WhatsApp can carry marketing for a South African business only to people who gave you their number and agreed to hear from you. Meta’s policy says so, and South Africa’s data protection law says it more strictly. That leaves three decisions: which WhatsApp product to use, what Meta’s per-message model will cost, and which conversations must stay with a person. This is the guide KM Digital Solutions works from.
Which WhatsApp product does a business actually need?
The WhatsApp Business app handles conversations a person types on a phone. The WhatsApp Business Platform is Meta’s API, which Meta says “enables businesses to communicate with customers at scale” and which connects WhatsApp to other software. Most businesses start on the app and move to the Platform when volume, automation or record keeping demands it.
Almost every rule in this article, templates, windows and per-message charges, belongs to the Platform.
| What Meta’s pages say | WhatsApp Business app | WhatsApp Business Platform |
|---|---|---|
| Who Meta says it is for | “built with the small business owner in mind” | “developers using our APIs” |
| How a message gets sent | A person, in the app | Your software, which can “programmatically message and call on WhatsApp” |
| Messaging when no window is open | The policy’s template rule is Platform-specific | Only an approved template: “Template messages are the only type of message that can be sent to WhatsApp users outside of a customer service window” |
| Connecting a CRM or automation | Not described on Meta’s app page | Yes, through the API |
| What Meta charges | Not covered by the Platform pricing page | Per message, since 1 July 2025 |
The practical test is whether anything other than a person needs to send or read the messages. Booking confirmations, CRM logging and reminders that go out without someone typing them are Platform work. If one person with one phone can answer everything, the app is enough.
Do you need consent before sending WhatsApp marketing messages?
Yes, twice over. Meta’s policy lets you contact people only if they gave you their number and opted in to hear from you. South Africa’s data protection law treats direct marketing by electronic communication strictly, and a WhatsApp message fits the Information Regulator’s definition of one. Both rules apply at once, and the stricter one decides.
Meta’s side. The WhatsApp Business Messaging Policy states: “You may only contact people on WhatsApp if: (a) they have given you their mobile phone number; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you.” Meta’s opt-in guidance adds that businesses “must clearly state that a person is opting in to receive communication from the business” and “must clearly state the business’s name that a person is opting in to receive messages from”. Opt-outs are absolute: “You must respect all requests (either on or off WhatsApp) by a person to block, discontinue, or otherwise opt out of communications from you via WhatsApp, including removing that person from your contacts list.”
POPIA’s side. The Information Regulator’s Guidance Note on Direct Marketing, published in December 2024, defines electronic communication as “any text, voice, sound or image message sent over an electronic communications network which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient”. Its paragraph 7.1 list of unsolicited electronic methods is expressly “not limited to” telephone, email, SMS, push notifications, “Direct messaging in Instagram or LinkedIn” and others. WhatsApp is not named in the note; reading a WhatsApp message as one more stored message sent over a network is our interpretation, not the Regulator’s, but the definition is hard to read any other way.
For non-customers, the note is direct. Paragraph 7.2.1: a business “must obtain the consent of such a data subject before sending the communication”. Paragraph 7.2.2: you “may approach the data subject only once for the purpose of obtaining the consent”. Paragraph 7.2.8: “the responsible party bears the onus of proving that a data subject gave consent”. No record, no consent.
This is not legal advice. The Guidance Note itself says it “is advisory in nature” and “does not constitute legal advice”. For anything beyond routine opt-in marketing, ask a practitioner.
What satisfies both sets of rules is a well-kept record:
- Decide where the opt-in is captured: a form tick box, a click-to-chat reply or a checkout box. Meta says “It is up to businesses to determine the method of opt-in”.
- Name the business and say what they will receive. “Get WhatsApp updates from [business name] about your booking and occasional offers” passes; “Contact me” does not.
- Record when and how: date, source and the exact wording shown. The note says a data subject’s response “must be recorded”, and the onus is yours.
- Honour opt-outs everywhere, including a “stop” typed in the chat.
- Keep the objection list. Paragraph 7.3.5 requires you to “compile and maintain a database” of people who withheld consent or objected; the wider direct marketing rules cover the rest.
