WhatsApp Marketing Rules in Kuwait (2026): What CITRA, Kuwaiti Law and Meta Actually Require

Short answer: Kuwait has no single, state-wide data-protection statute. CITRA's Data Privacy Protection Regulation (Decision No. 26 of 2024) applies only to CITRA-licensed telecom and internet providers, and CITRA's marketing-message rules — commercial messages only between 7 AM and 10 PM Kuwait time, an opt-out database, verified recipients — are likewise written for licensees. For an ordinary Kuwaiti shop, clinic or showroom on WhatsApp, the binding rules come mainly from Meta's WhatsApp Business policy (opt-in, honouring opt-outs, approved templates) plus Kuwait's general Electronic Transactions and Cybercrime laws. Following CITRA's licensee rules anyway is the sensible standard.

This guide explains the rules as published by Meta and as summarised by Kuwaiti and international law firms. It is general information, not legal advice; for a specific situation, ask a Kuwaiti lawyer.

The legal landscape in one table

Two things follow from that table. First, Kuwait has no single data-protection regulator: CITRA, the Central Agency for Information Technology and the National Centre for Cybersecurity (established by Decree No. 37 of 2022) each oversee parts of the field. Second, for a typical business the rule that will actually bite first is not a Kuwaiti statute — it is Meta's enforcement on your WhatsApp account.

CITRA's Regulation No. 26 of 2024 — what it is and is not

CITRA published Decision No. 26 of 2024 in the Official Gazette on 18 February 2024, replacing the 2021 regulation and its amendments. According to the Chambers Data Protection & Privacy 2026 practice guide for Kuwait, the current version "now applies exclusively to CITRA-licensed telecom and internet providers". Law-firm summaries describe its main duties for those licensees:

• Consent before collecting and processing personal data, with the conditions disclosed.
• Plain-language terms in Arabic and English, including how users can ask for their data to be changed or deleted.
• Purpose limitation — data used only for the purposes stated.
• Prompt breach notification to CITRA and appropriate security measures.
• Conditions on transfers outside Kuwait.

Sources disagree on the effective date (some give 19 February 2024, others 1 January 2025), and the regulation does not specify penalty amounts, according to one compliance summary. If your business is not a CITRA licensee, the regulation does not bind you directly — but it is the clearest statement of what a Kuwaiti regulator considers fair handling of personal data, and following it costs little.

The 7 AM–10 PM rule: written for SMS and telecom, best practice for WhatsApp

The marketing-hours rule is the one most often repeated by Kuwaiti marketers, and it needs care. As the Chambers guide summarises it, licensees sending messages for commercial purposes "must only do so between the hours of 7am and 10pm Kuwait time", must keep a database of users who have asked not to receive spam, and must have verified the identity of the recipient. We could not obtain CITRA's official text, so we are relying on that legal summary; SMS-vendor guides vary — some list no time restriction at all.

What this means in practice:

• If you send SMS through a Kuwaiti operator or aggregator, your provider is a licensee and will apply these rules to your traffic.
• If you send on WhatsApp, your messages do not pass through a Kuwaiti SMS licensee, and an ordinary shop or clinic is not itself a CITRA licensee. The rule is therefore best practice rather than a legal obligation for your WhatsApp campaigns — but it reflects what Kuwaiti customers expect, and a 10:30 PM promotion is exactly the kind of message that gets reported.
• Ramadan is the exception to plan for. Kuwait's evenings run late during Ramadan, with iftar, Taraweeh and the ghabga gathering. Staying inside 7 AM–10 PM still leaves you the hour after iftar, which is when Ramadan offers perform; it does not require sending at midnight.

In QuickWA you set a sending window in Settings — for example 7 AM–10 PM Kuwait time — and any scheduled broadcast that falls outside it waits until the window reopens instead of going out.

Meta's rules: the ones enforced on your account

Opt-in

Meta's policy says you may contact people only if they gave you their number and you have "received opt-in permission from the recipient confirming that they wish to receive subsequent messages". You choose the method, and you are responsible for any notices the law requires. Meta's best-practice guidance is to communicate clearly what the customer will receive and why it is useful, and, ideally, to collect opt-in separately per category of message, with a separate opt-in before calling someone.

