WhatsApp Marketing Rules in the Netherlands: What the Telecommunicatiewet, the AVG, the ACM and Meta Actually Require

Short answer: promotional WhatsApp messages in the Netherlands fall under the spam rule in article 11.7 of the Telecommunicatiewet, enforced by the ACM, which lists WhatsApp messages ("whatsappjes") alongside email in its own guidance. You need prior, specific consent that you can prove for up to 5 years, unless the person is an existing customer and the message is about similar products of your own, with an opt-out offered when you collected the number and in every message. Every message must show who you really are and give a simple, free way to stop. The AVG (GDPR), supervised by the Autoriteit Persoonsgegevens, adds an absolute right to object to direct marketing. Meta's WhatsApp policy separately requires opt-in and honouring every opt-out. This is general information, not legal advice; for a specific campaign, ask a Dutch lawyer.

Three sets of rules, and which ones cover WhatsApp

Dutch businesses often hear "you need permission for WhatsApp" without hearing which law says so. There are three layers, plus one register that is regularly misunderstood.

Article 11.7 in plain English

The current text (version in force from 15 August 2026 on wetten.overheid.nl) contains four parts that matter for WhatsApp:

• Prior consent (lid 1). Using electronic messages to send unsolicited communication for commercial, idealistic or charitable purposes is prohibited, unless the sender can show that the recipient gave prior consent. Note where the burden lies: on the sender.
• Business recipients (lid 3). Consent is not required when you message a legal entity, or a person acting in their profession or business, at an electronic address they published for receiving such communication, used for the purpose they attached to it. A KvK-registered sole trader's personal 06 number that is not published for that purpose is not covered by this.
• Existing customers (lid 4). A sender who obtained a customer's electronic contact details in the context of a sale of a product or service may use them for commercial messages about its own similar products or services, provided the customer was clearly given a free and easy chance to object when the details were collected, and again in every message.
• Identity and a way to stop (lid 7). Every such message must state the real identity of the party on whose behalf it is sent, and a valid address or number to which the recipient can send a request to stop.

What the ACM says in its own guidance

The ACM's page on preventing spam opens with "Voorkom spam als u reclame maakt via e-mail, whatsappjes of andere elektronische berichten". It then sets out what it looks for:

• Recipients chose consciously, and the choice was clearly about advertising or promotional messages. A pre-ticked box, or consent buried in general terms and conditions, does not count.
• You can prove that consent for up to 5 years after sending.
• You show that you are the sender, and you do not use an alias ("geen fantasienaam").
• Every message contains a way to unsubscribe that is quick (not a complicated questionnaire) and free.
• Existing customers may receive unsolicited messages about products or services related to earlier purchases, as long as they can unsubscribe.

What this means on WhatsApp

QuickWA processes STOP replies automatically and excludes the contact from later broadcasts. It recognises English keywords such as STOP and UNSUBSCRIBE; Dutch words such as "afmelden" are not yet recognised automatically. Because "STOP" is the word Dutch customers already know from SMS, ask for exactly that word in your footer, and have someone review other replies after each campaign.

Transactional messages are a different thing

A track-and-trace update for an order a customer placed, or a reminder for an appointment they booked, is not unsolicited commercial communication in the ordinary sense. It is also a utility template in Meta's terms. The moment you add "and 10% off your next order", it becomes promotional, for Meta's pricing and for the consent question alike.

The existing-customer exception, done properly

Lid 4 is the reason Dutch webshops can message buyers without a separate marketing tick box, but its conditions are strict:

• A sale must have happened. Someone who only created an account, entered a giveaway or asked a question is not a customer under this rule.
• Only your own similar products. A bike shop that sold an e-bike can offer a service check or accessories. It cannot use the number to promote a partner's insurance or a sister company's products.
• Opt-out at collection. The checkout must clearly offer the chance to refuse marketing at the moment the number is collected, for example an "I do not want offers by WhatsApp" choice next to the phone field.
• Opt-out in every message. Each template must carry the STOP footer or button.

How long someone stays an "existing customer" for messages is not set in article 11.7. For telemarketing calls, Dutch sector self-regulation uses three years after the customer relationship ends, as reported when the opt-in rule took effect. Re-permissioning older customers with a clear question is the safer route.

The common grey areas

• "They gave their number for delivery." A number entered for a courier is collected in the context of a sale, but only covers marketing if the checkout offered the refusal option at that point.
• Bought, rented or shared lists. A list from a lead supplier or a partner carries no consent for your marketing, and you cannot prove consent that someone else collected. The ACM held an affiliate network responsible for exactly this.
• Years of WhatsApp Business app chats. Talking to a customer often does not, on its own, prove consent to broadcasts. Send a short re-permission message first.
• Click-to-WhatsApp ads. A person who taps your ad and writes first started the conversation, so answering is fine. Adding them to future broadcasts still needs their opt-in.