- Identify yourself and give a way to stop. Section 69(4) requires “details of the identity of the sender” and “an address or other contact details to which the recipient may send a request that such communications cease”.
What does the WhatsApp Business Platform cost?
Meta charges per message, and has since 1 July 2025; the older model that billed by conversation is deprecated. What you pay depends on the template’s category and whether a customer service window is open. Rates are set by the recipient’s country calling code on Meta’s rate card, so check the current rate for South African numbers before budgeting.
Meta’s pricing page, dated 10 September 2026, states: “Effective July 1, 2025, Meta charges on a per-message basis for messages businesses deliver to WhatsApp users”. Rates “vary based on the template’s category and the recipient WhatsApp phone number’s country calling code”, and templates “can be categorized as” marketing, utility or authentication. Non-template replies inside a window are what Meta’s update notes call service messages. When a customer messages you, “This opens a 24 hour customer service window”, and inside it “All non-template messages are free within an open customer service window” and “utility templates sent within an open CSW are free”. Outside it, only priced templates. If someone messages you from a “Click to WhatsApp Ad or Facebook Page Call-to-Action button” and you respond within 24 hours, “a Free Entry Point (“FEP”) window will be opened”, and “FEP windows remain open for 72 hours. While open, you can send any type of message to the user at no charge.”
Two cautions. This article gives no rand figure on purpose: Meta publishes rate cards by billing currency, marked “effective July 1, 2026”, so quote the live card with its date. And the page already announces changes effective 1 October 2026: “Charging for service messages, with rates the same as those of utility and authentication, by market”, with “a free monthly tier of 1,000 service messages per business phone number”, and charging for utility templates sent inside the window.
On top of Meta’s charges sit the provider that connects you to the API and the work to build the flows. Our automation service is “Scoped per workflow on a call”, and KM Digital Solutions, in Durbanville, Western Cape, scopes and builds WhatsApp Business Platform automations (opt-in capture, templates and CRM logging) on the same basis: quoted per client, not from a rate card.
What should you automate on WhatsApp, and what should stay with a person?
Automate acknowledgements, reminders, routing and record keeping. Keep judgement, complaints, pricing conversations and anything sensitive with a person. Meta’s own policy requires a clear route to a human whenever automation is answering, so the question is never whether a bot can reply, but whether you would stand behind the reply.
The policy is specific: “You may use automation when responding during the 24-hour window, but must also have available prompt, clear, and direct escalation paths”, such as “In-Chat Human Agent transfer”, a phone number, email or a support form. It also draws a privacy line: “You may not forward or otherwise share information from a customer chat with any other customer.”
A good filter is the one we use for any automation: the task should be repetitive, rule-based, documented and cheap to get wrong.
| Task | Automate? | Why |
|---|---|---|
| Acknowledging a new enquiry | Yes | A non-template reply inside a window the customer just opened; the cheapest message there is |
| Appointment or job reminder | Yes, as a utility template | Rule-based and dated; reviewed once, reused |
| Review request after a completed job | Yes, to opted-in customers only | Same message each time, triggered by a completion date and a recorded opt-in |
| Quote or pricing question | A person | It commits the business |
| Complaint | A person | The policy requires an escalation path, and a template cannot judge tone |
| Promotional broadcast | Only as a marketing template, to opted-in contacts | Outside a window only templates are allowed, and every recipient needs recorded consent |
KM Digital Solutions builds these flows with human review as the default, the standard on our automation page: “Anything that carries risk waits for a person to approve it.” The automation drafts, logs and reminds; a person sends anything that commits the business to a price, a date or an apology.
How do you connect WhatsApp to your CRM and measure it?
Give every WhatsApp contact a record that holds their consent state, the source of their number and the outcome of each conversation. Count WhatsApp enquiries as their own event, and do not mistake a click on a chat link for a conversation that happened. Without both, you can neither prove consent nor attribute a sale.
The record is your consent evidence, so it carries more than a number:
- Permission state: opted in, opted out or objected, with the date, wording and source of each change. This is the core of what a CRM must record for any marketing channel.
- Number source: the form, advert, checkout or sign-up it came from. A bought list fails Meta’s condition (a) and should not be messaged.
