WhatsApp Marketing Rules in the UK: What PECR, UK GDPR, the ICO and Meta Actually Require

Short answer: in the UK, a WhatsApp marketing message to an individual is treated like a marketing email or text under the Privacy and Electronic Communications Regulations (PECR). You need the person's consent, or you must meet every condition of the soft opt-in (existing customer, similar products, a simple opt-out offered when you collected the number and in every message). You must say who you are and give a working way to opt out. The Information Commissioner's Office (ICO) enforces this, and since 5 February 2026 it can fine up to £17.5 million or 4% of global turnover for PECR breaches, up from £500,000. The Telephone Preference Service covers calls, not messages. Meta's WhatsApp policy adds its own opt-in and opt-out duties on top. This guide is general information, not legal advice.

Which rules apply to a WhatsApp campaign

UK businesses often hear "GDPR" and assume that is the whole story. For marketing messages there are three layers, and the most specific one is not GDPR.

The content of a marketing message, such as whether a price claim is misleading, falls under the UK advertising codes as well, but that is a separate question from whether you may send it at all, which is what this guide covers.

PECR: the rules that bite on marketing messages

What counts as "electronic mail"

PECR defines electronic mail as any text, voice, sound or image message sent over a public electronic communications network that can be stored in the network or on the recipient's device until they collect it. The ICO's guidance on electronic mail marketing lists emails, texts, picture messages, video messages, voicemails and direct messages via social media, plus "any similar message that is stored electronically". It adds that if you are marketing using direct messaging via social media, the electronic mail rules apply.

The ICO page does not mention WhatsApp by name. A WhatsApp message is a stored text, image or voice message sent to someone's phone, so the sensible reading, and the one we follow, is that a WhatsApp marketing message is electronic mail for PECR. Plan as if it is.

Regulation 22: consent, or the soft opt-in

You may not send unsolicited direct marketing by electronic mail to an individual subscriber unless they have consented to receive it from you. Consent must meet the UK GDPR standard: freely given, specific, informed, and a clear positive action. A pre-ticked box, or a line in your terms and conditions, is not consent.

The exception is the soft opt-in, and it is narrower than many people think. According to the ICO you can rely on it only when all of these are true:

• you got the contact details from the person in the course of a sale, or negotiations for a sale, of a product or service;
• you are marketing your own similar products or services;
• you gave them a simple way to opt out when you collected the details; and
• you give them a simple way to opt out in every message.

It does not cover prospects who never bought or got a quote, numbers from bought-in lists, or another company's products. In practice: a Shopify customer who bought trainers can receive your new-season trainers on WhatsApp under the soft opt-in, provided you showed an opt-out at checkout. Someone who only entered a competition cannot.

Charities: a new soft opt-in from 5 February 2026

The Data (Use and Access) Act 2025 added a charitable-purposes soft opt-in to PECR, in force since 5 February 2026. The ICO says charities can now contact supporters by email, text and direct message without prior consent if they meet strict conditions, broadly: the person expressed an interest in, or offered support for, the charity's purposes; the messages only further those purposes; and an opt-out is offered at collection and in every message. It is for registered charities only.

Regulation 23: say who you are

Every marketing message must identify the sender and give a valid address where the person can ask you to stop. The ICO puts it plainly: "You must not disguise or conceal your identity, and you must provide a valid contact address so they can opt out or unsubscribe." On WhatsApp, your verified display name helps, but put your brand name in the template text too, and give a reply-based opt-out such as "Reply STOP".

Business customers

The consent rule in regulation 22 protects individual subscribers. The ICO says you can email or text a corporate body (a company, a Scottish partnership, an LLP or a government body) without consent, but sole traders and some partnerships are treated as individuals. Two cautions for WhatsApp. First, most WhatsApp numbers are personal mobiles, even when the person uses them for work, so do not assume a business contact's WhatsApp is a corporate subscription. Second, regulation 23 still applies to business recipients, and a named employee's number is still personal data under UK GDPR.

UK GDPR: the data protection side

• Lawful basis. Where PECR requires consent, that consent is also your lawful basis for the processing. Where the soft opt-in applies, businesses usually rely on legitimate interests for the data processing.
• Transparency. Tell people at the point of collection that you will use WhatsApp for marketing, and link to a privacy notice that says so.
• The right to object. Anyone can object to direct marketing at any time, and you must stop. There are no exceptions. An opt-out received by email, by phone, in a shop or on WhatsApp counts.
• Keep evidence. Record when, where and how each person opted in, and what they were shown. If the ICO asks, "they gave us their number" is not evidence.
• Suppression, not deletion. Keep a minimal record of people who opted out, so a future import does not message them again.

