Back to Intelligence Hub
platform-policyEuropean UnionRisk Level: high
WhatsApp Business Click-to-Chat Ads EU May 2026: DSA VLOP Status, Conversational Commerce Disclosure & Advertiser Compliance
WhatsApp's full DSA VLOP designation lands in May 2026 and Click-to-Chat ad campaigns face a new transparency, consent and disclosure stack. Here is the advertiser-side workflow.
Quick Answer
WhatsApp's full DSA VLOP designation lands in May 2026 with Click-to-Chat ad campaigns facing a new transparency, consent, and disclosure stack. Conversational commerce flows now require Article 26 sensitive-category limits on targeting, opt-in confirmation for ongoing messaging, and DSA Article 39 ad-repository inclusion for EU-served placements.
WhatsApp DSA VLOP & May 2026 Phase
WhatsApp received Very Large Online Platform designation under the EU Digital Services Act in stages. The full set of VLOP obligations applicable to WhatsApp Channels landed mid-May 2026 and the broader WhatsApp surface — including Click-to-Chat ad targeting and the WhatsApp Business platform — joins the VLOP obligations through Q2 2026. The May 2026 phase is the first wholesale enforcement window for commercial advertising activity routed through WhatsApp.
Click-to-Chat ads — user taps an ad on Facebook, Instagram or another Meta surface and is connected to a WhatsApp conversation with a business — combine multiple regulatory frameworks in one user journey. The ad placement is on a Meta surface (Meta's ad framework). The WhatsApp conversation falls within the VLOP framework. The transition produces specific compliance obligations the May 2026 phase operationalises.
Four specific obligations apply: Article 39 ads repository disclosure on Meta side, Article 26 sensitive-category prohibition for targeting, Article 28 minor protection (age-18 floor), and WhatsApp-side VLOP transparency for the conversation phase.
"Click-to-Chat is no longer a single ad format — it is a cross-surface user journey with two regulatory perimeters and one shared advertiser obligation."
— AuditSocials WhatsApp Click-to-Chat brief, May 2026
For consolidated EU regulatory framework, see EU DSA Compliance. Reference the parallel WhatsApp Channels DSA guidance.
Conversational Commerce Disclosure
Disclosures operate at multiple touchpoints in the user journey from initial ad placement through the WhatsApp conversation to any subsequent commercial transaction.
Touchpoint Disclosure Map
| Touchpoint | Disclosure | Framework |
|---|---|---|
| Ad placement (Meta surface) | WhatsApp routing visible in CTA + supporting text | EU Unfair Commercial Practices Directive |
| Conversation entry (WhatsApp) | Commercial nature, business identity, data handling, user rights | GDPR transparency + DSA |
| Ongoing messaging consent | Frequency, categories, withdrawal right | GDPR Article 7 |
| Product info + commercial terms | Description, pricing, delivery, returns, complaints | EU Consumer Rights Directive |
| AI-augmented responses | AI system disclosure | EU AI Act Article 50 |
For automated audit of conversational commerce disclosure, run AI Compliance Audit.
GDPR Data Processing Layer
GDPR applies to conversation data with multiple parties involved (advertiser as controller, WhatsApp as processor, third-party CRM as additional processor).
Six-Layer GDPR Stack
- Lawful basis: Consent for conversation initiation; contract performance for transactions; explicit additional consent for ongoing messaging beyond customer service window
- Controller-processor: Advertiser controller; WhatsApp processor; CRM additional processor; processing agreements required
- Article 9 special categories: Avoid prompting; heightened protection when volunteered
- Article 22 profiling: Automated decision-making + objection right framework
- Cross-border transfers: Verify Standard Contractual Clauses cover actual flow including third-party CRM
- User rights response: Access, deletion, objection within 30 days across WhatsApp + CRM
For audit of GDPR compliance across cross-platform conversational commerce, run Legal Compliance Scan.
Template Messages & Consent Framework
WhatsApp Business template framework distinguishes four categories with different consent and content requirements.
