POPIA and WhatsApp: what you're actually allowed to send customers

The distinction that matters most

POPIA section 69 regulates electronic communications sent for the direct or indirect purpose of promoting goods or services. A genuinely transactional message about work already requested is different from a promotional message, but adding offers, sales language or a request for more business can change the analysis.

Section 69(3) provides a limited existing-customer exception for the responsible party's own similar products or services. It applies only where the contact details were obtained in the context of a sale and the customer received a reasonable, free opportunity to object both when the details were collected and in every later marketing communication. Bought or scraped lists do not satisfy that exception.

Treat review requests carefully

A short request for an honest review of a completed job may be framed as a transactional follow-up rather than a promotion, but POPIA does not create a blanket review-request exemption. Classification depends on the message's purpose and content. If the message also advertises services, offers a discount or asks for future business, treat it as direct marketing and apply section 69.

Use the same neutral review invitation for every eligible customer, send it only in relation to genuine work, avoid promotional add-ons and include a working opt-out. Service recovery may happen separately, but it must not suppress or delay access to the public-review link.

The opt-out has to actually work

An opt-out instruction that nobody reads and no system honours is worse than none at all, because it demonstrates you knew the obligation and failed it. Whatever you send must include a clear way to stop, and a STOP reply has to genuinely suppress that person across every channel and every future campaign — immediately, not at the next list clean-up.

This is the part most businesses get wrong. The message template is compliant; the system behind it isn't. If somebody replies STOP on WhatsApp and later receives an SMS or an email from the same business, the opt-out was never real.

Meta's rules sit on top of POPIA, and they bite faster

Even where POPIA permits a message, WhatsApp's own Business Platform policy may not. Meta requires opt-in for template messages, restricts what marketing templates may say, and rates the quality of your number based on how recipients react. Enough blocks or reports and your number's quality rating drops, your sending limits fall, and eventually the number is restricted.

In practice Meta will punish you long before the Information Regulator does. Businesses that treat WhatsApp like a bulk SMS channel lose the channel.

What good practice looks like

Collect the number in the course of doing business and say plainly at that point how you'll use it. Message the customer about their own job, not about your specials. Send review requests once, shortly after the work, never repeatedly. Put an opt-out in every message and honour it instantly and everywhere. Keep a record of consent and of opt-outs, because the burden of proof is on you.

None of this makes WhatsApp harder to use. It makes it sustainable, which matters when it's the channel your customers actually read.