Is it legal to let AI answer your customers? The three questions that decide it: disclosure, consent and advice
Using software to answer customers is legal almost everywhere; businesses have used auto-replies for decades. The questions that matter are narrower: must you say it is an AI, whom may you message, what may it advise on, and what happens to the data. Here they are in plain language, with the caveat that this is general guidance and your lawyer knows your jurisdiction.
Quick answer
In general, yes. Three rules keep it that way: disclose that customers are talking to an assistant, especially where consumer or AI transparency laws require it; only message people who contacted you or consented, and honour opt-outs; and never let the AI give regulated advice (medical, legal, financial) or make decisions the law reserves for people. Handle personal data under the PDPA or your local equivalent. Separately, WhatsApp's own terms only sanction automation through the official platform, which is what ReplyKit uses; unofficial linked-device tools carry a platform risk rather than a legal one.
Disclosure
Several jurisdictions now require or strongly expect businesses to tell people when they are interacting with an AI system, and consumer protection law generally prohibits misleading customers about who they are dealing with. The safe course everywhere is the honest one: the assistant says it is an assistant, and a person is reachable. ReplyKit keeps that on by default; the wording is in setting expectations for AI replies.
Consent and messaging
Replying to a customer who messaged you is expected service. Sending messages to people who did not, or after they asked you to stop, breaks WhatsApp's Business Messaging Policy and, in most countries, spam and data protection law; Singapore adds the Do Not Call Registry for marketing to local numbers. An agent that only replies to inbound messages and honours STOP stays inside all of these by construction. See opt-out and consent rules.
Advice and decisions
Medical, legal, financial and other regulated advice may only come from a licensed person. Some decisions about people (hiring, credit, tenancy) are also restricted. An AI that gives such advice or makes such decisions exposes the business, regardless of disclaimers. ReplyKit refuses regulated advice at the platform level and our Acceptable Use Policy forbids configuring it; the industry guides for professional services and insurance agents show the intake-only pattern that works.
Data
Phone numbers and chats are personal data. You need a lawful purpose, a notice, security, and a way to honour rights, under Malaysia's or Singapore's PDPA or your local law. Name the platforms that process the data. A template notice is in the privacy notice guide.
Law versus WhatsApp's terms
One more distinction. WhatsApp's terms are a contract with Meta, not the law. linked-device automation is against those terms, and the consequence is platform enforcement: a restricted number. It is not illegal, but it is a risk to plan for with a dedicated number, as explained in Meta's messaging limits explained.
Frequently asked questions
Is it legal to use AI to reply to customers?
In general yes, provided you disclose it where required, only message people who contacted you or consented, keep regulated advice with licensed people, and handle data lawfully.
Do I have to tell customers it is an AI?
In some jurisdictions it is required; everywhere it is the honest and safer course. ReplyKit discloses by default.
Can the AI give medical or legal information?
It can state published facts such as prices and processes. Advice must come from a licensed person, and ReplyKit refuses regulated advice.
Is linked-device automation illegal?
No. It is against WhatsApp's terms, which is a platform risk, not a legal one.
Is this legal advice?
No. It is general guidance; consult a lawyer for your jurisdiction and industry.
Built around the three rules
Disclosed, inbound only, regulated advice refused. 7-day free trial.
Sources and further reading
- WhatsApp Business Messaging Policy · opt-in, opt-out and prohibited-use rules every business must follow
- Personal Data Protection Department, Malaysia (PDPA 2010)
- Personal Data Protection Commission, Singapore
- ReplyKit Acceptable Use Policy · what we refuse to automate
- WhatsApp Terms of Service
ReplyKit is an independent product and is not affiliated with or endorsed by Meta or WhatsApp. This article is general guidance, not legal advice. Laws on AI disclosure, consent, regulated advice and data protection differ by country and change; consult a lawyer for your situation.