App & Mini-Program
CalonVIP: a WhatsApp-based marketing tool for businesses
A WhatsApp marketing tool for companies selling overseas: contact lists, message templates and follow-ups move off personal phones into a system the team can share.
Buyer questions
Where are the compliance limits when building a WhatsApp marketing tool?
Three hard rules define the boundary: use the official WhatsApp Business Platform (Cloud API), collect verifiable opt-in before the first message, and send marketing content only through pre-approved templates outside the 24-hour customer service window. Unofficial libraries that bypass the official API, blasting numbers that never opted in, and treating template messages as free text are three of the most common ways an account ends up restricted.
The compliance boundary for a WhatsApp marketing tool is not a vague ethical line. It is a hard constraint set by Meta's API design and business policies. Get it right and the tool keeps running. Get it wrong and the penalty is usually not a fine but a banned number, rejected templates, or a business account restricted from sending.
Three hard rules you cannot break
Rule one: official APIs only
Meta offers the WhatsApp Business Platform (formerly the WhatsApp Business API). New integrations go through the Cloud API; the earlier On-Premises API has been deprecated by Meta and closed to new sign-ups, so existing systems need to migrate. There is also the WhatsApp Business App for very small merchants. Anything else, including third-party libraries that reverse-engineer the consumer protocol, automation scripts that drive the web client, and multi-instance or device-farm software, is prohibited by Meta's terms of service.
Those unofficial routes do work at first, and they are cheaper, but the risk is asymmetric: an appeal channel exists, but the outcome and the timeline are outside your control, and the conversation history you have built up is usually gone for good. A tool built that way is a liability from the day it ships.
Rule two: opt-in before the first message
Meta's business messaging policy requires that a business obtain clear consent through some channel before starting a conversation, and that the consent record be verifiable — the business must be able to state when, on which page or form, and with what wording that number agreed to receive messages.
Compliant opt-in includes a checkbox on a website form, an in-person QR-code scan, explicit notice within an existing service relationship, or confirmation through another channel such as SMS or email. Practices that breach Meta's policy include buying number lists, scraping numbers from public sources, and treating "has not refused" as "has agreed." Whether they also breach local law depends on the target market.
Build this into the data model from day one: a number enters the database together with its opt-in source, timestamp and original wording, never reconstructed after the fact.
Rule three: marketing goes through approved templates only
WhatsApp splits conversations into two states:
| State | How it opens | What you may send | Billing |
|---|---|---|---|
| 24-hour customer service window | Opens when the user messages first; each user reply restarts the clock | Free-form text, images and files, no template needed | Service conversations are now free |
| Outside the window | Business initiates | Pre-submitted, approved template messages only | Charged, with rates set by template category and country |
Meta has changed how this is billed: service conversations are now free, and pricing has moved from per-conversation to per-message. Check Meta's current pricing page before you budget — do not carry over older figures.
Templates are submitted for review by category (marketing, utility, authentication). Reviews commonly fail because the copy is misleading, because a placeholder sits where Meta does not allow it (at the very start or end of the message, or next to another placeholder), because sample values are missing, or because the category does not match the content. Passing marketing content off as a utility template usually gets it reclassified (and billed as marketing) or rejected outright; repeated attempts accumulate into account-level action.
What this means when you build it
| Area | Compliant approach | Common mistake |
|---|---|---|
| Integration | Cloud API, verified through the official Business Manager | An unofficial library talking to consumer WhatsApp; building on the deprecated On-Premises API |
| Number management | Capture the opt-in source, timestamp and exact wording when the number is added; exportable as evidence | Importing a purchased list |
| Sending | Separate in-window from out-of-window; force templates outside the window | Stuffing whole marketing paragraphs into template variables |
| Send-rate control | Adjust to Meta's quality rating and messaging limits | Fixed high-volume blasts that ignore a falling quality rating |
| Opt-out | Clear opt-out command that takes effect immediately and persists | Telling users to "reply STOP" but never recording the opt-out |
| Data | Define where conversation data lives and how long it is kept; cross-border transfers must comply with the law of the jurisdiction the data came from | Retaining conversations indefinitely without telling users |
Platform rules are not the only rules
What follows is a general orientation only. Requirements for a specific market should be confirmed by the client's own counsel.
Local law applies wherever the recipient is. Cross-border projects usually have to consider at least:
| Regulation | What it governs |
|---|---|
| EU ePrivacy Directive and national implementations (PECR in the UK) | Commercial electronic marketing messages themselves |
| EU GDPR | The personal data processing behind those messages, and its lawful basis (consent being only one) |
| Singapore PDPA and its Do Not Call registry | Specified messages sent to Singapore numbers |
| China's Personal Information Protection Law (PIPL) | How a Chinese entity handles overseas user conversation data, and the rules for transferring it out of China |
What these share is simple: consent must be provable, opt-out must be enforceable, and processing must be disclosed. The tool's job is to turn "provable" and "enforceable" into system behavior rather than a human promise.
Two more things to watch: the WhatsApp Commerce Policy prohibits certain categories (alcohol, gambling, pharmaceuticals, weapons, adult content and others, with further regional restrictions), and template category availability varies by region — verify against your target market before you build.
How we build it
We delivered a WhatsApp-based marketing tool on the CalonVIP project (client not disclosed), moving customer lists, message templates and contact history off individual sales phones and into one system the company controls. The compliance points above are the engineering judgement we have built up on work like this.
If you want an existing WhatsApp setup reviewed for exposure, or a compliant one built from scratch, get in touch — or read the case study first.
This page summarizes Meta's publicly documented WhatsApp Business policies and API behavior. Platform rules change; check Meta's current documentation before you build. This is not legal advice.
Related cases
App & Mini-Program
Question not covered here?
Send us your situation. We reply within one business day, at no charge and without the run-around.