Is bulk WhatsApp messaging legal?
Sending business messages on WhatsApp is legal in most countries when the recipient consented to hear from you, you identify yourself, and you honour opt-out requests. What creates legal exposure is messaging people who never agreed — that can breach data-protection law such as GDPR or India's DPDP Act, and separately breaks WhatsApp's own Terms of Service, which is a contractual matter rather than a criminal one.
This page is general information, not legal advice. Marketing and data-protection rules vary by country and change over time. If you are sending at scale or across borders, take proper advice for your jurisdiction.
Two separate questions
People usually collapse these into one, and they have different answers:
| Question | Governed by | Consequence if you get it wrong |
|---|---|---|
| Is it lawful to message these people? | Data protection and marketing law in your country and theirs | Regulatory fines, complaints, civil claims |
| Does WhatsApp allow how I am sending? | WhatsApp's Terms of Service | Your number is restricted or banned |
You can be entirely lawful and still lose a number for sending in a way WhatsApp dislikes. You can also comply with WhatsApp's terms and still breach privacy law by messaging people who never consented. Both need to be right.
The legal side: consent is the dividing line
Most modern marketing and privacy regimes work on the same principle — you need a lawful basis, and for direct marketing to individuals that usually means consent that was freely given, specific and recorded.
- EU / UK (GDPR, PECR) — consent for direct electronic marketing, with a narrow exception for existing customers about similar products. Every message must allow opting out.
- India (DPDP Act) — notice and consent for processing personal data, with the right to withdraw it. Telemarketing rules apply separately.
- United States (TCPA and state law) — consent rules written for calls and texts are commonly applied to messaging apps too; penalties are per message and add up quickly.
- Elsewhere — most countries have adopted something similar. Assume consent is required unless you know otherwise.
A purchased list is not consent. Neither is a number scraped from a website, a directory, or a WhatsApp group you joined. Consent has to have been given to you, for this, and you need to be able to show it.
What good consent looks like
- The person gave you the number themselves — a form, a checkout, a sign-up, a reply to your ad.
- It was clear they would receive WhatsApp messages from your business.
- You kept a record: where it came from and when.
- They can stop it easily, and you act on that immediately.
BuzzRelay's custom fields are a practical place to store the source and date of consent alongside each contact, so it travels with the record and you can show it if challenged.
The platform side: WhatsApp's own terms
Separately from the law, WhatsApp's Terms of Service prohibit sending bulk, automated or unsolicited messages. In practice enforcement is behavioural rather than technical — the signal that gets a number restricted is recipients blocking and reporting it.
This is a contractual relationship, not a criminal one. The realistic consequence of breaking it is losing the number, not prosecution. But losing numbers repeatedly is an expensive way to run a channel, which is why the consent question matters commercially as well as legally.
Practical compliance checklist
- Only message people who gave you their number for this purpose.
- Identify yourself in the first line — business name, not just a first name.
- Include an opt-out and honour it the same day. "Reply STOP and I won't message again" is enough.
- Keep proof of consent — source and date, per contact.
- Delete on request. Under GDPR and DPDP, people can ask you to erase their data.
- Respect local hours. Some jurisdictions restrict marketing at night; use Quiet Hours.
- Do not message minors or scrape numbers from groups you joined for the purpose.
Where BuzzRelay sits in this
BuzzRelay is a tool that automates sending from your own WhatsApp account on your own computer. It does not supply contacts, and it has no view of whether the people in your list consented — that is entirely your responsibility as the sender, and it is where essentially all of the legal risk lives.
What the software does provide is the mechanics of sending responsibly: per-device daily limits, randomised delays, quiet hours, custom fields for recording consent, and per-recipient logs so you can show what was sent and when. See Acceptable use policy for what we will and will not support.
Frequently asked questions
Is it legal to send bulk WhatsApp messages?
In most countries it is legal to send business messages on WhatsApp when the recipient consented, you identify yourself and you honour opt-outs. Messaging people who never consented can breach data-protection law such as GDPR or India's DPDP Act, and separately breaks WhatsApp's Terms of Service.
Can I message a list I bought?
No. A purchased or scraped list is not consent under GDPR, the DPDP Act or comparable regimes, and it is also the fastest way to get a number banned because those recipients report the messages. Consent must have been given to you, for this purpose, and be recorded.
Will I be prosecuted for breaking WhatsApp's Terms of Service?
Breaking the Terms of Service is a contractual matter, not a criminal one, and the realistic consequence is that your number is restricted or banned. Legal exposure comes from the separate question of whether you had a lawful basis to message those people.
What counts as proof of consent?
A record of where and when the person gave you their number for this purpose — a form submission, a checkout, a sign-up, or a reply to an ad. Storing the source and date against each contact, for example in a BuzzRelay custom field, means the evidence travels with the record.
Last updated: