How do Dubai businesses use WhatsApp Business API for marketing legally?
I want to use the WhatsApp Business API to promote my business in Dubai, but I am not sure about the legal requirements. How can I use it for marketing while following UAE regulations and avoiding compliance issues?
Drupad
For a Dubai business, I would treat WhatsApp marketing as a permission-based communication channel, not simply another advertising platform.
There are two layers to check: UAE requirements around electronic marketing and personal data and WhatsApp’s own Business Platform rules.
TDRA states that marketing communications require prior consent, with records of consent and an effective unsubscribe mechanism being important controls. Here's a list of components that you must check before moving forward:
- Capture explicit opt-in: Use a clear checkbox or digital consent statement specifically covering WhatsApp marketing. Do not assume that having someone's phone number means they agreed to promotional messages.
- Store consent records: Keep the phone number, timestamp, source, wording shown at opt-in and consent status in your CRM. TDRA's policy specifically addresses retaining consent records.
Separate transactional and promotional messages: Order confirmations, delivery updates and service notifications are different from promotional campaigns. TDRA distinguishes non-marketing informational messages from marketing communications. - Build opt-out handling: Give customers a simple way to stop marketing messages and immediately synchronise that status with the WhatsApp API and CRM.
- Control message timing: TDRA's published marketing-message rules specify 7 AM to 9 PM UAE time.
- Check WhatsApp policies: Your templates, business profile, products and campaign content must comply with WhatsApp Business policies.
- Protect customer data: Limit API and CRM access, encrypt sensitive information and publish a privacy policy explaining collection and use of customer data. TDRA's website guidance also addresses privacy, consent and encryption.
To conclude, I would first audit the consent-to-message flow, CRM suppression logic, WhatsApp templates and data handling before launching a campaign. Working with UAE websites over the last few years, I have found that the technical setup matters just as much as the marketing copy. A technically sound opt-in and opt-out system gives the business a much clearer compliance trail than simply uploading a large contact list and starting a broadcast.
Priya Gupta
Yes, a Dubai business can use the WhatsApp Business Platform for marketing, but I would treat it as a consent and data protection exercise first, and a marketing exercise second.
The biggest mistake is thinking that having someone's mobile number means you can legally add them to a WhatsApp marketing list. It does not. You need to consider both UAE requirements and WhatsApp's own business messaging rules.
The UAE's Personal Data Protection Law sets rules around the processing of personal data, including requirements around consent and the rights of individuals. The UAE government also states that individuals can request that their personal data processing be restricted or stopped.
WhatsApp has its own requirements as well. Its Business Platform documentation says that once you have obtained a customer's opt in, you can initiate messages using approved message templates.
Start with proper customer consent
For marketing, I would use a clear opt in rather than assuming consent.
For example, if someone fills out a form on your website, the form could say:
"I agree to receive promotional offers and updates from [Business Name] on WhatsApp."
That is much clearer than simply collecting their phone number for an enquiry and later using it for advertising.
Keep a record of:
• When the person gave consent
• How they gave consent
• What they agreed to receive
• The phone number associated with the consent
• Whether they later withdrew that consent
This becomes particularly important if someone complains about receiving unwanted messages.
The UAE's data protection framework places importance on consent and gives individuals rights relating to their personal data.
Do not buy WhatsApp databases
This is one of the practices I would stay away from completely.
You might find vendors selling lists of "Dubai customers" or "UAE WhatsApp numbers" and promising thousands of contacts.
Having a database does not mean you have permission to market to those people.
Even if the numbers belong to people who might be interested in your product, that does not establish that they agreed to receive your marketing messages from your business.
It also creates a poor customer experience and can create problems with WhatsApp's platform policies.
Build your own permission based database instead.
Keep marketing consent separate from other consent
This is a small detail that can make a big difference.
Someone might give you their number because they want a quotation. That does not necessarily mean they want promotional messages every week.
