WhatsApp's Business Messaging Policy in plain English: the ten rules that matter to a small business, and what breaks them
WhatsApp's business rules are written for lawyers and platform engineers. A small business needs to know ten things. Here they are, each with what it means in practice and what breaks it, with a link to the original for anyone who wants the full text.
Quick answer
The ten rules: message only people who agreed or who messaged you; honour stop instantly; be honest about who you are; do not send prohibited content or operate in prohibited categories; do not spam, burst or mass-message; keep automation task-specific and disclose it; respect data protection; do not sell or share contact data; keep message quality high enough that people do not report you; and understand which document governs you (the Business Messaging Policy for the official platform, the Terms of Service for the app). An inbound-only, honest, disclosed agent on a dedicated number sits inside all ten.
The ten rules
- Consent. Message people who opted in or who contacted you. Broke it: messaging a list you bought or scraped.
- Opt-out. Stop the moment someone asks. Broke it: one more "last chance" message.
- Honesty. Your real business name and purpose. Broke it: pretending to be a bank, a courier or a person you are not.
- Prohibited content and categories. WhatsApp lists content and industries it does not allow, from illegal goods to certain regulated categories. Broke it: selling anything on the list, or misleading claims.
- No spam. No bulk unsolicited messages, no bursts from new numbers, no identical messages to many contacts. Broke it: the promotion blast.
- Automation. Task-specific business automation is allowed and disclosed; general-purpose AI assistants are barred from the official platform as of January 2026. Broke it: an assistant that answers anything about anything. See the 2026 AI policy.
- Data protection. Follow local law (PDPA in Malaysia and Singapore) on collection, notice and use. Broke it: no privacy notice, or using chats for something else.
- No selling contacts. Numbers and chats are not yours to sell or share. Broke it: passing a customer list to a partner.
- Quality. WhatsApp watches blocks and reports relative to your volume. Broke it: enough reports that the number is restricted; see blocks and reports.
- Which document. The Business Messaging Policy governs the official platform; the Terms of Service govern the app, and they do not sanction automation through linked devices. Broke it: assuming a third-party tool is covered by the platform's rules.
What this means for an AI agent
An agent that replies only to people who message you, honours stop, says it is an assistant, stays scoped to your business, refuses prohibited categories, and sends reminders only through approved templates sits inside rules one through nine. Rule ten is the honest caveat: linked-device automation is outside what the app's terms sanction, which is a platform risk rather than a policy breach you can fix. ReplyKit's design and Acceptable Use Policy follow the first nine, and the tenth is laid out in Meta's messaging limits explained.
A quick self-check
- Can every person you messaged this month be shown to have contacted you or opted in?
- Did anyone say stop, and did it stop?
- Is your business name and purpose accurate in the profile?
- Is anything you sell on WhatsApp's prohibited list?
- Did a new number send a burst?
- Does the agent say it is an assistant?
- Is there a privacy notice?
Seven yeses and you are fine. The consent details are in consent and opt-out rules.
Frequently asked questions
What are WhatsApp's main rules for businesses?
Consent, instant opt-out, honesty, no prohibited content, no spam, task-specific disclosed automation, data protection, no selling contacts, and message quality, under the policy for the official platform and the terms for the app.
Can I message customers who did not contact me?
Only if they opted in. Otherwise no.
Is AI automation allowed on WhatsApp?
Task-specific business automation is; general-purpose assistants are barred from the official platform since January 2026. Linked-device automation is not sanctioned by the app's terms.
What gets a number banned fastest?
Bulk unsolicited messages, especially from a new number, and ignoring stop requests.
Where is the original policy?
business.whatsapp.com/policy for the Business Messaging Policy, and whatsapp.com/legal for the Terms of Service.
Inside the rules by design
Inbound only, disclosed, scoped, capped. 7-day free trial.
Sources and further reading
- WhatsApp Business Messaging Policy · opt-in, opt-out and prohibited-use rules every business must follow
- WhatsApp Terms of Service
- Meta for Developers, Policy for AI Providers on the WhatsApp Business Platform
- Personal Data Protection Department, Malaysia (PDPA 2010)
- ReplyKit Acceptable Use Policy · what we refuse to automate
ReplyKit is an independent product and is not affiliated with or endorsed by Meta or WhatsApp. This is a plain-language summary of WhatsApp's published policies as of September 2026, not legal advice. Read the originals and consult a lawyer for your situation.