Safe sendingFor businesses in Germany
WhatsApp marketing and GDPR: what German businesses need before the first message
In Germany, consent is not a formality. Here is how to collect it, prove it and still send messages people want to read.
Quick answer
WhatsApp marketing GDPR compliance in Germany starts with clear, provable consent: customers must actively agree to receive WhatsApp messages, ideally through a double opt-in. Send only to those contacts, explain how you use their data, offer an easy STOP option in every campaign, and keep transactional order messages separate from advertising.
Key takeaways
- Promotional WhatsApp messages in Germany generally need prior, explicit consent from the recipient.
- A double opt-in, where the customer confirms a second time, is the safest way to prove that consent.
- Order confirmations the customer expects are treated differently from advertising, but keep them free of promotions.
- Your privacy notice must say that you use WhatsApp and what data it processes.
- Every campaign needs a simple way to stop, and a stop must be honoured immediately.
In this article
WhatsApp marketing GDPR basics for Germany
Two sets of rules matter in Germany. The GDPR governs how you process personal data such as phone numbers, and the German Unfair Competition Act limits advertising by electronic message without consent. Together they mean: no promotional WhatsApp message without a clear yes.
| Message type | Example | What you need |
|---|---|---|
| Transactional | Your order #4471 ships tomorrow | A real order and a clear privacy notice |
| Service follow-up | Is your delivery address correct? | A real order; keep it free of offers |
| Advertising | 20% off our new collection | Prior explicit consent, ideally double opt-in |
Collecting consent with a double opt-in
A double opt-in turns a checkbox into evidence. The customer ticks an unticked box at checkout or on a form, then confirms once more, for example by sending a short WhatsApp message. You store when and how both steps happened, so you can show it if anyone asks.
- 1
Unticked checkbox
Customer opts in at checkout
- 2
Confirmation request
Customer replies YES
- 3
Record stored
Date, source, wording
- 4
Campaigns allowed
Until they send STOP
Upload only opted-in contacts to your campaign tool. In Ulfah, add a consent column to your sheet and build a segment of contacts who said yes, as described in our guide to WhatsApp sending limits.
Handling contact data responsibly
Phone numbers, names and order details are personal data. Collect only what the message needs, explain in your privacy notice that you contact customers via WhatsApp, delete contacts you no longer need and make sure everyone on your team knows where the data lives.
- Mention WhatsApp and its provider in your privacy notice.
- Keep consent records with date, source and the exact wording shown.
- Remove contacts who opted out from every list, not only one campaign.
- Export and delete data on request within the legal deadlines.
Opt-out, tone and timing in Germany
German customers value directness and privacy. Say who you are, why you are writing and how to stop, all in the first message. Avoid evenings and Sundays, keep campaigns infrequent and make every message useful enough that nobody feels the need to complain.
Ulfah blocks anyone who replies STOP or Abmelden from every future campaign automatically. Read more in our WhatsApp opt-out guide, or create a free account to test with your own number.
Bottom line
WhatsApp marketing GDPR compliance is less about paperwork and more about respect you can prove. Collect a clear double opt-in, keep order messages free of advertising, explain WhatsApp in your privacy notice, honour every STOP at once and keep campaigns rare and useful. Customers who said yes twice are also the ones most likely to reply.
Questions people ask
Is WhatsApp marketing allowed in Germany?
Yes, with prior explicit consent. Advertising by electronic message without consent is generally treated as unreasonable harassment under German competition law. Transactional messages about an existing order are treated differently, but they should not contain promotions.
Do I need a double opt-in?
It is not always strictly required, but it is the most reliable way to prove consent in Germany and is widely recommended. Without proof, you carry the risk if a customer later claims they never agreed to receive WhatsApp messages from your business.
Can I send order confirmations without marketing consent?
Generally yes, when the customer placed an order and expects the message, and your privacy notice explains it. Keep these messages purely about the order. Adding a discount code or product tips turns them into advertising that needs consent.
What should my privacy notice say about WhatsApp?
State that you use WhatsApp to contact customers, which data you process such as name, number and order details, the legal basis, how long you keep it and how customers can object or ask for deletion. A data protection adviser can help word it.
How does Ulfah help with GDPR?
Ulfah lets you upload a consent column and build campaigns only from opted-in segments, blocks STOP replies across all campaigns, keeps an opt-out record and exports or deletes contact data on request. Compliance still depends on how you collect consent.
Sources
Try it with your own WhatsApp
Ulfah — Every customer. Their own message. sends one personal message at a time from your number and sorts every reply.
contact@ulfah.chat
Keep reading
Order confirmationWhatsApp order confirmation: a practical guide for cash-on-delivery storesConfirm every order before it leaves the warehouse, in the app your customers already open first.4 min read · 10 November 2026
Safe sendingWhatsApp sending limits: how to message customers without getting blockedPace, permission and personal wording matter more than any trick.3 min read · 10 November 2026