Template Category Matrix
| Category | Use Case | Consent | Format |
|---|---|---|---|
| Marketing | Promotional, product announcements, offers | Explicit opt-in (WhatsApp-native required May 2026+) | Approved templates only |
| Utility | Order confirmations, shipping, reminders, account notifications | Lighter — aligned with transactional context | Approved templates with format flexibility |
| Authentication | OTP, identity verification | Implicit via authentication request | Specific format; no marketing content |
| Service | Responses within 24h customer service window | Implicit via prior interaction | Flexible format in conversational context |
May 2026 Tightening
- WhatsApp-native opt-in required: External website checkboxes or contractual provisions no longer sufficient for marketing template consent
- Customer service window: 24h after user's last interaction; resets per interaction
- Approval timeline: Marketing 3-7 business days, authentication same-day
- Content alignment: Substantiation capability for any product claims
For automated review of template message configurations, route through AI Compliance Audit.
Practical Click-to-Chat Workflow
Five-workstream parallel rollout for EU Click-to-Chat campaigns in May 2026 framework.
Workstream Summary
| Workstream | Output |
|---|---|
| Account + template configuration | WhatsApp Business verification + approved templates per use case |
| Consent capture flow design | WhatsApp-native opt-in + GDPR-aligned consent text + retention infra + withdrawal mechanism |
| Conversational disclosure framework | Disclosures at all 5 touchpoints + documentation for regulator response |
| GDPR data processing posture | Processing agreements + transfer mechanism verification + user rights infrastructure |
| Cross-platform user journey design | Coherent experience: ad → conversation → transaction → follow-up |
For end-to-end audit of Click-to-Chat campaign readiness, run AI Compliance Audit.
Click-to-Chat EU Compliance Checklist
- [ ] Verify WhatsApp Business account through standard verification flow
- [ ] Approve marketing, utility, authentication templates per use case
- [ ] Implement WhatsApp-native opt-in flow (external evidence no longer sufficient)
- [ ] Document consent capture aligned with GDPR Article 7
- [ ] Configure disclosure at ad placement (WhatsApp routing visible in CTA)
- [ ] Configure conversation-entry disclosure (commercial nature, identity, data handling, rights)
- [ ] Apply Article 26 sensitive-category prohibition to targeting
- [ ] Apply Article 28 minor protection (age-18 floor for EU)
- [ ] Verify Article 39 repository disclosure aligns with actual targeting
- [ ] Document controller-processor relationship with WhatsApp + third-party CRM
- [ ] Implement user rights response process across WhatsApp + downstream processors
- [ ] Test cross-platform user journey against representative scenarios
- [ ] Disclose AI augmentation under Article 50 if used
- [ ] Track in-flight WhatsApp + DSA guidance through the Policy Tracker
Frequently Asked Questions
What does WhatsApp's full DSA VLOP designation in May 2026 mean for Click-to-Chat advertisers?
WhatsApp received Very Large Online Platform designation under the EU Digital Services Act in stages, with the full set of VLOP obligations applicable to WhatsApp Channels as of mid-May 2026 and the broader WhatsApp surface — including Click-to-Chat ad targeting and the WhatsApp Business platform — joining the VLOP obligations through Q2 2026. The May 2026 phase is the first wholesale enforcement window where the full VLOP framework applies to commercial advertising activity routed through WhatsApp surfaces. Click-to-Chat ads — where a user taps an ad on Facebook, Instagram, or another Meta surface and is connected to a WhatsApp conversation with a business — are a distinct ad format that combines several regulatory frameworks in one user journey. The ad placement is on a Meta surface and falls within Meta's standard ad framework. The WhatsApp conversation occurs on a WhatsApp surface and falls within the VLOP framework. The transition between the two surfaces produces specific compliance obligations that the May 2026 phase operationalises. The first specific obligation is Article 39 ads repository disclosure for the ad placement on the Meta surface. Click-to-Chat ad campaigns must be reflected in Meta's Article 39 repository with accurate targeting parameters, advertiser identity, funder identity for political or issue-based ads, and total impressions delivered to EU recipients. The second specific obligation is Article 26 sensitive category prohibition. Click-to-Chat ad targeting cannot use special category audience attributes including health, political opinion, religious belief, sexual orientation, trade union membership, biometric identifiers, and genetic data. The platform-side filter applies the same prohibition to Click-to-Chat as to other Meta surfaces. The third specific obligation is Article 28 minor protection. Click-to-Chat ad campaigns must apply hard age-eighteen floors for profiling-based targeting on EU surfaces. The fourth specific obligation operates within WhatsApp surfaces once the user has entered the conversation. WhatsApp must satisfy VLOP obligations on the conversation side including transparency about commercial intent, traceability of business communications, and risk assessment for conversational commerce flows. Advertisers should not assume that WhatsApp-side compliance is fully handled by WhatsApp — advertiser-side practices including template message content, consent flows, and conversation handling produce direct advertiser obligations. From the advertiser perspective the May 2026 phase produces several specific operational requirements that did not previously exist for Click-to-Chat campaigns. For consolidated EU regulatory framework, see EU DSA Compliance and reference the parallel WhatsApp Channels DSA compliance guidance.