I would separate purposes wherever possible.
For example:
"Use my number to contact me about my enquiry."
is different from:
"I agree to receive promotional offers and marketing messages on WhatsApp."
That distinction makes your records much easier to manage and gives customers a clearer choice.
Give people an easy way to stop marketing
Your process should not end when someone gives consent.
Customers should be able to withdraw it.
For example, a marketing message could include something such as:
"Reply STOP to opt out of promotional messages."
Your system should actually process that request and remove or suppress the person from future marketing campaigns.
Do not make someone contact customer support, send an email and explain why they want to unsubscribe.
If they say they no longer want marketing messages, treat that seriously.
Follow WhatsApp's messaging rules as well
There are two separate questions here.
First, are you allowed to process and use the person's information under the applicable UAE data protection requirements?
Second, are you following WhatsApp's rules for business messaging?
Both matter.
WhatsApp states that businesses need customer opt in before initiating conversations, and marketing messages sent through the Business Platform use message templates.
So I would not treat the API as a way to upload a spreadsheet containing thousands of numbers and start sending promotional messages.
Your technical implementation should have consent records, opt out handling, message templates and appropriate controls built into the system.
Be careful with the type of message
There is an important difference between:
"Your appointment is confirmed for tomorrow at 3 PM."
and:
"Your appointment is tomorrow. We are also offering 30% off our premium package."
The first is a service communication. The second contains marketing.
Your CRM or WhatsApp system should be designed to distinguish these purposes.
This becomes even more important if you are operating in sectors where additional rules may apply. Financial services, healthcare, insurance and other regulated industries can have additional requirements, so I would not rely on a general WhatsApp marketing setup without checking the rules applicable to that industry.
Keep your privacy documentation clear
Your website should explain what personal information you collect, why you collect it, how it is used, and where relevant, how customers can exercise their rights.
The UAE government notes that the Personal Data Protection Law also addresses obligations around protecting personal data, confidentiality and certain cross border transfers.
This is particularly relevant if your WhatsApp setup involves a CRM, marketing platform, automation provider or other third party that processes customer information.
Before connecting such a service, I would check:
• Who processes the customer data?
• Where is the data stored?
• What information is being shared?
• Is the provider acting as a processor on your behalf?
• What happens when a customer asks for their data to be deleted?
• Can you remove someone from every marketing list?
Do not confuse WhatsApp marketing with telemarketing rules
The UAE has specific regulations governing telemarketing calls under Cabinet Resolution No. 56 of 2024, with administrative penalties addressed by Cabinet Resolution No. 57 of 2024.
Those rules specifically concern telemarketing calls, so I would not automatically assume that every WhatsApp message is treated exactly like a phone call. At the same time, I would not use that distinction as a reason to send unsolicited promotional messages.
For a real campaign, especially a high volume one, it is worth getting advice based on your exact business, audience, messaging and setup.
What I would do before launching
I would create a simple compliance process:
Collect clear marketing opt in.
Store evidence of that consent.
Use an official WhatsApp Business Platform setup.
Use the appropriate approved message templates.
Keep transactional and promotional communications separate.
Provide a simple opt out method.
Automatically suppress opted out contacts.
Document how customer data is collected, stored and shared.
Review your privacy notice.
Check whether your industry has additional UAE requirements.
For a small business, you do not necessarily need a large internal marketing or technical team to manage this. A competent developer or external specialist can help set up the technical side, while someone internally should own the customer data and consent process.
As the business grows, I would consider bringing more of this in house if you have enough campaign volume to justify it. The important thing is that responsibility for compliance does not disappear simply because an external agency or WhatsApp provider is handling the technical implementation.
The simple rule I would follow is this: Do not ask "How many WhatsApp numbers can we message?" Ask "Which customers have clearly agreed to receive marketing from us, and can we prove it?"
That mindset will keep you much closer to both responsible marketing practice and the requirements you need to consider in the UAE.