- Conversation outcome: quoted, booked, declined or unanswered.
- Who answered and how fast, because the 24-hour window is also a response-time budget.
A tap on a chat link is a click, worth counting; it is not an enquiry until a message arrives. Track clicks in analytics, conversations in the CRM and sales in invoicing. Every enquiry then gets the same follow-up, because what happens in the first hour decides whether it becomes a job, and when the flows outgrow off-the-shelf tools, that is usually when a bespoke build makes sense.
When is WhatsApp the wrong channel?
When you do not have the person’s opt-in, when nobody can reply while the customer is waiting, or when the message belongs in a document or a signed record rather than a chat. WhatsApp rewards fast, short, permitted exchanges and punishes the rest.
- Purchased or scraped numbers. They fail the policy’s first condition, that the person has “given you their mobile phone number”, and under POPIA the first message to a non-customer must itself be a request for consent.
- Nobody owns the inbox. If no one is responsible for replies during business hours, use a form and an email address until someone is.
- Long quotes and contracts. Send the document; use WhatsApp only to say it has been sent.
- Special personal information. The Regulator’s note gives biometric, health and genetic information as examples and says there are “stricter requirements” for processing it. Keep it out of automated flows.
Work out what to automate on WhatsApp
Tell us where WhatsApp messages come in today and who answers them. We will tell you what can be automated safely, what needs an opt-in first, and what should stay with a person.
Frequently asked questions
Can I send marketing to customers who gave me their number for an order?
Only with their opt-in, or if you meet POPIA’s customer conditions. Meta requires opt-in “confirming that they wish to receive subsequent messages”, and a number given for a delivery is not that. The Regulator’s note allows marketing to an existing customer without fresh consent when the details were obtained “in the context of a sale of a product or service”, the marketing is for your “own similar products or services”, and the person had “a reasonable opportunity to object” at collection and on each message; “silence cannot mean consent”. The customer exemption is explained with the rest of the direct marketing rules.
Is the WhatsApp Business app enough for a small business?
Often, yes. If one or two people can answer every message during business hours and the chat itself is the only record you need, the app does the job. Move to the Platform when a system must send messages, when consent and outcomes must be logged somewhere other than a phone, or when you need an audit trail.
How long do I have to reply to a customer without paying?
Twenty-four hours from their last message, on Meta’s current page. A customer’s message “opens a 24 hour customer service window”, and inside it non-template replies and utility templates are free. If the customer came through a click-to-WhatsApp ad or a Facebook Page button and you reply within 24 hours, a free entry point window opens for 72 hours, during which “you can send any type of message to the user at no charge”. Meta has announced charges for service messages from 1 October 2026 (see above).
Do WhatsApp message templates need approval?
Yes, and the review is automatic. Meta’s template documentation says “Templates are automatically reviewed upon creation or after editing”, and “If it is rejected, or if its status changes to any other value, it cannot be sent in template messages.” Each template carries a category, marketing, utility or authentication, that sets its price, and “Businesses are responsible for reviewing the category assigned to their approved templates”. Submit once and leave the approved version alone; editing triggers a fresh review.
Is WhatsApp marketing legal in South Africa?
Yes, when it is sent with the recipient’s opt-in and in line with POPIA’s direct marketing rules. The practical test is the Information Regulator’s Guidance Note on Direct Marketing: consent before the first marketing message to a non-customer, one request for that consent, the onus on you to prove it, sender identity and an opt-out route in every message, and a list of objections you keep. This is not legal advice.
Per-message pricing, template categories, the windows, rate cards and the October 2026 changes are from Meta’s Pricing on the WhatsApp Business Platform (dated 10 September 2026); the Platform description from About the WhatsApp Business Platform; template review from Meta’s template documentation; opt-in wording from Get opt-in for WhatsApp; the contact, opt-out, automation and chat-sharing rules from the WhatsApp Business Messaging Policy; the app description from Meta’s WhatsApp Business app page. The POPIA definitions, paragraphs 7.1 to 7.3.5 and the advisory status are from the Information Regulator’s Guidance Note on Direct Marketing (PDF), dated December 2024 on its guidance notes page. All accessed on 16 September 2026.