What conversational commerce disclosure obligations apply to WhatsApp Business advertisers in 2026?
Conversational commerce disclosure obligations apply to WhatsApp Business advertisers running Click-to-Chat campaigns in the May 2026 EU framework. The disclosures operate at multiple touchpoints in the user journey from the initial ad placement through the WhatsApp conversation to any subsequent commercial transaction. The first disclosure touchpoint is the ad placement on the Meta surface. The ad creative must clearly indicate that tapping the ad opens a WhatsApp conversation with a business rather than a standard click-through to a website. The disclosure should appear in the call-to-action and supporting text, with the WhatsApp branding visible to satisfy consumer expectation alignment. Ads that obscure the WhatsApp routing produce consumer protection risk under the EU Unfair Commercial Practices Directive. The second disclosure touchpoint is the conversation entry on WhatsApp. When the user enters the WhatsApp conversation the first message from the business should disclose the commercial nature of the conversation, the business identity, the data handling practices applicable to the conversation, and the user's rights including the right to terminate the conversation and request deletion of the conversation data. WhatsApp's platform-side template framework supports several formats for the entry disclosure, and advertisers should select a format that aligns with the campaign's commercial intent. The third disclosure touchpoint is the consent flow for ongoing commercial messaging. WhatsApp's framework for ongoing messaging requires user consent for messages sent outside the twenty-four-hour customer service window after the user's last interaction. The consent flow must be clear about the message frequency, content categories, and the user's right to withdraw consent. The consent capture mechanism is platform-side but advertisers must configure their template messages to support the consent capture. The fourth disclosure touchpoint is product information and commercial terms. Click-to-Chat conversations that lead to commercial transactions must satisfy the EU Consumer Rights Directive disclosure obligations including product description, pricing, delivery terms, return rights, and complaints handling. The disclosure obligations apply regardless of whether the transaction completes within WhatsApp or transitions to a separate checkout flow. The fifth disclosure touchpoint is the AI disclosure for AI-augmented business responses. WhatsApp Business platform supports AI-augmented response generation and the May 2026 EU AI Act framework requires disclosure when users interact with AI systems. Businesses using AI-augmented responses must disclose the AI involvement to align with Article 50 transparency obligations. From the operational perspective Click-to-Chat advertisers should map the user journey from ad placement through conversation conclusion and identify the disclosure obligations at each touchpoint. The disclosures should be incorporated into template message libraries, consent flow configurations, and supporting documentation. The disclosures should be tested against representative user journeys to verify that the consumer-facing experience satisfies all applicable framework obligations. For automated audit of conversational commerce disclosure compliance, run AI Compliance Audit.
How does GDPR interact with WhatsApp Click-to-Chat conversation data in 2026?
