This article is general guidance, not legal advice. For your specific situation, consult a POPIA or legal professional.
WhatsApp marketing works brilliantly in South Africa — but get the consent rules wrong and you’re not just risking a bad customer experience, you’re risking a POPIA breach. The good news: the rules are clear, and compliance is very achievable.
Under South Africa’s POPIA, you may only send WhatsApp marketing messages to people who have given you prior opt-in consent — or who are existing customers, under specific conditions. WhatsApp counts as “electronic communication” under Section 69 of the Act, so the same strict rules that govern marketing SMS and email apply equally to WhatsApp broadcasts.
What POPIA Says About WhatsApp Marketing (Section 69)
Section 69 prohibits direct marketing by electronic means unless one of two things is true: the person has given consent, or they are an existing customer and specific conditions are met. Crucially, POPIA is an opt-in regime — silence or a pre-ticked box doesn’t count. The person has to actively agree.
The Consent Rule: Opt-In, Specific, and Informed
Valid consent under POPIA must be a voluntary, specific, and informed expression of will. In practice, for WhatsApp marketing that means:
- An active opt-in — a ticked box, a typed “YES”, or an explicit agreement (never pre-ticked or assumed).
- Clear about what you’ll send — the goods or services you’ll market.
- Clear about the channel — that you’ll contact them on WhatsApp.
The POPIA Regulations even provide a prescribed format (Form 4) setting out what a direct-marketing consent request should contain.
The Existing-Customer Exception (Section 69(3))
There’s a narrow exception. You may market to an existing customer without fresh consent if you obtained their contact details in the context of a sale, you’re marketing your own similar products or services, and you give them a clear chance to opt out — both at the point of collection and in every message thereafter. If in doubt, get explicit consent; it’s the safer path.
WhatsApp Groups and Adding Contacts
Adding people to a WhatsApp marketing group or broadcast list without their consent is exactly the kind of thing Section 69 targets. Don’t import a contact list and start broadcasting — build your audience from people who have opted in.
Your Practical POPIA Compliance Checklist
- Collect explicit opt-in consent before any marketing message — and keep a record of it.
- Identify yourself clearly as the sender in every message.
- Offer an easy opt-out (for example, reply STOP) in every marketing message — and honour it immediately.
- Only market what the person consented to receive.
- Keep a privacy policy and, as POPIA requires generally, register an Information Officer.
- Remember this applies to marketing — transactional messages a customer expects (order confirmations, OTPs) sit on a different legal footing.
It’s worth noting that Meta’s own WhatsApp rules already require opt-in and punish spam with lower quality ratings — so compliance and deliverability pull in the same direction.
How Automation Makes Compliance Easier
Done manually, consent and opt-outs are easy to drop. Done with automation, they look after themselves: a chatbot captures and timestamps opt-in, your CRM logs the consent, and opt-out keywords are honoured automatically across your lists. Compliance stops being a chore and becomes part of the plumbing.
Frequently Asked Questions
Can I send WhatsApp marketing without consent? Generally no. POPIA requires prior opt-in consent for electronic direct marketing. The only exception is marketing similar products to existing customers under Section 69(3), with an opt-out provided each time.
Is offering an opt-out enough? No. POPIA is opt-in, not opt-out — you need consent before you message. An opt-out is required in addition, not instead.
Are WhatsApp marketing groups POPIA-compliant? Only if everyone in the group consented to being added and to receiving marketing. Adding people without consent is a breach.
Do order updates and OTPs need marketing consent? No — transactional messages the customer is expecting aren’t “direct marketing” under Section 69. They rely on a different lawful basis, though you still handle the data responsibly under POPIA.
