The Compliance Checklist for WhatsApp Commerce: Opt-Ins, Message Frequency, and Shopify Data

What Is WhatsApp Commerce Compliance?

WhatsApp commerce compliance means following Meta's Business Messaging Policy, the WhatsApp Commerce Policy, and applicable data-protection laws (GDPR, CCPA, LGPD) when you use WhatsApp to sell, recommend products, or support customers. Non-compliance can result in account suspension, message-sending blocks, or regulatory fines — all of which stop revenue cold.

For Shopify merchants and DM-automation agencies, compliance is not optional. It is a precondition for sustainable conversational commerce.

Opt-In Requirements: The Foundation of Everything

WhatsApp requires explicit, documented opt-in before you send any business-initiated message. A customer messaging you first does not automatically grant you permission to send marketing or promotional content later.

What a Valid Opt-In Looks Like

• Clear language: The opt-in form must say the customer agrees to receive WhatsApp messages from your business — specifically, not buried in general terms.
• Named sender: The business name must be visible at opt-in. "You will receive messages from Maison Denim via WhatsApp" — not just "our team."
• Message type disclosure: State whether you will send order updates, promotions, cart reminders, or all three. Bundling all categories into one vague opt-in creates risk.
• Easy opt-out path: The opt-in flow must make clear how the customer can unsubscribe. "Reply STOP at any time" is the standard.

Where to Collect Opt-Ins on Shopify

• Checkout page: add a WhatsApp consent checkbox (unchecked by default — pre-ticked boxes are non-compliant under GDPR)
• Post-purchase thank-you page: offer to send order tracking via WhatsApp
• Pop-up or lead form: clearly separate from email opt-in
• Click-to-WhatsApp ads: the landing conversation itself counts as opt-in if your opening message confirms consent and the user replies

Store each opt-in with a timestamp, the channel where it was collected, and the exact language shown to the user. This log is your evidence if Meta or a regulator audits you.

Message Frequency: How Often Is Too Often?

Meta does not publish a hard daily cap per contact, but it enforces quality ratings on your WhatsApp Business Account. When users block or report your messages, your quality rating drops — and Meta throttles or suspends sending.

Practical Frequency Rules

• Transactional messages (order confirmation, shipping update, delivery notice): send as events occur — no frequency concern as long as messages are genuinely triggered by order activity.
• Marketing messages (promotions, product launches, re-engagement): most compliant brands stay at 2–4 per month per opted-in contact. Going beyond that without strong segmentation increases block rates.
• Cart abandonment: one reminder within 24 hours of abandonment is the industry standard. A second at 48 hours is acceptable if the first was not opened. Three or more reminders for a single cart is a spam pattern.
• Re-engagement sequences: if a contact has not purchased or interacted in 90+ days, treat them as cold. Send a single re-permission message before resuming regular sends.

Frequency vs. Relevance: The Real Metric

A message sent twice a week that is precisely relevant (the right product, the right price, in stock) generates fewer complaints than one irrelevant message per month. Relevance is a compliance lever, not just a conversion lever. This is exactly the logic behind how SmartBrain works: the server selects which product to surface based on live catalog, stock, and budget signals before the message is ever composed. Irrelevant recommendations are eliminated at the source, not in the copy.

Shopify Data: What You Can Use and How

Data You May Use for WhatsApp Targeting

• Order history: products purchased, frequency, average order value
• Browsing behavior: collections viewed, products added to cart (via Shopify Pixel)
• Customer tags: loyalty tier, subscription status, geographic region
• Explicit preferences: sizes, categories, or interests collected during opt-in

Data You Must Not Use Without Additional Consent

• Health or medical inferences (even from supplement or wellness purchases) — sensitive category under GDPR
• Data purchased from third-party lists and loaded into Shopify — this data carries no WhatsApp opt-in
• Social graph data from Meta ads audiences passed back into your CRM without a lawful basis

Data Retention and Deletion

If a customer unsubscribes from WhatsApp messages, you must stop sending within 48 hours. If they also invoke their right to erasure under GDPR, you must delete their WhatsApp number and associated consent record from your database — including any integration layer sitting between Shopify and your messaging platform. Document your deletion procedure before you scale.

WhatsApp vs. SMS: A Compliance Comparison

Merchants often ask whether WhatsApp or SMS is easier to operate compliantly. Here is a direct comparison on the dimensions that matter most:

• Opt-in standard: SMS (TCPA, USA) requires written consent and allows one-click opt-out. WhatsApp requires explicit written consent globally, plus Meta's own policy layer on top of local law — making WhatsApp stricter in practice.
• Template approval: WhatsApp business-initiated messages outside the 24-hour session window must use pre-approved message templates. SMS has no equivalent pre-approval requirement.
• Rich media: WhatsApp supports images, carousels, and buttons natively and compliantly. SMS rich media (MMS) has lower deliverability and no interactive button standard.
• Cost per message: WhatsApp charges per conversation (not per message) in most regions. SMS charges per message segment. For high-frequency sequences, WhatsApp is typically cheaper per interaction.
• Account risk: A WhatsApp Business Account ban affects your entire messaging operation on that number. An SMS provider suspension is easier to recover from by switching carriers.

For most Shopify merchants targeting international customers, WhatsApp has the better reach-to-cost ratio — but the compliance overhead is higher and requires a proper opt-in infrastructure from day one.

How SmartBrain Reduces Compliance Risk

The biggest source of WhatsApp marketing complaints is irrelevance — messages that feel like spam because the product does not match the customer's situation. SmartBrain eliminates this at the recommendation layer: before any message is sent, the engine checks real-time catalog data (availability, price, category fit) and selects the product. The AI then writes copy for that specific recommendation. The result is fewer messages that feel off-target, which directly reduces block and report rates.

Agencies managing multiple Shopify brands through SmartBrain also benefit from a centralised audit trail: every recommendation decision is logged server-side, giving you the evidence layer that compliance audits require.

FAQ: WhatsApp Commerce Compliance

Do I need a separate opt-in for each type of WhatsApp message (transactional vs. marketing)?

Technically Meta allows a single opt-in that covers all message types, but best practice — and GDPR guidance — is to separate transactional and marketing consent. Customers are far more willing to accept order updates than promotional messages, and separating them reduces opt-out rates on the marketing list.

What happens if Meta suspends my WhatsApp Business Account?

You lose the ability to send or receive messages on that number. Recovery requires filing an appeal with Meta, which can take 5–15 business days with no guarantee of reinstatement. Always maintain a backup communication channel (email or SMS) for order-critical notifications.

Can I import my Shopify email list into WhatsApp?

No. An email opt-in does not transfer to WhatsApp. Every contact you message on WhatsApp must have opted in specifically for WhatsApp communication from your business.

How do I handle WhatsApp compliance for customers in multiple countries?

Apply the strictest applicable standard to all contacts — in practice, GDPR if you have any EU customers. This simplifies your policy to one framework instead of country-by-country rules.

Does using an approved WhatsApp Business Solution Provider protect me from suspension?

A BSP (Business Solution Provider) gives you access to the WhatsApp Business API and may offer template management tools, but compliance responsibility remains yours. The BSP does not absorb regulatory or Meta-policy liability on your behalf.