GDPR applies to processing of personal data in WhatsApp Click-to-Chat conversations and produces several specific obligations on advertisers running Click-to-Chat campaigns. The interaction is layered because multiple parties — the advertiser, Meta as the ad placement controller, WhatsApp as the conversation infrastructure provider, and any third-party processors — are involved in the data flow. The first GDPR layer is the lawful basis for the conversation. Click-to-Chat conversations typically operate under the lawful basis of consent for the initiation of the conversation and contract performance for any subsequent transaction. The consent must be freely given, specific, informed, and unambiguous. The user's tap on the ad call-to-action constitutes the consent for the conversation initiation under most operational interpretations. Subsequent ongoing messaging beyond the customer service window requires explicit additional consent. The second GDPR layer is the controller-processor relationship. The advertiser is typically the controller for the conversation content and the customer relationship arising from the conversation. WhatsApp acts as a processor for the conversation infrastructure under the standard WhatsApp Business agreement. Third-party CRM systems that ingest conversation data act as additional processors with separate processing agreements. The advertiser's controller responsibilities include data minimisation, purpose limitation, retention discipline, and response to user rights requests. The third GDPR layer is sensitive category processing. Click-to-Chat conversations frequently surface sensitive category information including health concerns, political opinions, sexual orientation, religious belief, and other Article 9 categories. The advertiser must avoid prompting users to share sensitive category information unless the lawful basis under Article 9 supports the processing. Even where users volunteer sensitive category information, the advertiser must apply heightened protection including specific retention discipline and access controls. The fourth GDPR layer is automated decision-making and profiling. Click-to-Chat conversations may produce profiles of users that inform subsequent marketing communications. Profiling activities must satisfy the Article 22 framework on automated decision-making and the user's right to object to profiling. The fifth GDPR layer is cross-border data transfers. WhatsApp's infrastructure operates across jurisdictions and the conversation data may transit to non-EEA countries during processing. The advertiser must verify that the cross-border transfer mechanism — typically WhatsApp's Standard Contractual Clauses framework — covers the actual data flow. Advertisers using third-party CRM systems for conversation data must verify that the CRM's transfer mechanism is also adequate. The sixth GDPR layer is user rights response. Users can exercise GDPR rights including access, deletion, and objection on conversation data. The advertiser must implement processes to respond to rights requests, retrieve conversation data from WhatsApp and any downstream processors, and provide the response within the GDPR thirty-day timeline. From the operational perspective Click-to-Chat advertisers should treat GDPR compliance as a recurring workstream rather than a one-time setup. The conversation data flow evolves as WhatsApp's platform evolves and as the advertiser's third-party processor stack changes. Periodic review of the data processing posture is essential for response to regulator inquiries and user rights requests. For audit of GDPR compliance across cross-platform conversational commerce, run Legal Compliance Scan and reference EU DSA Compliance.
What template message restrictions and consent requirements apply on WhatsApp Business in 2026?
WhatsApp Business template message restrictions and consent requirements operationalise the platform's commercial messaging framework alongside the broader EU regulatory stack. The May 2026 phase tightens several aspects that were previously flexible and creates specific advertiser obligations on template configuration, consent capture, and message timing. The template message framework distinguishes several categories. The marketing template category covers promotional messages, product announcements, and commercial offers. Marketing templates require explicit user opt-in through a consent capture mechanism and can only be sent within applicable messaging windows. The utility template category covers transactional messages including order confirmations, shipping updates, appointment reminders, and account notifications. Utility templates are subject to lighter consent requirements but must align with the underlying transactional context. The authentication template category covers one-time passwords and identity verification messages. Authentication templates have specific format requirements and cannot include marketing content. The service template category covers responses within the customer service window after a user's last interaction. Service templates have flexible format but must remain in the conversational service context. The May 2026 update tightens the consent capture mechanism for marketing templates. Previously WhatsApp accepted opt-in flows that operated through external mechanisms such as website checkboxes or contractual provisions. The May 2026 update requires the opt-in to be captured within a WhatsApp conversation or through a verified identity flow that maps to the WhatsApp account. External opt-in evidence is no longer sufficient. Advertisers must implement WhatsApp-native consent capture flows for marketing template eligibility. The customer service window — the twenty-four-hour period after the user's last interaction during which businesses can respond freely without template approval — remains the primary mechanism for ongoing conversation. Outside the window businesses must use approved templates and must verify consent for marketing templates. The window resets with each user interaction. The advertiser-side workflow includes several specific configuration items. Template approval requests must align with WhatsApp's content policies and the broader EU regulatory framework. Approval timelines vary by template category, with marketing templates typically taking three to seven business days and authentication templates taking same-day in most cases. Template content must not include misleading claims, prohibited content categories, or claims that conflict with the advertiser's substantiation capability. Consent capture flows must be implemented in WhatsApp-native format with documentation that supports response to regulator inquiries. The advertiser should retain consent records aligned with GDPR Article 7 documentation requirements. From the strategic perspective the template framework rewards advertisers who invest in conversation design rather than treating WhatsApp as a one-way broadcast channel. Conversational commerce performs better when the conversation is genuinely conversational and aligned with the user's intent. The framework's restrictions on marketing templates push advertisers toward higher-quality conversation design. For automated review of template message configurations, route through AI Compliance Audit.
