WhatsApp chatbot: what the law requires

To put a chatbot on your business’s WhatsApp you need to comply with data protection rules, not send commercial messages to people who have not agreed to them, respect the WhatsApp Business terms and, if an artificial intelligence is replying, say so.

This guide is general information and is not legal advice: confirm your case with your adviser or a lawyer.

It is not one law: it is four separate fronts, and each asks for different things.

Data protection

The General Data Protection Regulation and the Spanish organic law that develops it: what data you collect, on what basis and what you tell people.

Commercial communications

The Spanish law on information society services: do not send advertising by electronic means to people who have not asked for it or authorised it.

WhatsApp’s terms

Not a law, but it rules: WhatsApp Business sets when and how a business may write to a person.

AI Act

If whoever replies is an artificial intelligence, the person has to know.

A chatbot processes personal data from the first message: at least the phone number and what the person writes.

• Have a legal basis for each use: the person wrote to you to ask for something, the performance of a contract with them, their consent or another you can justify.
• Say who you are, what you use the data for and how to exercise the rights of access, rectification, erasure and the rest, before or at the start of the conversation.
• Collect only what is necessary and do not keep conversations longer than needed.
• If the chatbot provider can access the data, sign the data processing agreement with them.
• If the chatbot decides something with an effect on the person, it is best that a person always reviews it (the GDPR limits solely automated decisions with significant effects).

Spanish rule

Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights (BOE-A-2018-16673), in Spanish (opens in a new tab)

Replying to someone who writes to you is not the same as writing first. Article 21 of the Spanish law on information society services prohibits, with exceptions, sending advertising or promotional communications by electronic means that have not been requested or authorised.

That is why a chatbot that answers an enquiry is one thing and a chatbot that sends promotions to a list of numbers is another.

• Replying to someone who wrote first is the usual case and the safest.
• Sending offers or news requires, as a general rule, prior authorisation (there is a limited exception for customers of similar products), and that the person can stop receiving them easily.
• Do not upload a list of phone numbers to write to them without permission: that is exactly the case the law aims to prevent.

Rule

Law 34/2002 of 11 July on information society services and electronic commerce (BOE-A-2002-13758), in Spanish (opens in a new tab)

Even if you comply with the law, WhatsApp can limit or close an account that does not respect its terms. They change over time, so always check the current ones before setting anything up.

• As of this guide, businesses that write first need the person to have agreed to receive messages.
• Messages the business starts are sent with templates that WhatsApp has to approve.
• Replying within a conversation opened by the person has different rules from starting it yourself.
• WhatsApp can close the account of a business number used for spam.

Article 50 of the EU AI Act asks that people know when they are interacting with an artificial intelligence system, unless it is obvious. It applies from 2 August 2026.

In practice, the clearest approach is for the chatbot’s first message to say that whoever replies is an automated assistant, and offer a way to speak to a person.

AI policy

How we flag it and how we work at BAZROX

A chatbot is not always the answer; these cases argue against one.

• If you get few enquiries, answering them yourself is closer and costs no upkeep.
• If the questions are always the same, an automatic reply or a link to a frequently asked questions page is sometimes enough.
• If the matter is sensitive or legal, a person is better.
• If you cannot review the conversations, an unsupervised chatbot ends up saying things you do not want.

A useful chatbot is designed from the real questions you receive and from what a person must decide. We start with a preliminary analysis: we review the real enquiries you receive and what the assistant can answer. Tell us your case and we will say whether it is worth building.

Automation and AI

How we work and what is delivered

What does the law require of a WhatsApp chatbot in a business?

Complying with data protection rules (legal basis, information and rights), not sending commercial messages to people who have not authorised them, respecting the WhatsApp Business terms and saying when whoever replies is an artificial intelligence. Confirm your case with your adviser.

Can I send promotional messages by WhatsApp to my customers?

Only if they have authorised receiving them, with exceptions that the law limits, and always with an easy way to stop receiving them. Replying to someone who wrote to you is different from writing first. WhatsApp also requires approved templates for messages the business starts.

Do I have to say that an AI is replying?

In most cases, yes, unless it is obvious from the context. Article 50 of the EU AI Act, applicable from 2 August 2026, asks that people know they are interacting with an AI system. The clearest way is to say so in the first message and offer to speak to a person.

What data can a WhatsApp chatbot keep?

Only what is necessary for what the person asked, on a legal basis you can justify and for as long as needed. Say who you are, what you use it for and how to exercise rights, and sign the data processing agreement with your provider.

When is a WhatsApp chatbot not a good idea?

When you get few enquiries, when the questions are solved by an automatic message or a frequently asked questions page, or when the matter is sensitive and a person should reply. A chatbot nobody supervises ends up saying things you do not want.

What to automate first in a small business

Five tasks a small business usually starts automating with, how to decide the order and when you do not need to program anything or use artificial intelligence.

Custom software examples for small businesses

What custom software usually looks like in a small business, examples by type of business and when a ready-made tool is enough.