WhatsApp for UK Businesses: Messaging, Consent and Automation Rules

WhatsApp for UK businesses is now a normal customer channel for salons, clinics, tradespeople and shops, but a business that messages customers there is bound by two sets of rules: WhatsApp's own business messaging policy and the UK's electronic marketing law. This guide explains what Meta's policy pages say about opt-in, templates and automation, and what the Information Commissioner's Office (ICO) and PECR say about consent, read on 14 November 2026. It covers when automation is allowed, how to get opt-in and what to do before using a bot. It is general information, not legal advice. Policies and guidance change, so the pages linked at the end should be checked before launch.

Key takeaways

• WhatsApp's Business Messaging Policy says businesses may contact people only if they have received opt-in permission confirming the person wants to hear from them.
• The policy says conversations a business starts must use an approved message template, while replies inside the 24-hour customer service window do not.
• The policy allows automation when responding during the 24-hour window, and it requires escalation paths such as a human agent, phone, email or support form.
• Under UK law, unsolicited marketing by electronic mail needs prior consent or the soft opt-in, and the ICO says the rules cover direct messages stored electronically.
• A business should keep consent records, honour opt-outs immediately and never rely on one channel's opt-in to market on another.

WhatsApp for UK businesses: what the policy requires

Meta's Business Messaging Policy, shown as last updated on 23 September 2026, says a business may contact a person only when it has the person's phone number or username and has received opt-in permission confirming that they wish to receive messages. Opt-in is the business's responsibility, and the business must comply with applicable laws. Meta's developer page on opt-in adds that the business must clearly state that the person is opting in, state the business name and comply with local law, and gives examples such as collecting opt-in on a website, in person or on paper. The policy also says businesses must respect requests to block, stop or opt out, and must not spam or surprise people. Users can block or report a business, and Meta may limit the number of messages a business can send when feedback is poor.

Templates and the 24-hour window

The policy says a business may initiate conversations only using an approved message template. Inside a 24-hour customer service window that opens when the person messages the business, a business can reply freely without a template. Outside the window, only approved templates may be sent. For a UK business this shapes real workflows: a reminder sent the day before an appointment is usually a business-initiated message that needs a template, while an answer to a customer's question can be a free-form reply. The guide to AI agent cost explains how Meta charges for these messages.

Automation and chatbots

The policy says a business may use automation when responding during the 24-hour window, and that it must offer escalation paths so that a person can reach a human or another channel. The pages read for this guide do not mention AI providers or general-purpose chatbots, so no statement about them is made here. A business using a chatbot should design it as a first responder with a clear handover. Meta's messaging guidelines also list unofficial clients, bulk messaging and auto-messaging among behaviour that can lead to enforcement when used to harm WhatsApp or its users. The difference between the official platform and a QR-linked connection is covered in the guide to the WhatsApp Business API versus a QR-linked agent.

What UK law adds

The ICO's guidance on electronic mail marketing says a business must not send marketing emails or texts to individuals without specific consent, that consent must be clear and given by a positive action and that pre-ticked boxes are not valid. Regulation 22 of PECR allows a soft opt-in for existing customers whose details were obtained in a sale or negotiation, for similar products, if a simple way to refuse was offered at collection and in every message. The ICO does not name WhatsApp, but says the rules cover direct messages stored electronically, so a business should treat WhatsApp marketing as covered. Routine customer service messages are not direct marketing, according to the ICO, unless they carry significant promotional material. The clinic angle is covered in the guide to WhatsApp appointment reminders for UK clinics.

A practical consent set-up

• Ask clearly: add an unticked box on booking forms such as "Message me about my appointment on WhatsApp", with a separate box for offers.
• Record it: keep the date, wording and source of each opt-in.
• Use the right route: reminders and replies are service messages, while promotions need consent or a valid soft opt-in.
• Make stopping easy: include a simple reply such as STOP, and apply it across the customer database.
• Keep lists clean: do not buy contact lists or add numbers from business cards without consent.
• Train staff: personal WhatsApp accounts should not be used to message customers from a business.

Before launching a WhatsApp bot

• Define the first-response job: opening hours, prices, booking links and simple questions.
• Add a human route: the policy requires an escalation path, so decide who picks up and when.
• Protect personal data: do not ask for sensitive details in chat unless needed, and explain how data is used in the privacy notice.
• Test with real questions: check the wrong answers before customers find them.
• Watch quality: monitor blocks and complaints, because poor feedback can limit sending.

Where CreativeIn Tek fits

CreativeIn Tek builds AI agents through its AI solutions service and the AI Agent product, which links to WhatsApp by QR code and does not use the official business platform, so the policy rules above, including templates, are not the whole picture for that route. CreativeIn Tek does not claim Meta approval, and a business should decide which connection method suits its risk. A team planning WhatsApp for UK businesses can talk to CreativeIn Tek about options.

Frequently asked questions

Do UK businesses need consent to message customers on WhatsApp?

WhatsApp's policy requires opt-in for business-initiated messages, and UK law requires consent or a soft opt-in for unsolicited marketing. Informational service messages are treated differently, so check which category applies.

Can a business use a chatbot on WhatsApp?

The policy allows automation when responding within the 24-hour window and requires escalation paths such as a human agent or another contact method.

What is a message template?

It is a pre-approved message a business must use to start a conversation outside the 24-hour customer service window.

Does PECR apply to WhatsApp?

The ICO does not name WhatsApp, but says the rules cover direct messages stored electronically, so businesses should treat marketing on WhatsApp as covered.

What is the 24-hour window?

It is the period after a customer messages the business during which the business can reply without a template.

Last reviewed: 14 November 2026, against the WhatsApp Business Messaging Policy and the ICO guidance on electronic mail marketing. Policies, guidance and law change, and this article is general information and not legal advice.