Guide

The rules for messaging customers on WhatsApp in the UK and India

8 min read · Updated 16 October 2026 · InfrAgent AI

The short version

Three sets of rules apply at once: Meta's platform policy, your country's privacy law, and your country's marketing law. You have to satisfy all three.
Reply freely within 24 hours of a customer messaging you. Beyond that, and for anything promotional, you need their permission.
"STOP" must work, immediately, every time, on every channel.
This is a plain-English summary, not legal advice. For a specific situation, ask a professional.

Why there are three sets of rules

Messaging a customer on WhatsApp is regulated by three things at once, and businesses get into trouble by satisfying one and forgetting the others. First, Meta's own rules for the WhatsApp Business Platform. These apply everywhere, because WhatsApp is Meta's product and it can switch your number off. Second, your country's data protection law, which governs the personal data (the phone number, the name, the order history) you hold about the customer. Third, your country's rules on electronic marketing, which govern whether you may send promotional messages at all. This guide covers the UK and India, which is where InfrAgent AI's customers are. It is a summary for business owners, not legal advice.

Meta's rules, which apply everywhere

Meta's rules are the first filter, and in practice the strictest, because enforcement is automatic.

The 24-hour window. When a customer messages you, you may reply with any message for 24 hours. After that, you may only send a pre-approved template message.
Opt-in. Before you send a customer a message they did not start - a reminder, an offer, an update - you must have their permission to message them on WhatsApp, and you should be able to show it.
Templates. Messages you start must use a template that Meta has approved. Marketing templates are reviewed more strictly than utility ones such as a booking confirmation.
Opt-out. If a customer asks to stop, you stop. Meta expects businesses to honour this, and customers who block or report you damage your number's quality rating.
Quality rating. Too many blocks or reports and Meta limits how many people you can message, then suspends the number. There is no appeal that works quickly.

The UK: UK GDPR and PECR

In the UK two laws matter. UK GDPR covers the personal data; the Privacy and Electronic Communications Regulations (PECR) cover whether you may send the marketing message at all. The regulator for both is the Information Commissioner's Office (ICO), which does fine businesses for unsolicited electronic marketing. Under PECR, sending a marketing message to an individual by electronic means - and a WhatsApp message counts - generally needs that person's consent. There is a narrow exception called the soft opt-in: if someone gave you their details while buying something from you, you may market similar products to them, provided you gave them a clear chance to refuse at the time and in every message since. Business-to-business messaging has looser rules, but a sole trader or partnership is treated as an individual. Under UK GDPR, you need a lawful basis to hold the number at all, you must tell people what you do with it (your privacy notice), and you must delete it when you no longer need it. Keep a record of when and how each person agreed to be messaged. If the ICO asks, "they messaged us first" is an answer for the 24-hour window, not for a promotion three weeks later.

India: the DPDP Act and Meta's rules

India's Digital Personal Data Protection Act 2023 is the data protection law, with its detailed rules being brought in in stages. It is built around consent: to process a person's personal data you generally need their clear, informed consent for a stated purpose, you must tell them what you are collecting and why, and they have the right to withdraw consent and to have their data erased. Fines under the Act are substantial. India's telecom regulator (TRAI) runs the rules and the do-not-disturb registry for SMS and voice calls. Those rules were written for SMS and calls rather than for WhatsApp, so for WhatsApp the day-to-day constraint on promotional messages is Meta's own opt-in and template policy, sitting on top of the DPDP Act's consent requirements. In practice that means the same discipline as the UK: get permission before you start a conversation, keep a record of it, and stop when asked.

What this means in practice

Put the three together and the working rules for a small business are short.

If a customer messages you, answer. You have 24 hours to reply freely.
Before you send anything the customer did not ask for, get their permission, in a way you can show later: a tick box at checkout, a line on the booking form, a "reply YES to get reminders" message.
Keep the permission with the customer record, with the date and how it was given.
Make STOP work immediately, across every channel, and never message that person again unless they opt back in.
Say who you are in the first message you start. Nobody opted in to a mystery number.
Send reminders and order updates - customers want them. Send promotions sparingly, and only to people who said yes.
Tell people when they are talking to software, if they ask. It is honest, and it keeps you inside most AI rules now arriving.

How InfrAgent AI handles this

Opt-out is enforced in software, not by memory: a STOP on any channel is honoured immediately and recorded against that customer for every channel. Messages that start a conversation go through Meta-approved templates. Consent is captured and stored with the customer record so it can be shown later. The full position - UK GDPR, EU GDPR and the DPDP Act, with a Data Processing Agreement - is on our trust centre. None of that replaces your own obligations. The software can make it hard to break the rules by accident. It cannot make an unsolicited message lawful.