WhatsApp Business: app, API and data protection

The WhatsApp Business app is for serving your customers one to one from a phone; Meta's platform is what programs and providers connect to, and Meta charges for it per delivered message. If you serve customers on WhatsApp, you also process personal data, and the GDPR and Spain's LOPDGDD apply.

Reviewed on 2026-10-10. BAI Business offers a receptionist solution for WhatsApp and publishes this article.

The app and the platform

Meta separates two products. The WhatsApp Business app was designed, according to its page, with small businesses in mind: a business profile with useful information, a catalogue to show your products, greeting and away replies and management of communication with customers (source: Meta, WhatsApp Business app, accessed on 2026-10-10). The WhatsApp Business platform is the one used by companies that connect at scale through programs and Meta partners, and the one with per-message prices.

If you receive few messages and a person answers them, the app is enough. The platform starts to make sense when you want to connect WhatsApp with your customer management, serve from several people's accounts or reply with an automatic receptionist. This is a criterion of ours, not a Meta figure: count your messages in a normal week before deciding.

How Meta charges for the platform

Since 1 July 2025, Meta charges per message and not per conversation, and only when the message is delivered, not when it is sent. The rate depends on the message category and on the country of the recipient's number (source: Meta, pricing documentation, accessed on 2026-10-10).

• Categories. Marketing, utility, authentication and service; since 1 July 2026 there is also the Meta Business Agent category.
• Markets. Spain appears as a market of its own on Meta's rate card, which is published with the rates by category and the volume tiers for utility and authentication.
• Service. From 1 October 2026, Meta gives each business number a free tier of 1,000 service messages a month and charges from message 1,001 (accessed on 2026-10-10).
• Ads. When a customer writes to you from a click-to-WhatsApp ad, your messages are not charged for the following 72 hours (source: Meta, platform pricing, accessed on 2026-10-10).

Prices change on a calendar: check the current rate card before you budget. If you sign up through a provider, it may add its own fee; its price is on its page.

When you can write first

Free-form messages, text or image, can only be sent during a customer service window of 24 hours, which opens and resets with each message from the user. To contact a user outside that window, or to write first, you have to use a template message of the right category (accessed on 2026-10-10). A promotional template also requires you to have a legal basis for that processing.

Data protection: GDPR and LOPDGDD

A phone number tied to a conversation with a customer is information about an identifiable person, that is, personal data under Article 4 of Regulation (EU) 2016/679 (GDPR). Organic Law 3/2018 (LOPDGDD) of 5 December complements it in Spain. What you need to have in order:

• A legal basis. Article 6 of the GDPR lists the bases; three of them are that the customer has given consent (point a), that the processing is necessary to perform a contract (point b) or to pursue legitimate interests (point f).
• Information for the customer. Article 13 requires you to say how you process their data when you obtain it from them. A practical way is to link your privacy policy in the welcome message.
• Record of activities. Article 30 obliges you to keep a record of processing activities; note serving customers on WhatsApp there, with its purpose and its retention period.
• Contract with your provider. Article 28 requires processing by a processor to be governed by a contract; ask for it from whoever connects you to WhatsApp before you start.
• Retention period. Decide how long you keep the histories and how you delete them. You set the period according to what you use them for.

If your business processes health data or other special categories, the GDPR treats them with extra protection: consult your data protection officer or your adviser before using this channel.

Where BAI fits in

BAI Business has a receptionist solution for WhatsApp within a management platform for the self-employed and small businesses. You can see how it is described on the WhatsApp receptionist page. All of the above, the legal basis, the information for the customer, the record and the contract with the provider, is your responsibility as the controller whichever provider you use, ours included.

How we checked this

We read Meta's official pages, the consolidated text of the GDPR on EUR-Lex and the LOPDGDD entry in the BOE on 2026-10-10 and noted only what they state. This guide does not replace the advice of a lawyer or a data protection officer for your case. Meta's prices and conditions change on a calendar: the page is reviewed every ninety days, or sooner if they change.

Frequently asked questions

Are the WhatsApp Business app and the WhatsApp Business platform the same thing?

No. Meta presents the app as a tool designed for small businesses, to talk to customers one to one, show products and reply easily. The business platform is the product that programs and providers connect to, and it is the one Meta charges for per delivered message.

How does Meta charge for platform messages?

Per delivered message, according to its category (marketing, utility, authentication and service) and the recipient's market. From 1 October 2026, each business number has a free tier of 1,000 service messages a month (accessed on 2026-10-10). Meta publishes the rates by market on its rate card.

Can I write to a customer whenever I want?

Free-form messages can only be sent during a customer service window of 24 hours, which opens and resets with each message from the customer. To write first or outside that window you need a template message, and if it is promotional you also need a legal basis for that processing.

What data protection paperwork do I need to serve customers on WhatsApp?

Tell the customer how you process their data (Article 13 of the GDPR), note the processing in your record of activities (Article 30) and sign the data processing contract with your provider (Article 28).

You may also be interested in

• 8 problems with AI in a small business's customer service: common mistakes when automating a customer service channel.
• GDPR for your small business: what customer data you can keep and for how long: the retention period, explained.

Sources

• WhatsApp Business platform pricing, accessed on 10 October 2026.
• WhatsApp Business pricing documentation (Meta), accessed on 10 October 2026.
• WhatsApp Business app, accessed on 10 October 2026.
• Regulation (EU) 2016/679 (GDPR), consolidated text, accessed on 10 October 2026.
• Organic Law 3/2018 (LOPDGDD), BOE, accessed on 10 October 2026.