What practical workflow should advertisers follow for EU Click-to-Chat campaigns in May 2026?
The practical workflow for advertisers running EU Click-to-Chat campaigns in the May 2026 framework involves five workstreams that should run in parallel during campaign planning and execution. The workstreams operationalise the DSA VLOP framework, the conversational commerce disclosure obligations, the GDPR data processing posture, the template message restrictions, and the cross-platform user journey design. The first workstream is account and template configuration. The WhatsApp Business account must be verified through the standard business verification flow and template messages must be approved for the campaign's intended use. Marketing template approvals require alignment with content policies and consent capture documentation. Utility templates require alignment with the underlying transactional context. Account configuration typically takes between five and ten business days for new advertisers and same-day for existing advertisers extending into Click-to-Chat. The second workstream is consent capture flow design. WhatsApp-native consent capture flows must be implemented for marketing template eligibility. The flow design includes the initial consent moment within the conversation, the consent text aligned with GDPR transparency, the consent record retention infrastructure, and the consent withdrawal mechanism. The flow design should be tested against representative user journeys to verify regulatory alignment and user experience. The third workstream is conversational disclosure framework. Disclosures at the ad placement, conversation entry, ongoing messaging, product information, and AI augmentation touchpoints must be configured and tested. The disclosures should align with the EU Unfair Commercial Practices Directive, GDPR transparency, the EU Consumer Rights Directive, and the EU AI Act Article 50. Disclosure framework documentation should be retained for response to regulator inquiries. The fourth workstream is GDPR data processing posture. The controller-processor relationship with WhatsApp and any third-party CRM systems should be documented through processing agreements. Data minimisation, purpose limitation, retention discipline, and user rights response infrastructure should be configured and tested. Cross-border transfer mechanisms should be verified against the actual data flow. The fifth workstream is cross-platform user journey design. The user journey from Meta surface ad placement through WhatsApp conversation to commercial transaction should be designed as a coherent experience rather than as disconnected platform interactions. The journey design includes ad creative alignment with conversation entry, conversation flow alignment with consent and disclosure obligations, transaction handoff alignment with consumer protection requirements, and post-transaction follow-up alignment with consent and retention. From the strategic perspective Click-to-Chat campaigns reward advertisers who treat the journey as a unified design problem rather than as a series of separate compliance check-points. Advertisers running large-scale Click-to-Chat programmes should commission a multi-disciplinary review involving legal, product, customer experience, and marketing functions. The review produces operational recommendations that improve both regulatory compliance and campaign performance. For end-to-end audit of Click-to-Chat campaign readiness, run AI Compliance Audit and reference the broader Meta policy framework through Meta Ad Policies.
Don't miss the next policy change.
Create a free account — track every policy change across 8 platforms, get instant alerts, and access every free compliance tool. Or try our Keyword Risk Checker first.
Report Keywords — Run AI Compliance Audit
#WhatsApp#WhatsApp Business#Click-to-Chat#DSA#DSA Article 39#Conversational Commerce#GDPR#Ad Compliance#VLOP#2026 Policy#Advertisers#Compliance Guide 2026
Related Posts
WhatsApp Business Marketing-Message Compliance in 2026: Opt-In, Template Categories and Per-Message Pricing
WhatsApp marketing messages now bill per delivered template and demand documented opt-in. A misfired broadcast can breach TCPA, GDPR and Meta quality rules at once in 2026.
WhatsApp Business API & Click-to-WhatsApp Ads Compliance Guide 2026 — Messaging Rules, Opt-In Requirements & Meta Policy
WhatsApp Business API and Click-to-WhatsApp ads are powerful tools for reaching customers directly — but Meta enforces strict messaging rules, opt-in requirements, and template approval processes that advertisers must follow. This guide breaks down the 2026 compliance landscape including the 24-hour messaging window, spam limits, GDPR obligations, and enforcement penalties.
WhatsApp Channels DSA Compliance May 2026: The Mid-May VLOP Deadline, Article 39 Ad Repository & Advertiser Obligations
WhatsApp Channels was designated a VLOP on January 26, 2026. Meta has until mid-May to bring it into DSA compliance, and advertisers face new ad repository, targeting, and minors-protection obligations on a 51.7M-user surface.