you. Slow down and tighten the segment before Meta does it for you.

Brainito sends through your own WhatsApp Business account, reads your approved templates, shows your quality rating and tier, and keeps consent per contact and per channel. The WhatsApp marketing page walks through the setup. The rules are Meta's and your regulator's; the tooling is there to make following them the default.