Lawful WhatsApp marketing in Spain: consent or a fine
· 3 min read
WhatsApp converts: people open it. That is precisely why it is where it is easiest to cross the line — and the line here is not an opinion, it is article 21 of the LSSI, the Spanish e-commerce law: it is forbidden to send commercial communications the recipient has not consented to. Bulk sending without consent is a serious infringement (art. 38.3 LSSI), with fines from €30,001 to €150,000 (art. 39). It is not theory: sanctioning decisions are published every year.
The two lawful doors
- Prior consent — the (unticked) box the customer ticked when signing up or buying, asking to receive offers. Keep it with its date: we stamp it that way ourselves in our own sign-ups.
- A prior contractual relationship (art. 21.2 LSSI): you can promote products similar to those the customer already bought from you, without express consent, provided that in every sending they can object in a simple and free way.
And in both cases: check the Robinson List before every campaign (art. 23 of the Spanish data protection act, LOPDGDD) for anyone who is not already a customer, identify yourself as the advertiser and offer a clear opt-out — a “reply STOP” that actually works.
WhatsApp's additional requirements
Meta requires approved templates in the marketing category and its own opt-in. Meta decides the category and our platform prices with it — if Meta recategorises your “informational” template as marketing, you will see it reflected, not hidden. Meta bills the conversation separately from our flat rate.
And since 15 September, the sender too
For SMS with a brand name there is a regulatory novelty: the alias must be registered in the CNMC Alias Registry, and traffic with unregistered senders is cut at origin. We explain it here, because it affects any campaign with an alphanumeric sender.
How we set it up
Lists with documented opt-in, templates synchronised from Meta, opt-outs applied to your own lists before each sending and campaigns through the API or the dashboard with an estimated cost before you confirm. Marketing that works for years is marketing you can show an inspector.
The file of a campaign done properly
If the Spanish Data Protection Agency (AEPD) asks one day, this is what you should be able to show in an afternoon:
- The origin of each consent: date, form and box — unticked by default — with which each recipient accepted advertising.
- The Robinson List check before the campaign, with its date, for recipients who were not already customers.
- The content sent, identifying the advertiser and with the way to opt out.
- The opt-outs applied: who asked to leave and that they received nothing again.
Our platform keeps the history of each sending with its date and content, and the lists reflect the exclusions you apply. The part only you can build is the first: the archive of those consents lives on your website or in your CRM, and it is the piece that decides a sanctioning procedure.
A lawful campaign is not more expensive: it is the same campaign, with the paperwork.