Practical guidelines for GDPR-compliant WhatsApp messages with chatarmin
Sending marketing messages on WhatsApp without adhering to privacy laws like the GDPR isn’t just risky - it’s a recipe for trouble. In this guide, we’ll share best practices for obtaining proper opt-ins from your clients, ensuring compliance while building a valuable list that drives your marketing goals effectively and responsibly. 🚨 Make sure to watch our detailed YouTube Guide on this (German), otherwise read the article below:
Disclaimer: This information is provided as a guideline and does not constitute legal advice. Please tailor the procedures and texts to your specific needs and consult a legal expert if necessary.
Note: The CJEU judgment of 13 November 2025 (C-654/23) is partly being interpreted as allowing newsletter without consent in the future. In practice, however, it does not introduce any significant changes to the legal requirements.
Technical Requirements & Disclaimer
To engage in GDPR-compliant WhatsApp marketing, you must understand the distinction between the different versions of WhatsApp.WhatsApp App vs. WhatsApp Business API
- WhatsApp Private/Business App: These are the standard apps found on the App Store. They are not suitable for scalable marketing. They lack a Data Processing Agreement (DPA) and do not offer the technical interfaces (API) required for GDPR-compliant tracking and automated Double Opt-ins.
- WhatsApp Business API (Chatarmin): This is the professional interface. Only through the API can you ensure that data is handled according to European standards, and only the API allows for the automation of the “Double Opt-in” (DOI) process which is legally required in many regions.
An explanation about different optin ins for GDPR-compliance
SOI (Single Opt-In)
Users enter their phone number and are added directly to the your mailing list. There is no further confirmation. In this case you have no proof of consent. The risk of misuse is high and generally this is not GDPR-compliant. Avoid SOI as it is not legally secure and does not protect against unauthorized sign-ups.Transactional Opt-In
Transactional Opt-Ins are deliberately excluded from our campaignes. They usually only occur when customers have previously haven’t had an opt-in or purposely opted out, but then bought something from the client’s shop (again), so their data has been stored. We do not recommend to send campaignes to transactional opt-ins, as there is a higher risk that they view them as spam.Your recommendatoin: DOI (Double Opt-In)
- Trigger Message: User enters the WhatsApp Chat via QR-Code or wa.me.link. A predefined trigger message will be in the chat.
- Double Opt-In Flow: After the trigger message was sent successfully the double opt-in flow starts. If the user accepts to receive messages on WhatsApp (e. g. bei START / YES) you have a proper double opt in – and from now on can send marketing messages to the user.
- Do not forget: Opting out must be as easy as opting in.
- Recommendation: Always use DOI to ensure compliance and build trust.
TXOI (Transactional Opt-In)
Transactional messages on WhatsApp are automated, direct messages sent in response to specific user actions. Examples are order confirmations, delivery updates, or password reset requests. Their primary purpose is to inform and build trust with customers, not marketing. The primary purpose of transactional message must always be informational.Best Practices
Start: Always use Double Opt-In (DOI)
- Use DOI as the standard for all sign-ups. Do not forget to add a “DOI Tag” to your costumers or any other tags you need to manage your list. chatarmin documents the timestamp and IP address of the confirmation for your legal proof.
Stop: Include an “Unsubscribe” option in every message
- Provide a clearly visible unsubscribe notice in every message with clear wording, such as: “Don’t want to receive further messages? Write STOP.”
Technical and Legal Safeguards
- Data Processing Agreement (DPA): The data processing agreement (DPA) regulates the transfer of personal data. You as the client transfer data to chatarmin, and chatarmin is the contractor, as we receive and process this recipient data according to your instructions. To ensure compliance with the legal provisions of the GDPR, we offer you a data processing agreement in accordance with the legal provisions of Art. 28 of the GDPR and the other data protection requirements of the General Data Protection Regulation:https://chatarmin.com/avv