WhatsApp marketing consent in the UAE: what counts, what does not, and what it costs to get wrong
Having someone's number is not permission to message them. Two separate regimes apply to a UAE business sending marketing on WhatsApp: Meta's opt-in requirement, which decides whether you keep your number, and federal consumer and data protection law, which decides whether you should have sent it at all. This page covers both, and the gap between them where most businesses sit.
The short answer, in five lines
The short answer
Opt-in is required for business-initiated messages. Meta requires it, and it is the single biggest factor in whether a number survives.
Service consent is not marketing consent. Consumer protection law prohibits suppliers from using consumer data for marketing purposes.
Bought lists are the fastest way to lose a number. Not because of a rule you can argue with, but because recipients block and report, and the quality rating falls.
Record the evidence, not the intention. Timestamp, wording shown, source.
Withdrawal has to work immediately, across every sending tool you own.
The two regimes, side by side
| Meta's platform rules | UAE federal law | |
|---|---|---|
| What it protects | The WhatsApp experience | The individual |
| What it requires | Opt-in before business-initiated messages | Lawful basis for processing; marketing restrictions |
| How it is enforced | Quality rating, template rejection, number restriction | Regulatory and legal consequence |
| How fast you find out | Days. Sometimes hours | Slowly, and usually because someone complained |
| Can you appeal | Sometimes, and not reliably | Through proper process |
Businesses tend to plan for the second and get caught by the first, because the first moves at the speed of a bad campaign.
Federal Law No. 15 of 2020
Consumer Protection. Suppliers are prohibited from using consumer data for marketing purposes.
Read plainly, that separates the data a customer gave you to complete a transaction from the data you may use to sell them something else.
UAE Government portal, consumer protection, read 16 September 2026Federal Decree-Law No. 45 of 2021
Personal Data Protection Law, in force 2 January 2022. Processing requires the data subject's consent apart from narrow exceptions. Individuals may request correction, or ask that processing be restricted or stopped.
UAE Government portal, data protection laws, read 16 September 2026What a defensible opt-in looks like
- Collected at a moment the customer remembersBooking, checkout, signing up in store. Not scraped, not inferred, not bought.
- Specific about the channelIt says WhatsApp. An email consent is not a WhatsApp consent.
- Specific about the purposeReminders and service updates is one tick. Offers and promotions is another.
- Unbundled from the purchaseIf they cannot buy without agreeing to marketing, it is not freely given.
- Recorded with evidenceTimestamp, source, the exact wording shown, and what they ticked.
- In the language of the interactionArabic consent for an Arabic conversation.
- Reversible in one stepA reply of STOP, honoured immediately and everywhere.
Things businesses believe are consent, and are not
- "They messaged us first." That opens a 24-hour service window. It is not permission to send offers next month.
- "They gave us their number at the till." For the receipt, or for marketing? Only one of those was asked.
- "It was in the terms they accepted." Bundled consent is the weakest kind, and it reads badly if it is ever examined.
- "They follow us on Instagram." A different platform and a different relationship.
- "We bought the list from a reputable source." The reputation of the seller is not the consent of the person.
- "They are an existing customer." Useful context, not a lawful basis on its own, and consumer protection law addresses exactly this case.
What actually happens when you get it wrong
The platform consequence arrives long before any regulatory one, and it is the one that stops your business working.
| Stage | What you see | What it means |
|---|---|---|
| Quality rating drops | A warning in the manager | Recipients are blocking or reporting. Stop sending now |
| Messaging limit cut | Fewer unique customers per day | Your capacity shrinks, usually at the worst moment |
| Templates rejected | Submissions bounce | Often a category problem, sometimes an account signal |
| Number restricted | Sending stops | Appeals exist and are not reliable |
Notice that every stage is driven by recipient behaviour. The rule you are really obeying is that people should want the message.
Separating service from marketing in practice
- Two consent flags, not oneStored per contact, with evidence for each.
- Two template setsUtility for transactions, marketing for promotion. Never disguise one as the other.
- Two suppression listsSomeone can stop marketing and still want their delivery notification.
- One audit viewA single screen that shows, for any contact, what you hold and what they agreed to.
The commercial argument for doing this properly is not fear of enforcement. It is that a list of people who genuinely opted in performs several times better than a large list that did not, and it does not cost you the number.
