Yes, WhatsApp marketing can be GDPR-compliant. GDPR doesn't care which app you use; it cares how you got the customer's number and what you do with it. For a typical Shopify store that means clear opt-in consent for marketing messages, a record of that consent, a privacy notice that mentions WhatsApp, contracts with the companies processing data for you, and an opt-out you honour immediately.
I'll walk through each of those as a checklist you can work through in an afternoon. One thing up front: this isn't legal advice. I run a WhatsApp app, not a law firm. If you sell at real volume into Europe, an hour with a data protection lawyer in your main market is money well spent. But most of what follows is the stuff a lawyer will tell you anyway.
Does GDPR apply to your store?
If you're in the EU, yes. If you're not, it still can. Article 3(2) applies GDPR to businesses outside the EU that process personal data of people in the EU when offering them goods or services. So a Shopify store in Pakistan or the UAE that ships to customers in Germany and messages them on WhatsApp is in scope for those customers.
A phone number is personal data. So is a WhatsApp chat history, a name, an order history. If you send marketing on WhatsApp to people in the EU, you're processing all of it.
Which lawful basis covers WhatsApp marketing?
GDPR Article 6 gives six lawful bases. Three matter for a store:
Consent: the person clearly agreed to a specific use.
Contract: processing is needed to deliver what they bought.
Legitimate interests: you have a genuine business reason that isn't overridden by the person's rights.
Recital 47 says direct marketing may be a legitimate interest, and you'll see people lean on that. I wouldn't for WhatsApp. Most EU countries also have separate electronic marketing rules, based on the EU's ePrivacy Directive, that sit alongside GDPR and often require consent for marketing by electronic message. And WhatsApp's own Business Messaging Policy requires opt-in before you message people anyway. Consent is the clean answer.
Order confirmation, COD confirmation, shipping update
Contract
Yes, WhatsApp policy requires it
Reply to a question the customer sent you
Contract or legitimate interests
They started the chat
Abandoned checkout reminder
Consent is safest
Yes
Promotions, new arrivals, sale announcements
Consent
Yes
Review request
Consent is safest
Yes
The template category matters here too. Meta classifies WhatsApp templates as marketing, utility or authentication, and the template categories guide explains the difference. Roughly, utility templates map to "contract" messages and marketing templates map to "consent" messages. Keep them separate in your head and in your opt-in wording.
Freely given. Don't make the purchase depend on agreeing to marketing.
Specific. One clear purpose per tick box. "Order updates" and "offers" are two purposes.
Informed. Say who you are, what they'll get, on which channel, and that they can stop.
Unambiguous. A clear action, like ticking an empty box. Pre-ticked boxes, silence and inactivity don't count.
Meta's opt-in guidance lines up neatly: name your business and make clear the person is agreeing to receive messages. Here's wording that does both jobs.
Checkout or signup checkbox (unticked by default):
☐ Send me offers and new arrivals from Atlas Coffee on WhatsApp, about twice a month. I can reply STOP at any time. See our privacy policy.
Asking inside a chat, after you've helped someone:
Glad that sorted it! One quick question: would you like us to send you offers and new roasts here on WhatsApp, about twice a month? Just reply YES. You can stop any time by replying STOP.
Confirmation after they say yes:
Thanks, you're in. You'll get offers and new roasts from Atlas Coffee here on WhatsApp, about twice a month. Reply STOP any time to opt out.
That confirmation message is quietly important. It's both good manners and part of your record. For more placements and wording, see how to collect WhatsApp opt-ins on Shopify.
How do you record WhatsApp consent?
Article 7 says you must be able to demonstrate that someone consented. "They're on our list" isn't proof. For each opted-in customer, keep:
Phone number and customer ID
Date and time of the opt-in
Where it happened (checkout, popup, chat, QR code)
The exact wording they agreed to, or a version number for it
Which categories they agreed to (offers, order updates, back in stock)
Date and time of any opt-out
The simplest setup on Shopify: a customer tag or metafield for each category plus the date, set automatically where possible. When a customer replies YES in a chat, a Shopify Flow workflow using WhatFlow's incoming-message trigger can add the tag for you, so nobody has to remember. The incoming-message routing guide shows the pattern.
Change your opt-in wording? Give it a new version number and keep the old text. If someone challenges a message in a year, you'll want to show what they saw.
Records of processing.Article 30 also asks controllers to keep written records of their processing activities. There's an exemption for organisations under 250 people, but it doesn't apply if the processing isn't occasional, and regular marketing isn't occasional. A one-page document listing what you collect, why, who processes it and how long you keep it covers most small stores.
Who are your processors, and do you have contracts?
Under GDPR, you're the controller: you decide why and how customer data is used. Companies that handle that data on your behalf are processors, and Article 28 requires a contract with each of them.
For WhatsApp marketing from a Shopify store, the chain usually looks like this:
Shopify, which stores your customer and order data.