Opt-out

You "must respect all requests (either on or off WhatsApp)" to stop. A customer who tells your Salmiya branch manager in person to stop messaging, or replies "وقف" (stop) in Arabic, has opted out just as much as one who types STOP. Remove them from every list, not just the campaign they replied to.

Templates and categories

Business-initiated conversations need an approved template. Marketing, utility and authentication are separate categories, and Meta treats a template that mixes an update with a promotion as marketing. In Kuwait that matters twice: miscategorising risks rejection, and marketing costs $0.0792 per message against $0.044 for utility.

Human escalation

If a bot answers customers, Meta requires "prompt, clear, and direct escalation paths" to a human — an in-chat agent transfer, a phone number, an email or a store visit.

The enforcement ladder

Meta's policy-enforcement documentation describes escalating restrictions for repeated violations:

1. A 1- or 3-day block on sending marketing, utility and authentication templates, and on adding numbers.
2. A 5-, 7- or 30-day block on sending any messages.
3. An account lock — an indefinite block that can be removed only through an appeal.
4. Permanent disablement if the business does not change after multiple warnings.

Separately, customer blocks and reports lower your quality rating, which can cap your messaging limit long before any formal violation.

Kuwait-specific risks worth thinking about

• A very international audience. According to PACI figures reported by Kuwait Times, Kuwaitis were 29.85% of a population of about 5.24 million at the end of 2025, with Indians (1.059 million), Egyptians (667,000), Bangladeshis and Filipinos the largest expatriate groups. An opt-in written only in Arabic may not be "informed" for a customer who reads English, Malayalam or Tagalog. Offer the opt-in and the opt-out instruction in the customer's language.
• Bought or inherited lists. Exhibition visitor lists, a previous employer's customers or a "Kuwait numbers" file sold on social media come with no opt-in at all. Messaging them is a Meta violation and, where the data was taken without authorisation, potentially a Cybercrime Law problem.
• Classified-ad leads. A buyer who messaged your car listing on 4Sale opted in to talk about that car. That does not make them a subscriber to your monthly offers; ask before adding them.
• Health and personal data. Clinics should keep reminders factual and avoid naming the treatment in a template preview — the lock screen of a family phone is not private.
• Data stored abroad. Your WhatsApp platform will typically store data outside Kuwait. If you are a CITRA licensee, the transfer conditions in Regulation No. 26 apply; if you are not, mention it in your privacy notice anyway.

A practical compliance checklist for Kuwaiti businesses

QuickWA tracks how each contact opted in, applies STOP opt-outs automatically across broadcasts and journeys, and holds scheduled broadcasts outside your sending window. Those tools help you follow good practice; they do not make anyone compliant on their own — that depends on how you collect consent and what you send. More on the Kuwait page.

Sources

• Chambers — Data Protection & Privacy 2026, Kuwait (DPPR scope, no single statute, commercial-message hours, opt-out database, regulators): practiceguides.chambers.com (checked 23 Oct 2026)
• Al Tamimi & Co. — CITRA Decision No. 26 of 2024, published 18 Feb 2024, replacing No. 42 of 2021: tamimi.com (checked 23 Oct 2026)
• Access Partnership — summary of the regulation's obligations: accesspartnership.com (checked 23 Oct 2026)
• Effective-date and penalty notes (third-party compliance summaries): clym.io (checked 23 Oct 2026)
• Meta — WhatsApp Business Messaging Policy (opt-in, opt-out, escalation): whatsappbusiness.com/policy (checked 23 Oct 2026)
• Meta — policy enforcement (restriction ladder): developers.facebook.com (checked 23 Oct 2026)
• Meta — template categorisation and pricing: categorisation, pricing (checked 23 Oct 2026)
• Kuwait population end-2025, PACI data via Kuwait Times: kuwaittimes.com (checked 23 Oct 2026)