Where consent is actually collected, ranked by how well it holds up
| Source | How strong | What makes it strong or weak |
|---|---|---|
| Checkout or booking form with an unticked box | Strongest | Deliberate, timestamped, tied to a moment the customer remembers |
| Click-to-WhatsApp ad | Strong for service | Clear intent to talk. Not automatically a marketing permission |
| In-store sign-up with a written record | Good | Only as good as the record. A name on paper with no date is weak |
| QR code with a landing page | Good | Capture the wording shown, not just the outcome |
| Bundled into terms and conditions | Weak | Not freely given if the purchase depended on it |
| Inferred from a past purchase | Very weak | The case consumer protection law addresses directly |
| Purchased or scraped list | None | No relationship, and the fastest route to losing the number |
Running a re-permission campaign without destroying the list
If your existing list was gathered loosely, the honest fix is to ask again. Done badly this burns the number; done well it produces a smaller list that actually performs.
- Start with the warmest segmentRecent customers who engaged. If they will not re-opt in, the colder ones certainly will not.
- Send in small batchesWatch the quality rating between batches. Stop at the first sign of a drop.
- Make the ask short and the opt-out obviousOne line on what they will get, one tap to decline.
- Accept the shrinkageA list that halves and stops getting reported is a better asset than one that doubles your risk.
- Record the new evidence properlyThis is the moment to start storing timestamp, wording and source.
We have watched quality ratings fall during exactly this exercise. Batch size and stopping discipline matter more than the copy.
Terms worth being precise about
- Opt-in
- A recorded permission to receive business-initiated messages on a named channel.
- Purpose
- What the data was collected for. Consent attaches to a purpose, so a new purpose needs new consent.
- Quality rating
- A per-number score driven by recipient blocks and reports.
- Suppression
- Stopping sends to a contact. Must apply across every tool you send from.
- Template category
- Marketing, utility or authentication. Misclassifying a promotion as utility is a common and visible error.
The grey zone
Safe and effective
- Replying inside the 24-hour window to someone who messaged you.
- Appointment reminders where the booking created the expectation.
- Marketing to people who ticked a marketing box, with a working opt-out.
Moves with a consequence
- Promoting to a service-only list.
- Uploading numbers collected by someone else.
- Submitting a promotion as a utility template to avoid the category rules.
Borderline, and businesses do it anyway
- Adding a gentle offer to the end of a service message. It is marketing, and Meta's categorisation treats it that way.
- Treating a WhatsApp enquiry from an ad as broad consent. It is a strong signal of interest and still not a marketing permission.
Frequently asked questions
Do I need opt-in to message customers on WhatsApp in the UAE?
For business-initiated messages, yes. Meta requires opt-in, and UAE data protection law requires a
lawful basis for processing personal data.
Can I message someone who contacted me first?
You can reply freely for 24 hours. After that you need an approved template, and for marketing you
need marketing consent.
Is a purchase consent to marketing?
Treat it as no. Federal Law No. 15 of 2020 prohibits suppliers from using consumer data for marketing
purposes, so collect a separate, recorded permission.
What happens if I send to a bought list?
Recipients block and report, the quality rating falls, messaging limits drop and the number can be
restricted. It is the most common way businesses lose a WhatsApp number.
How do I record consent properly?
Store the timestamp, the source, the exact wording shown and what was ticked, against the contact.
Evidence beats policy.
Does STOP have to work instantly?
Treat it as yes, across every tool you send from. A withdrawal that only applies to one campaign
system is the classic failure.
How we checked this, and what we could not settle
Checked: Federal Law No. 15 of 2020 and Federal Decree-Law No. 45 of 2021 as summarised on the UAE Government portal, read 16 September 2026. Meta's own documentation on opt-in, template categories and quality rating.
Not settled: this is commercial information, not legal advice. We have not found published UAE enforcement decisions about WhatsApp marketing specifically, so we cannot tell you where the practical threshold sits. The platform consequences described above we have seen directly; the regulatory ones we are describing from the text of the law.
Want a list that performs and a number that survives?
We build consent capture at the point of collection, separate service and marketing flows, and suppression that works across every send path.
Sources
- LawUAE Government portal, consumer protection, Federal Law 15/2020
- LawUAE Government portal, data protection laws, Federal Decree-Law 45/2021, DIFC Law 5/2020, Federal Law 2/2019 on ICT in health, Dubai Data Law
- LawUAE Government portal, justice, safety and the law, legal framework overview
- PlatformWhatsApp Business Messaging Policy, what business accounts may and may not do
- PlatformMeta, Cloud API send-messages guide, the 24-hour customer service window and templates
- PlatformWhatsApp Business Solution Terms, platform terms
Written by Edmund Gay, Learnmind.ai, Dubai. This page is commercial information about a market we operate in, not legal advice. Regulation and vendor rates on this page carry the date we checked them, and both change.