More enquiries · · 5 min read · By Alexander
How to set up a compliant WhatsApp newsletter
A WhatsApp newsletter reaches customers directly, but an existing mobile number is not permission to advertise. German businesses need explicit consent, evidence of registration and an unsubscribe route that is as easy as the opt-in.
Is a WhatsApp newsletter legal in Germany?
Yes, provided the recipient has validly agreed in advance. Section 7(2)(2) UWG generally treats electronic advertising without prior express consent as an unreasonable nuisance. A number obtained from an enquiry, appointment or purchase is not an automatic marketing permission. Source: German Federal Ministry of Justice, Section 7 UWG, checked on 31 October 2026.
Germany’s Data Protection Conference also treats electronic direct marketing as consent-based. The choice must be voluntary, informed and specific to WhatsApp, the sending company and the intended content.
Separate requested service messages from marketing. A requested appointment confirmation is not the same as regular offers or promotional tips.
- Do not import old address-book contacts
- Keep service and advertising messages separate
- Obtain consent before the first promotion
What should the WhatsApp opt-in say?
Name the sender, WhatsApp as the channel and the types of content. Explain that consent is voluntary, can be withdrawn and link to the privacy notice. Do not use pre-ticked boxes or hide consent in general terms.
Article 7 GDPR requires evidence. Store the number, timestamp, registration source and exact consent wording shown at that time. Record confirmation and withdrawal as well. The DSK says the specific declaration must be fully documentable; checked on 31 October 2026.
A plain example is: “I want to receive the WhatsApp newsletter from [company] with offers and practical tips. I can withdraw at any time by sending STOP.” Adapt it to the real setup.
- Identify the company
- Name WhatsApp explicitly
- Describe topics
- Explain unsubscribe
- Link the privacy notice
- Store wording and timestamp
How do you create the newsletter and prove registration?
A website form can collect the number through a separate checkbox and clear button. Alternatively, the user can start the chat and send a keyword such as START. Never treat numbers from business cards or previous enquiries as subscribers.
Double opt-in is not prescribed under that exact label, but a confirmation step can strengthen evidence. Keep the first confirmation non-promotional and log both stages. The DSK notes that technical confirmation alone may not always prove who controlled a number, so match the process to the risk.
Design the entire lifecycle: registration, confirmation, sending, withdrawal, suppression list and deletion periods. A managed website subscription can keep the form, privacy information and technical integration aligned.
WhatsApp Business App or Business Platform?
The app may suit a very small manual list. The Business Platform is generally easier to govern when teams, automation, templates or structured customer management are needed. Choose based on evidence, roles, unsubscribe handling and deletion, not features alone.
WhatsApp’s Business Messaging Policy requires a business to obtain the number and opt-in and to honour opt-outs. Outside the 24-hour window following a user message, Platform-initiated conversations require approved templates; policy checked on 31 October 2026. Platform rules do not replace German consent law.
Avoid ordinary groups because participants may see other members’ phone numbers. Check the data processing agreement, subprocessors, locations and international transfers for every provider.
How should privacy and unsubscribe work?
The privacy notice should explain the controller, purposes, data, legal basis, provider, recipients, retention, transfers and rights. Also check whether the chosen app uploads the address book. Bavaria’s data protection authority notes that messenger use involves contact and metadata as well as message content; information checked on 31 October 2026.
Under Article 7(3) GDPR, withdrawal must be as easy as consent. Accept clear words such as STOP and prevent further advertising immediately. A minimal suppression record may remain necessary to avoid accidental re-import.
Offer email, telephone or a normal web page to customers who do not want WhatsApp. Access to the underlying service should not depend unnecessarily on one messenger.
What should you test before the first campaign?
Use a small test group. Check form, evidence, confirmation, mobile display, unsubscribe and suppression. Define who approves messages and processes withdrawals, and send only the topics and frequency promised.
Measure sign-ups, withdrawals, replies and genuine enquiries rather than message volume. Never buy number lists. This guide is not individual legal advice; sensitive data and large distributions deserve a specific legal review.
- Approve consent text and privacy notice
- Test registration evidence
- Test STOP and suppression
- Review DPA and transfers
- Assign responsibility and frequency
- Run a test campaign
Frequently asked questions
Can I send the newsletter to existing customers?
Not merely because you have their number. Obtain explicit, demonstrable consent for WhatsApp marketing.
Is double opt-in mandatory?
The law does not prescribe that named process, but you must prove consent. A suitable confirmation step can improve the evidence.
Is the privacy notice enough?
No. It provides information but does not replace prior consent to electronic advertising.
How should people unsubscribe?
A simple word such as STOP should work. Process it promptly and prevent renewed advertising imports.
Can I use a WhatsApp group?
Usually avoid it because participants may see other members’ data. Use a method that keeps recipients separate.