SMS and WhatsApp marketing terms

A text message or a WhatsApp message is electronic mail in the eyes of the marketing rules, so a business that sends offers by text needs the same consent or soft opt-in as for email, a way to stop that works by reply, and a record of each person's consent; WhatsApp adds its own platform rules, which require an opt-in before the first business message and approved templates for anything the business starts. The terms set out what the business will send, how a person opts in and out, and what the business does with the number, and the privacy notice says the rest. The privacy notice and the cookie notice are drafted for the business, with guidance on the consent mechanism, for a fixed £595 and delivery in five working days.

Who this is for

Salons, restaurants, retailers, gyms, clinics, trades, event businesses and any business in England and Wales that sends texts or WhatsApp messages to customers for marketing, reminders or both.

What matters in SMS and WhatsApp marketing terms

Why a text message is electronic mail in law

Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 applies to unsolicited marketing by electronic mail, which the Regulations define to include any text, voice, sound or image message sent over a public electronic communications network and stored until collected, so that SMS, MMS, voicemail marketing and messages through WhatsApp and similar apps are all within the rule; consent, or the soft opt-in, is what regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 requires before marketing an individual electronically, exactly as for email, and the Information Commissioner's largest fines under the Regulations have been for text campaigns sent to numbers with no consent.

Consent, the soft opt-in and the keyword that stops it

The terms should set out how a person opts in (an unticked box on the booking or checkout form, a keyword texted to the business's number, a sign-up at the till with the wording shown), what they are opting in to (marketing by text or WhatsApp from this business, about these things, roughly this often), that they can stop at any time by replying with a keyword (which must work on every message, be free or at standard rate and take effect at once), and that the business records the opt-in with the date, source and wording; the soft opt-in applies to a customer whose number came from a sale or negotiations, for similar products, with the chance to refuse at the time and in every message, which an appointment booking usually provides and a competition entry does not.

WhatsApp, the platform's rules and the opt-in they require

Messaging customers through WhatsApp Business (the app or the platform) is subject to the platform's business and commerce policies as well as the law: the platform requires the business to have obtained the person's opt-in to receive messages on WhatsApp before sending, requires business-initiated messages outside a customer conversation to use templates the platform has approved, restricts certain categories of content, and can suspend a number that generates complaints; the terms should say that the business messages on WhatsApp with the person's opt-in, that the person can block or report, and that the platform's own privacy terms apply to the service, and the business should know that the platform (and its parent) is a processor of its messages under terms it has accepted.

Service messages, reminders and the line into marketing

An appointment reminder, a delivery update, an order confirmation and a 'your table is ready' are service messages the customer expects as part of the transaction and do not need marketing consent, but a reminder that adds an offer, a 'we miss you' message, a birthday discount and a 'book your next appointment' with a promotion are marketing, and the terms should keep the two apart: service messages are sent to everyone with a transaction, marketing is sent only to those with consent or the soft opt-in, and the business should not use the reminder channel to slip marketing past the rule; the booking platform's settings implement the split and the note that comes with the documents lists them.

The sender, the number and the hours

Regulation 23 of the Regulations prohibits sending electronic mail for marketing where the sender's identity is disguised or concealed or no valid address for opting out is given, so every message should name the business and carry the stop keyword; the terms should state the number the business sends from (a long number, a short code or the business's WhatsApp number), that the business sends during reasonable hours (a text at midnight is lawful but is the complaint), how often the person can expect messages, and that standard message charges may apply to replies; a business that sends from a number the customer cannot reply to has no working opt-out.

Records, retention and the complaint about a text

The business should keep the record of each opt-in, the suppression list of every number that has stopped (kept permanently, so that the number is not re-added), the log of messages sent, and the retention period for numbers of people who have not transacted for a stated time, and the privacy notice should state the basis for marketing by text, the platform used as a processor under Article 28 of the UK GDPR, the transfers under Article 46 where the platform is hosted abroad, and the individual's rights over their data (access, rectification, erasure, restriction, portability, objection), the process and the one-month limit, and the complaint to the Information Commissioner's Office; a complaint about a text is answered by producing the opt-in record and confirming the stop, and the Data (Use and Access) Act 2025 raises the fines under the Regulations to the UK GDPR level on commencement, which makes the record worth keeping.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do we need consent to text our customers?

For marketing, consent or the soft opt-in (the number came from a sale or negotiations, the message is about similar products, and they could refuse at the time and in every message). Reminders and confirmations are service messages and do not need it. The terms and the booking settings keep the two apart.

Can we use WhatsApp to message customers?

With the person's opt-in to WhatsApp messages, approved templates for messages the business starts, and the platform's policies followed. The terms say so, and the platform is a processor under terms the business has accepted.

What has to be in every marketing text?

The business's name and a stop keyword that works at once. A message from a number that cannot be replied to, or without the sender identified, breaches the rule regardless of consent.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Email marketing and consent for a small business
• Privacy notice for a salon using online booking

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.