Sonar logo Sonar
Get started

POPIA and WhatsApp marketing

What South Africa's Protection of Personal Information Act asks of businesses that market on WhatsApp, in plain English, with the sections to check.

Checked against the Act, the Regulations as amended in April 2025 and the Information Regulator's guidance on 6 October 2026. A summary, not legal advice.

The short version

  • You need consent to send marketing on WhatsApp, unless the person is already your customer and you're marketing similar products (section 69(1)).
  • You may ask for that consent once, and only if the person hasn't already said no (section 69(2)).
  • Every marketing message must say who it's from and how to make the messages stop (section 69(4)).
  • Stop as soon as someone opts out, and keep a record of who agreed and who said no.
  • A bought or scraped list gives you no consent at all.
  • Meta's rules sit on top, and for WhatsApp they're stricter than POPIA in places.

Does POPIA cover WhatsApp?

Yes. Section 69 covers direct marketing "by means of any form of electronic communication", and the Act defines that as any text, voice, sound or image message sent over a network. A WhatsApp message fits. Since 17 April 2025 the Regulations also name WhatsApp as a channel for asking people for consent. There's no court ruling about WhatsApp specifically, but no serious reading leaves it out.

It covers more than many people expect: asking for donations counts as direct marketing, so charities are included, and the Act protects companies as well as individuals, so business-to-business marketing is covered too.

Existing customers

You can market to your own customers without separate consent, but only if all three of these are true (section 69(3)):

  • You got their contact details when they bought something from you.
  • You're marketing your own similar products or services. The Regulator's example: a clothing shop can market shoes to its customers, but not funeral cover.
  • You gave them a free, simple way to say no when you collected their details, and you give it again in every message.

Someone who only messaged you with a question isn't a customer under this section. And on WhatsApp, Meta asks for an opt-in even from customers (see Meta's rules).

Asking for consent: the one-message rule

If someone isn't your customer and hasn't agreed, you may approach them once, only to ask for consent, and only if they haven't said no before. That message must ask; it can't market.

The Regulations used to require Form 4. Since April 2025 a request can be "substantially similar to Form 4" or made in any convenient way, including on WhatsApp. A good request still carries what Form 4 asks for:

  • your business's name and contact details,
  • what you'd like to market to them,
  • the channel you'd use, and
  • a clear yes and a clear no.

If they say no, or don't answer, that's the end of it.

What every marketing message must include

Section 69(4) requires two things in every direct marketing message: who it's from, and contact details where the person can ask you to stop. On WhatsApp, your business name on the number plus a line such as "Reply STOP to unsubscribe" covers both, as long as a STOP reply actually stops the messages.

Opt-outs

  • Act on them straight away. POPIA sets no number of days. In its enforcement notice against FT Rams Consulting, the Regulator said the business had to stop immediately.
  • Keep a list of people who said no, so they're never asked again. The Regulator's guidance expects you to keep one.
  • Honour opt-outs however they arrive. The Regulations accept objections by WhatsApp, and Meta requires you to respect opt-outs made on or off WhatsApp.
  • The national opt-out registry is coming. Consumer Protection Act regulations amended on 15 April 2026 require direct marketers to register with the National Consumer Commission's registry and check their lists against it every month. The practical rules were still being finalised in October 2026. Someone who isn't on the registry still hasn't given you consent.

Bought, rented and scraped lists

Don't market to them. The people on a bought list agreed, if at all, to someone else, and they aren't your customers. A number being public doesn't change that: it may be lawful to collect, but marketing to it still needs consent. Sharing or selling a list is a new use of that information, which needs its own lawful basis and telling the people on it.

WhatsApp closes the door completely: Meta only lets you message people who gave you their number, so you can't even send the one consent request to a bought list on WhatsApp.

What happens if you get it wrong

Breaking section 69 isn't a crime in itself. It's an "interference" with personal information that the Regulator can investigate after a complaint, and then order you to fix with an enforcement notice. Ignoring that notice is an offence, which can mean a fine or up to 10 years in prison, or an administrative fine of up to R10 million. The people you messaged can also sue you for damages.

It does happen. In February 2024 the Regulator issued an enforcement notice against FT Rams Consulting over marketing emails sent without consent. The unsubscribe link in those emails didn't make them lawful.

Meta's rules on top

WhatsApp's Business Messaging Policy and Meta's opt-in guidance apply whatever POPIA allows:

  • You may only message people who gave you their number and opted in to hear from you.
  • The opt-in should make clear it's for messages from your business, and name it.
  • That applies to existing customers too, so the customer route above isn't enough on its own for WhatsApp.
  • You must respect opt-out requests, wherever they're made.

Breaking these can get your number's messaging limits cut or the number blocked, which is often the faster consequence.

How Sonar handles it

  • Every contact has a consent state: Can message, One message allowed, Needs opt-in, or Opted out.
  • The one-message rule is built in. Someone with no consent on record can get one message, which you should use to ask. After that they need an opt-in before any more marketing reaches them.
  • Broadcasts skip anyone who can't be messaged, so a list with a few opted-out people in it is safe to send to.
  • STOP and START work automatically, along with words like "unsubscribe" and "opt out". You can change the list.
  • A consent record you can show: every opt-in and opt-out is logged with when it happened and how (a keyword, an import, the API or a team member).
  • Imported contacts start without consent, at One message allowed, until they opt in. When you add someone yourself or upload an event guest list, you can record that they agreed.
  • Delete or anonymise a contact's data when they ask.

Common myths

  • "POPIA requires double opt-in." It doesn't. One clear, recorded yes is enough.
  • "You must use Form 4 exactly." Not since April 2025.
  • "An unsubscribe link makes a cold message legal." No. The FT Rams notice says so, and opting out isn't consent.
  • "POPIA only protects consumers." Companies are protected too.
  • "ECTA section 45 sets the opt-out rules." It was repealed in 2021.

Sources

This guide summarises the law as it stood on 6 October 2026. It isn't legal advice. For a specific campaign, check with a lawyer. Spotted something out of date? Email support@whats-hub.co.za.

Market on WhatsApp with consent built in

Start free trial See Sonar's compliance tools
Chat with us