Acceptable Use Policy

1. Purpose and scope

WhatsApp is a private messaging app. People give businesses their number expecting relevance and restraint, and Meta holds Tech Providers accountable for what their customers send. This policy exists so that one customer's bad campaign cannot damage other customers, message recipients, or our standing as a Tech Provider.

It applies to everyone who uses the platform — your staff, your contractors, and anything automated through your API keys. It forms part of our Terms of Service (/terms); breaching it is a material breach of that agreement.

2. WhatsApp and Meta policies apply too

You must comply with Meta's rules as well as ours. Where they are stricter, they win. You are responsible for reading them and for keeping up with changes.

• WhatsApp Business Messaging Policy — https://www.whatsapp.com/legal/messaging-policy
• WhatsApp Commerce Policy — https://www.whatsapp.com/legal/commerce-policy
• WhatsApp Business Terms of Service — https://www.whatsapp.com/legal/business-terms
• Meta Platform Terms — https://developers.facebook.com/terms

3. Opt-in: the non-negotiable rule

You must have prior, informed opt-in from a person before you message them on WhatsApp. There is no exception for existing customers, purchased lists, publicly listed numbers, or numbers you already hold for another channel.

• Opt-in must be given knowingly and voluntarily by the person who owns the number.
• It must clearly identify your business by the name you will message under, and state that messages will arrive on WhatsApp.
• It must state what kind of messages you will send — order updates, appointment reminders, marketing — and you must stay within that scope.
• It may be collected on any channel you control (website form, in-app, in store, IVR, an existing chat thread), but you must record when, where and how it was given.
• Keep opt-in evidence for as long as you message the person, and produce it within a reasonable time if the person, we, or Meta ask.
• Opt-in does not transfer. A number opted in to one brand may not be messaged by another, including a group company or a reseller's client.

4. Opt-out handling

• Offer a clear, free and obvious way to stop — for example a Stop button on marketing templates or an instruction to reply STOP.
• Honour every opt-out promptly and no later than within a few days, across every campaign and every number you send from.
• Treat any clear expression of unwillingness as an opt-out, even if the wording does not match your keyword.
• Maintain a suppression list and check it before every send. Do not re-add a person because they placed a new order or filled a different form, unless they opted in again.
• Never make a person opt out repeatedly, and never charge them for it.
• A block or a report from a recipient is the strongest possible opt-out signal. Stop.

5. Prohibited content and industries

You must not use the platform to promote, sell, facilitate or reference the following. Some are illegal, some are banned by WhatsApp's Commerce Policy, and all of them will get your account terminated here.

• Illegal, prescription or recreational drugs, and any product that facilitates drug use.
• Tobacco, vaping and nicotine products, and related paraphernalia.
• Alcohol, except where the WhatsApp Commerce Policy permits it and you enforce age verification.
• Weapons, ammunition, explosives and instructions for making them.
• Live animals, endangered species and products derived from them.
• Adult content, sexual services and adult products.
• Real-money gambling, betting, lotteries and games of chance, except where Meta has expressly authorised the use case.
• Medical and healthcare products making unapproved claims — including devices, unapproved supplements and treatment guarantees.
• Body parts, bodily fluids and human remains.
• Currency exchange, cryptocurrency, tokens, mining services and speculative financial products.
• Multi-level marketing, pyramid and matrix schemes, get-rich-quick offers, payday and predatory lending.
• Counterfeit, stolen or infringing goods, and services that facilitate them.
• Deceptive, misleading, exaggerated or false claims — including fake discounts, fake urgency and fabricated testimonials.
• Hate speech, harassment, threats, violent extremism, terrorist content, and content that exploits or endangers children.
• Content that discriminates against a person on the basis of a protected characteristic.