The AVG layer: lawful use, information and the right to object

Whatever the Telecommunicatiewet allows, the AVG governs how you handle the data behind it. Four points matter most for WhatsApp:

• Tell people. Your privacyverklaring should say that you use WhatsApp, for what, and that Meta processes the messages.
• The right to object is absolute for direct marketing. The Autoriteit Persoonsgegevens explains (page updated March 2026) that once someone objects to direct marketing, the organisation may no longer send it, and may not ask why. Treat any "stop sending me offers", by WhatsApp, email or phone, as covering WhatsApp too.
• Contracts with processors. Any provider that stores your customers' chats on your behalf is a processor; the AVG requires a written processing agreement (verwerkersovereenkomst). Ask your provider for its data-processing terms before you import contacts.
• Health and other sensitive data. For a physio practice or clinic, the fact that someone is a patient can itself be health data. Keep diagnoses and treatment details out of templates; "your appointment on Tuesday at 10:00" is enough.

Who enforces it, and what it can cost

The ACM supervises the spam rule and acts on complaints. Under article 15.4 of the Telecommunicatiewet it can impose a fine of up to EUR 900,000, or 1% of turnover if that is higher, for breaches of the provisions it supervises. Its best-known spam case was against the affiliate network Daisycon, which it fined a total of EUR 810,000 in 2013 because consent from recipients had not been shown; the ACM also held two executives liable. The AP enforces the AVG, where the GDPR caps fines at EUR 20 million or 4% of worldwide annual turnover for the most serious breaches.

The Bel-me-niet Register is about calls

The Bel-me-niet Register was an opt-out list for telephone sales. Since 1 July 2021, sales calls to natural persons require their explicit consent, or an existing or recent customer relationship, and the register was replaced by that opt-in rule. It never covered WhatsApp text messages. If you use WhatsApp voice calls to sell (QuickWA includes calling from Pro), treat an outbound sales call to a consumer like any other telemarketing call and get consent first.

Is there a legal sending-hours rule?

We found no Dutch rule that sets hours for WhatsApp marketing. Good practice is daytime and early evening on weekdays, a lighter touch on Sundays, and no promotions at all on the evening of 4 May, when the country observes two minutes' silence for Dodenherdenking at 20:00. QuickWA lets you set a sending window in Settings, which is off by default; once on, scheduled broadcasts wait until it reopens.

Meta's own rules

Meta enforces its WhatsApp Business Messaging Policy on every account, and usually acts faster than a regulator.

• Opt-in first. You may contact people only after they gave you their number and you "received opt-in permission from the recipient". Meta encourages separate opt-ins per message category.
• Honour every opt-out, whether the request arrives on or off WhatsApp, and explain clearly how people can opt out of specific categories.
• Templates outside the 24-hour window. Business-initiated conversations must start with an approved template, and utility templates must not be promotional.
• Do not surprise people. The policy tells businesses not to "confuse, deceive, defraud, mislead, spam, or surprise people".

Meta's enforcement ladder

A warning naming the policy; then a 1- or 3-day block on sending templates and adding numbers; then a 5-, 7- or 30-day block on sending any messages; then an account lock that only an appeal can lift; and finally permanent removal from the platform after repeated violations. Scams and other severe harm can lead to immediate offboarding. Appeals go through Business Support Home, with decisions typically in 24 to 48 hours, though not every spam violation can be appealed.

A practical checklist for Dutch businesses

1. Map every contact source: webshop checkout, booking system, in-store sign-up, Click-to-WhatsApp ad.
2. Separate customers from prospects. Customers can fall under the lid 4 exception; everyone else needs prior consent.
3. Fix the checkout: an unticked WhatsApp opt-in, or for customers a clear refusal option next to the phone field.
4. Store proof for at least 5 years: date, source, wording, language.
5. Use the real brand name in the display name and the template body.
6. Put "Stuur STOP" in every marketing template and make sure it works automatically.
7. Keep utility clean: no offers in order, delivery or appointment templates.
8. Re-permission old app contacts before the first broadcast.
9. Update your privacyverklaring and sign a processing agreement with your provider.
10. Respect quiet moments: evenings, Sundays, 4 May.
11. Watch your quality rating after every campaign, and slow down if it drops.

Software helps, but no tool makes a campaign lawful on its own: what counts is how you collected consent and what you send. For setup, see the QuickWA Netherlands page; for timing, the Dutch campaign calendar.

Sources

• Telecommunicatiewet, article 11.7 and article 15.4 (version from 15 August 2026): wetten.overheid.nl (checked 26 Oct 2026)
• ACM, "Spam voorkomen" (WhatsApp named, consent, 5-year proof, alias, unsubscribe, existing customers): acm.nl (checked 26 Oct 2026)
• ACM, "ACM legt boete op voor overtreding spamverbod" (Daisycon, EUR 810,000): acm.nl (checked 26 Oct 2026)
• Autoriteit Persoonsgegevens, "Recht van bezwaar" (direct marketing, updated March 2026): autoriteitpersoonsgegevens.nl (checked 26 Oct 2026)
• GDPR (AVG), article 83 on fines: eur-lex.europa.eu (checked 26 Oct 2026)
• Telecompaper, telemarketing opt-in from 1 July 2021 and the three-year customer period: telecompaper.com (checked 26 Oct 2026)
• WhatsApp Business Messaging Policy: whatsappbusiness.com (checked 26 Oct 2026)
• Meta, policy enforcement: developers.facebook.com (checked 26 Oct 2026)