WhatsApp Broadcasts in South Africa: A POPIA-Ready Guide

WhatsApp is where many South African customers already talk, so enterprises naturally want to reach them there. The WhatsApp Business API (delivered mainly through Meta's Cloud API) lets you broadcast to thousands of people at once, but it puts two rulebooks in front of you: the Protection of Personal Information Act (POPIA) and Meta's own WhatsApp Business policies. Get either wrong and you risk complaints to the Information Regulator, blocked numbers and a messaging account that Meta throttles. This guide walks through how to run broadcasts that are lawful, well received and measurable.

This article is general information, not legal advice. For decisions about your own organisation, speak to your information officer or a qualified attorney, and read the Information Regulator's published guidance directly.

Why WhatsApp broadcasts need a different mindset

WhatsApp messages land in the same app people use for family and friends, so an unwanted promotion feels far more intrusive than an unread email. Recipients can block or report you with two taps, and those signals feed directly into how Meta treats your number.

On the Business API, every business-initiated message outside an open customer service window must use a pre-approved message template, and the recipient must have opted in to hear from you on WhatsApp. That structure forces you to think about consent and content before you press send.

POPIA and direct marketing by electronic communication

Section 69 of POPIA deals with direct marketing by means of unsolicited electronic communications. The Act's definition of electronic communication covers text, voice, sound or image messages sent over an electronic communications network and stored until the recipient collects them. WhatsApp messages fit comfortably inside that definition, so a promotional WhatsApp broadcast should be treated the same way as marketing SMS or email.

The consent rule

Under section 69, you may only process personal information for direct marketing by electronic communication if the person:

• has given their consent, or
• is an existing customer and the conditions of the customer exception are met (see below).

You may approach a person for consent only once, and only if they have not previously withheld it. The POPIA regulations include a prescribed form (Form 4) for requesting consent, so check with your information officer how your own forms and opt-in flows line up with it.

Consent under POPIA must be voluntary, specific and informed: a clear statement that the person will receive marketing on WhatsApp from your named organisation, no pre-ticked boxes, and no bundling consent into general terms and conditions.

The existing customer exception

You can market to an existing customer without fresh consent if all of these apply:

• you obtained their contact details in the context of a sale of a product or service
• the marketing is for your own similar products or services
• they were given a reasonable opportunity to object, free of charge and without unnecessary formality, when their details were collected
• they are given that same opportunity to object on every subsequent message

Every direct marketing message must also identify the sender and give a way to ask for the messages to stop. On WhatsApp, a "Stop promotions" quick reply button or a clear "Reply STOP to opt out" line in the template footer does the job, provided you actually act on it.

Meta's opt-in rule sits on top

Meta's WhatsApp Business Messaging Policy separately requires opt-in before you message someone on WhatsApp, and the opt-in must make clear that they are agreeing to receive messages from your business on WhatsApp. POPIA's existing customer exception does not override Meta's requirement. For broadcasts, the practical standard is simple: get explicit WhatsApp opt-in and record it.

Record keeping that survives an audit

If a customer complains to the Information Regulator, you will need to show when and how they agreed to hear from you. For each contact on a broadcast audience, keep:

Store these records alongside the contact, not in a spreadsheet on someone's laptop, with the same access controls and retention rules you use for other customer data.

Handling opt-outs properly

An opt-out is only useful if it takes effect immediately and everywhere. Good opt-out handling looks like this:

1. Recognise the request in any form. Handle "stop", "unsubscribe" and button taps automatically, and route anything ambiguous to a person.
2. Suppress before the next send. Remove the contact from every marketing audience before your next broadcast, not at the end of the month.
3. Confirm once, then stay quiet. One confirmation is reasonable. Follow-up promotions are not.
4. Keep service messages separate. An expected order update can still go out, but be honest about what counts as service.
5. Log it. The opt-out and its timestamp belong in your consent record.

In Social Agent, opt-out keywords and button replies update the contact's consent status automatically, and broadcast audiences exclude opted-out contacts at send time, so a stale export cannot sneak them back in.

Audience hygiene and template use

Keep audiences clean

• Remove numbers that repeatedly fail delivery.
• Segment by genuine interest. Relevance is the best protection against blocks.
• Send long-inactive contacts a single re-permission message rather than more promotions.
• Never buy, rent or scrape lists.

Use the right template for the job

Broadcasts almost always use Marketing templates. Trying to disguise a promotion as a Utility message to save money or improve delivery tends to backfire, because Meta reviews and can re-categorise templates. Our guide to WhatsApp template categories and approval covers what each category allows and how to avoid rejection.

Put your organisation's name and the reason for the message in the first line, personalise only where it adds value, include a clear opt-out option and keep one call to action per message.

Quality rating and messaging limits

Meta assigns every WhatsApp business phone number a quality rating based on how recipients respond to your messages, particularly blocks and reports over recent days. At the time of writing, Meta shows this as High, Medium or Low (green, yellow or red) in WhatsApp Manager.

Quality affects how many people you can reach. Meta applies messaging limits that cap how many unique customers you can contact with business-initiated template messages in a rolling 24-hour period. New accounts start on a low tier and move up as they send consistently at good quality, while a sustained low rating can hold you back or, in serious cases, lead Meta to restrict the number. Meta has been changing how these limits are calculated and which tiers apply, so check the current rules in Meta's WhatsApp Business Platform documentation rather than relying on older blog posts.

Meta may also limit how many marketing templates an individual user receives from businesses, so some messages may not be delivered even when your limits allow the send.

To protect your rating, ramp up gradually with a new number or audience, split large campaigns into batches, pause if the rating drops and send at sensible local times. A 22:00 promotion invites a block.

Measuring broadcast results

WhatsApp gives you delivery and read status for each message through the API, which is richer data than most email platforms can offer. Build a simple scorecard for every broadcast:

Look at opt-out rate alongside conversions: a broadcast that converts well but drives a spike in opt-outs is eroding next month's audience. Meta charges per delivered template message by category, so divide results by spend to compare campaigns fairly.

A broadcast that invites conversation will also generate a wave of replies within minutes. A shared inbox with sensible automation lets your team answer those replies inside the customer service window without chaos.

Putting guardrails into the process

Make the safe path the default: before any broadcast goes out, someone other than the author should check the audience, template and opt-out mechanism, with an audit trail of who sent what to whom. Social Agent builds broadcasts around exactly that model, with approvals and permissions that apply whether a person or an AI agent drafted the message.

Key takeaways

• Treat promotional WhatsApp broadcasts as direct marketing by electronic communication under POPIA section 69.
• Get explicit WhatsApp opt-in and record the source, wording, timestamp and scope of consent.
• The existing customer exception needs a free, easy opt-out at collection and on every message, and Meta's own opt-in rule still applies.
• Act on opt-outs immediately across every audience, and log them.
• Keep audiences clean, ramp up gradually and check Meta's documentation for current messaging limits.
• Measure delivery, reads, replies, opt-outs and conversions against cost.
• This is general information, not legal advice: confirm your approach with your information officer and the Information Regulator's guidance.