6. Prohibited conduct

• Sending unsolicited or bulk messaging of any kind, including to numbers that opted in to a different brand or purpose.
• Sending phishing, smishing, malware, credential-harvesting links, or links that mislead about their destination.
• Impersonating another business, brand, government body, public figure or individual, or misrepresenting your identity in your display name, profile or templates.
• Registering templates whose approved category does not match how you actually use them — for example utility templates used for marketing.
• Spreading messaging across multiple phone numbers, WABAs or accounts to dodge quality ratings, messaging limits or a suspension.
• Circumventing rate limits, retrying aggressively after errors, or engineering around a throttle we applied.
• Automating human-agent interactions in a way that deceives recipients into thinking they are talking to a person when they are not, where the law requires disclosure.
• Scraping, harvesting or enumerating WhatsApp numbers, or testing which numbers exist.
• Reselling, sublicensing or white-labelling access to the platform without our written agreement.
• Probing, scanning or load-testing our infrastructure without written authorisation; interfering with other customers' service.
• Reverse engineering, decompiling or attempting to extract source code or credentials from the platform.
• Using the platform to build a competing service, or to train models on other customers' data.
• Sharing API keys or console logins between people, or embedding API keys in client-side code, mobile apps or public repositories.

7. Message quality, categories and limits

Meta scores every sending number on recipient feedback. Blocks and reports drive the quality rating down, which lowers your messaging limit and can pause your templates or flag your number. Quality is your responsibility, and it is the single best predictor of whether your account survives.

• Send at a frequency a reasonable recipient would expect from the opt-in they gave. Fewer, better messages beat volume.
• Use the correct template category — marketing, utility or authentication — and do not smuggle promotional content into a utility or authentication template.
• Personalise responsibly: template parameters must be accurate, and must not be used to inject content the template was not approved for.
• Respect the 24-hour customer service window. Outside it, only approved templates may be sent.
• Do not message at unreasonable local hours, and respect any national do-not-disturb rules that apply to your recipients.
• Respond to inbound replies. A number that only broadcasts and never answers attracts blocks.
• Watch your quality rating and pause campaigns yourself when it degrades — do not wait for Meta to do it for you.

8. Data and privacy obligations

• Have a lawful basis for every phone number and every piece of personal data you put into the platform.
• Publish your own privacy notice, and tell recipients how to reach you about their data.
• Collect the minimum data you need. Do not store payment card numbers, passwords or government identity numbers in contact notes or message parameters.
• Take special care with health, financial, biometric, religious, political and sexual-orientation data — do not send it through WhatsApp unless you have a lawful basis and appropriate safeguards.
• Honour access, correction and erasure requests from your recipients; ask us for help and we will support you.
• Do not use the platform to profile or track people in ways they would not reasonably expect.

9. Security obligations

• Keep API keys secret. Store them server-side, rotate them regularly, and revoke them immediately when a holder leaves or a key is exposed.
• Verify the signature on every webhook we deliver before you act on it, and keep your verify token secret.
• Serve your webhook endpoint over HTTPS with a valid certificate.
• Use individual console accounts with appropriate roles rather than shared logins.
• Report a suspected compromise of your account, keys or webhook endpoint to [email protected] without delay.

10. How we enforce this policy

We investigate reports and monitor abuse signals — block and report rates, quality-rating collapses, spikes in failed sends, and recipient complaints. Our response is proportionate to the harm and to whether it is ongoing.

Suspension is not a refund event. You may appeal any action we take by replying to the notice we send; a human reviews every appeal. Serious or repeated breaches may also be reported to Meta, which can act independently against your WABA.

11. Reporting a violation

If you received a message you did not consent to, or you believe someone is misusing the platform, tell us. Reports are read by a person, not a bot.

• Report abuse or spam[email protected]Include the sending number, the date and a screenshot if you have one
• Report a security issue[email protected]
• Stop a business messaging youData deletion instructions

12. Changes to this policy

We update this policy as WhatsApp's rules and abuse patterns change. The effective date at the top reflects the current version, and we notify Customers of material changes. Changes required by Meta or by law may take effect immediately.