The Data (Use and Access) Act 2025: what changed in 2026

The Act received Royal Assent in June 2025 and has been brought into force in stages. The stage that matters for marketers commenced on 5 February 2026. The ICO's statement that day said the Act gives it the power to issue "fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations". Before that, the maximum PECR fine was £500,000, which is why many businesses treated text and email rules as low-risk. That calculation no longer holds: PECR penalties now sit at the same level as UK GDPR's higher tier.

The ICO also said one further data-protection change, the requirement for organisations to have a complaints procedure, was due to commence on 19 June 2026. For a business that runs WhatsApp campaigns, the simplest response is to make sure complaints about marketing messages have somewhere to go and someone who answers them.

What did not change: the consent rule, the soft opt-in for businesses, and the duty to identify yourself and offer an opt-out are the same as before. The ICO notes its electronic mail guidance is being reviewed because of the Act, so check the current version before a major campaign.

TPS, CTPS and quiet hours

The Telephone Preference Service and the Corporate TPS are registers for people and organisations who do not want unsolicited live marketing calls. They do not cover texts, emails or WhatsApp messages, so screening a WhatsApp broadcast list against TPS is not what the law asks. The consent and soft opt-in rules above are. If you use WhatsApp calling to make sales calls, treat those as marketing calls and check the call rules before you dial.

UK law sets no fixed hours for marketing messages. Common sense does: a 10pm offer on a Tuesday gets blocked and reported, and blocks lower your quality rating with Meta. Most UK retailers keep broadcasts between about 9am and 8pm and avoid Sunday mornings. In QuickWA you set a sending window in Settings; scheduled broadcasts wait until it reopens. It is off until you switch it on.

Meta's own rules

Meta's WhatsApp Business Messaging Policy (last updated 23 September 2026) says you may only contact people on WhatsApp if they have given you their number and "you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages". You are "solely responsible for determining the method of opt-in". You must "respect all requests (either on or off WhatsApp) by a person to block, discontinue, or otherwise opt out". Meta can limit your ability to send, or remove access, if you break the policy.

Two more Meta mechanisms enforce this in practice. Template categories: a marketing message must be submitted as marketing, and a utility template carrying an offer can be recategorised. Quality rating: blocks and reports lower your number's rating, which can pause templates and cap your growth. Meta usually acts faster than any regulator, so an opt-in that would satisfy the ICO but annoys people will still cost you.

Common situations, answered

A practical checklist

1. Capture consent properly: an unticked box or a clear question at checkout, booking or sign-up, naming WhatsApp and the kind of messages.
2. Show the opt-out at collection if you rely on the soft opt-in, and keep a screenshot of the form.
3. Record the source and time of every opt-in against the contact. QuickWA keeps consent status on each contact and switches marketing off automatically when someone sends STOP or UNSUBSCRIBE (English keywords).
4. Identify yourself in every template: brand name in the body, not just the display name.
5. Put an opt-out in every marketing template: "Reply STOP to opt out" or an opt-out button, and test it.
6. Honour opt-outs from any channel, including a phone call or an email, across every WhatsApp number you use.
7. Keep utility messages clean: no offers in delivery updates or reminders.
8. Never upload bought or scraped lists.
9. Re-permission old app contacts before your first broadcast from the API.
10. Set sending hours and keep frequency sensible.
11. Have a complaints route and answer it.
12. Review the ICO guidance before large campaigns, since it is being updated after the 2025 Act.

None of this makes a campaign compliant on its own; it is the groundwork. For a specific campaign, especially one involving bought data, sensitive sectors or children, ask a UK data protection lawyer. To see how QuickWA handles consent and opt-outs for UK businesses, visit our UK page, and for setup steps see how to get the WhatsApp Business API in the UK.

Sources

• ICO, electronic mail marketing (definition, social media direct messages, soft opt-in, corporate subscribers, identification): ico.org.uk (checked 26 Oct 2026)
• ICO, statement on the commencement of the Data (Use and Access) Act, 5 February 2026 (PECR fines up to £17.5 million or 4%; complaints procedure from 19 June 2026): ico.org.uk (checked 26 Oct 2026)
• ICO, charities given new flexibility to contact supporters, 28 April 2026: ico.org.uk (checked 26 Oct 2026)
• Hill Dickinson, Data (Use and Access) Act: changes come into effect (previous PECR maximum £500,000): hilldickinson.com (checked 26 Oct 2026)
• The Privacy and Electronic Communications (EC Directive) Regulations 2003: legislation.gov.uk (checked 26 Oct 2026)
• WhatsApp Business Messaging Policy (updated 23 September 2026): whatsappbusiness.com (checked 26 Oct 2026)
• Meta, template category guidelines: developers.facebook.com (checked 26 Oct 2026)