POPIA and WhatsApp: what you're actually allowed to send customers

The distinction that matters most

POPIA treats a message to an existing customer about work you've done for them very differently from a message to a stranger promoting your services. The first is ordinary business communication. The second is direct marketing, and section 69 of the Act says you may not send it without consent, with one narrow exception.

That exception is worth knowing precisely: you may market to an existing customer, using contact details you obtained during a sale, about your own similar products or services — and only if you gave them a reasonable chance to object when you collected the details, and give them a chance to object in every message afterwards. If you bought a list, scraped numbers, or are contacting someone who has never transacted with you, that exception does not apply and you need consent first.

Asking for a review is not direct marketing

This trips people up. A message asking a customer to review a job you have just completed for them is not promoting a product or service — it is following up on an existing transaction. It sits on the safe side of the line, provided it goes to a genuine customer, refers to actual work, and carries an opt-out.

That said, the opt-out is not optional in practice even where the Act might not strictly demand it. It costs one line, it protects you if the classification is ever argued, and it materially improves how people respond.

The opt-out has to actually work

An opt-out instruction that nobody reads and no system honours is worse than none at all, because it demonstrates you knew the obligation and failed it. Whatever you send must include a clear way to stop, and a STOP reply has to genuinely suppress that person across every channel and every future campaign — immediately, not at the next list clean-up.

This is the part most businesses get wrong. The message template is compliant; the system behind it isn't. If somebody replies STOP on WhatsApp and later receives an SMS or an email from the same business, the opt-out was never real.

Meta's rules sit on top of POPIA, and they bite faster

Even where POPIA permits a message, WhatsApp's own Business Platform policy may not. Meta requires opt-in for template messages, restricts what marketing templates may say, and rates the quality of your number based on how recipients react. Enough blocks or reports and your number's quality rating drops, your sending limits fall, and eventually the number is restricted.

In practice Meta will punish you long before the Information Regulator does. Businesses that treat WhatsApp like a bulk SMS channel lose the channel.

What good practice looks like

Collect the number in the course of doing business and say plainly at that point how you'll use it. Message the customer about their own job, not about your specials. Send review requests once, shortly after the work, never repeatedly. Put an opt-out in every message and honour it instantly and everywhere. Keep a record of consent and of opt-outs, because the burden of proof is on you.

None of this makes WhatsApp harder to use. It makes it sustainable, which matters when it's the channel your customers actually read.