WhatsApp marketing consent and GDPR for Shopify stores

WhatsApp is a personal space. People accept messages from friends, family and the businesses they chose to hear from. That is why Meta, and European law, are strict about who you can message and when. Get consent right and WhatsApp becomes a channel your customers welcome. Get it wrong and you risk blocks, a restricted number and complaints.

This article is a practical overview for Shopify merchants. It is not legal advice: for your specific situation, ask a lawyer or your data protection officer.

Two kinds of messages, two sets of rules

The first question is always: what kind of message is it?

	Transactional (utility)	Marketing
Examples	order confirmation, shipping update, cash on delivery confirmation, cancellation notice	abandoned cart reminder, promotion, new collection, welcome offer
Purpose	the order the customer placed	selling more
Consent needed	no marketing consent, but the customer must be informed and able to opt out	yes, prior opt-in
Template category at Meta	utility	marketing

The line matters because it is easy to cross. A shipping update that ends with "use code SAVE10 on your next order" is no longer purely transactional: Meta can reclassify the template as marketing, and the consent rules for marketing apply.

What Meta requires

Meta's WhatsApp Business Messaging Policy asks businesses to:

• Get an opt-in before sending business-initiated messages, which makes clear that the person agrees to receive messages from your business on WhatsApp.
• Use approved templates to start a conversation outside the 24-hour window that opens when a customer writes to you.
• Honor opt-out requests right away.
• Keep message quality high. If many recipients block or report you, Meta lowers your number's quality rating and can reduce how many people you can reach.

Consent is not only a legal topic on WhatsApp: it directly affects whether your number keeps working.

What European law adds

In the EU, two texts apply together:

• The ePrivacy rules (transposed into national law, such as article L34-5 of the French postal and electronic communications code) generally require prior consent for direct marketing by electronic message. Some countries allow a "soft opt-in" for existing customers and similar products; how it applies to WhatsApp varies, so check your country.
• The GDPR defines what valid consent is: freely given, specific, informed and unambiguous, given by a clear affirmative action. It also requires you to demonstrate that consent was given (article 7(1)) and to make withdrawing it as easy as giving it (article 7(3)).

In practice, for WhatsApp marketing:

• Unchecked box only. A pre-ticked box is not consent.
• Clear wording naming your business and the channel, for example: "I agree to receive messages from Maison Lune on WhatsApp. Reply STOP to unsubscribe."
• Separate from your terms. Consent to marketing cannot be a condition of buying.

How to collect consent on a Shopify store

Good collection points:

• A popup or form on your store with an unchecked box and the consent text.
• At checkout, with an optional box next to the phone number field.
• Keywords: a customer who sends "START" to your number is asking to subscribe.
• QR codes on packaging or in-store, leading to a conversation where the customer subscribes.
• Imports, only for contacts who already gave consent that covers WhatsApp, with proof.

Shopify now stores WhatsApp marketing consent on the customer's phone number, next to email and SMS consent. Writing consent there keeps a single source of truth: your segments, your other apps and the customer record all see the same status.

How to prove consent

If a customer or an authority asks, you need to show who agreed, to what and when. For each opt-in, keep:

• the exact text shown to the customer;
• the date and time;
• where it happened (page URL, checkout, keyword, import);
• technical evidence such as a hashed IP address or the browser user agent.

Keep these records as long as you use the consent, and for the period your lawyer recommends after that.

STOP: making opt-out effortless

Every marketing message should remind the customer how to stop, for example "Reply STOP to unsubscribe". When someone replies STOP (or the equivalent in their language):

• stop all marketing messages to that number immediately, including campaigns already scheduled;
• confirm the unsubscription in one short message;
• keep a record of the opt-out, so the number is not added back by mistake in a later import.

Your tools and GDPR

Under GDPR, your store is the data controller for your customers' data. Any WhatsApp app you install is your processor, and it should:

• sign a data processing agreement (article 28) with you;
• list its sub-processors (hosting, the WhatsApp connectivity provider, Meta);
• explain where data is hosted and how transfers outside the EU are covered;
• delete your data when you uninstall, and handle Shopify's privacy requests for access and erasure.

Ask for these documents before you connect a tool to your customer data.

How Piaflo handles consent

Piaflo was built around these rules. Marketing flows and campaigns only reach subscribed contacts. Opt-ins from the storefront popup use an unchecked box and a fixed consent text; Piaflo stores the text, date and page as proof and writes the consent to the customer's WhatsApp marketing consent in Shopify. A STOP reply unsubscribes the customer immediately. Order updates require you to confirm that customers are informed at checkout. Data is hosted in the EU, in Germany, and our data processing agreement and privacy policy list our sub-processors.

Ready to start on the right foot? Install Piaflo for free.