Your WhatsApp app, for example WhatFlow, which connects Shopify to WhatsApp, stores conversations for your team inbox and sends your templates.
WhatsApp (Meta), which carries the messages. Meta publishes WhatsApp Business Data Processing Terms that apply where WhatsApp processes personal information in your customer data as your processor.
Ask every app that touches customer phone numbers for its data processing terms, WhatFlow included, and keep a copy with your records. Note where each one stores data. If any of them move data outside the EU, your privacy notice should say so and the contract should cover the safeguards.
Does your privacy notice mention WhatsApp?
Most Shopify privacy policies are a template that says nothing about WhatsApp. Add a short section in plain language:
WhatsApp messages. If you opt in, we use your phone number to send you messages on WhatsApp. Order updates are sent to deliver your order. Offers are only sent if you've agreed, and you can stop them any time by replying STOP. Messages are delivered by WhatsApp (Meta) and managed through our messaging app. We keep chat history for [X months] to help with orders and support.
Fill in your real retention period. Then actually delete older chats on that schedule.
How should you handle WhatsApp opt-outs?
Under Article 21, anyone can object to direct marketing at any time, and once they do, you can't use their data for it any more. No balancing test, no "but they're a good customer". And Article 7 says withdrawing must be as easy as giving consent. If they opted in with one tap, they must be able to opt out with one message.
In practice:
Put the opt-out instruction in every marketing template ("Reply STOP to opt out").
Treat "stop", "unsubscribe", "no more messages" and the equivalent in your customers' languages as opt-outs, not just the exact keyword.
Remove the marketing tag the same day, ideally automatically.
Send one short confirmation, and nothing else.
Keep sending order updates if they still have an order in progress, since those aren't marketing.
Done. You won't get offers from us on WhatsApp any more. We'll still message you about orders you've placed. Thanks for being a customer.
Staff using personal phones. Customer chats on an employee's personal WhatsApp are outside your control, outside your records and impossible to delete when they leave. Use a shared inbox. Shared WhatsApp inbox vs personal staff phones covers the trade-offs.
Importing an old contact list. Numbers collected for delivery five years ago aren't marketing consent. Ask them fresh, or don't message them.
One checkbox for everything. "I agree to the terms and to receive marketing" fails the "specific" test.
Sensitive products. If you sell health, pregnancy or intimate products, the product names in a chat can reveal sensitive information. Keep templates neutral.
Your WhatsApp GDPR checklist
I know which customers are in the EU and that GDPR applies to them.
I use consent for marketing messages, and a separate opt-in for order updates on WhatsApp.
Opt-in boxes are unticked and name my store, the channel and what people will get.
I record date, source, wording version and categories for every opt-in.
I have data processing terms from every app that handles customer numbers, and from WhatsApp.
My privacy notice explains WhatsApp messaging and how long chats are kept.
Every marketing template says how to opt out.
Opt-outs are actioned the same day and confirmed once.
Customer chats live in a shared inbox, not on personal phones.
WhatFlow WhatsApp Business API runs on the official Meta WhatsApp Cloud API and is built to make the operational half of this easier, whether you have two people answering chats or fifty: templates you write and control in the template editor, a shared team inbox with no seat fees so chats don't live on staff phones, and Shopify Flow triggers to tag opt-ins and opt-outs automatically. All of it is on every plan, including Free.
Free plan available
Run WhatsApp for your Shopify store with WhatFlow
Templates, COD confirmation, Shopify Flow automations and a shared team inbox with no seat fees. Every feature is included on every plan, including Free.
GDPR doesn't make WhatsApp marketing harder than email marketing. It makes sloppy marketing harder. Ask clearly, write it down, honour the stop, and you're most of the way there.
Frequently asked questions
Is WhatsApp marketing allowed under GDPR?
Yes, if you have a lawful basis for it, usually clear opt-in consent for marketing messages, and you can prove it, tell people how their data is used, have contracts with the companies processing it for you, and stop immediately when someone opts out.
Does GDPR apply to my Shopify store if I'm not based in the EU?
It can. Article 3(2) of the GDPR applies to businesses outside the EU that process personal data of people in the EU in connection with offering them goods or services.
Do I need consent to send WhatsApp order updates?
Order and shipping updates are usually justified as necessary for the contract, not as marketing. WhatsApp's own policy still requires the customer to have opted in to receive messages from you on WhatsApp, so ask for that at checkout or in the order confirmation.
Is a pre-ticked WhatsApp marketing checkbox GDPR-compliant?
No. GDPR consent needs a clear affirmative action, and silence, pre-ticked boxes or inactivity don't count.
How quickly must I stop marketing messages after someone opts out?
Under GDPR Article 21, once someone objects to direct marketing you can no longer process their data for that purpose. In practice, stop before the next send and confirm it to them.
