Updated on October 25, 2026
To use WhatsApp in line with the LGPD, Brazil’s General Data Protection Law, a business needs a legal basis for each purpose it messages people for, has to tell customers how their data is used, must honor opt-out and deletion requests, and should keep conversations only as long as necessary. Meta adds its own rules on top: a clear opt-in that names the business, honoring every request to stop, and a ban on sharing conversation data. This article explains how the two layers fit together and how to implement them in your system.
A note before we start: this is general information, not legal advice. It does not replace a lawyer or your company’s data protection officer.
Two sets of rules at once: the law and Meta’s policy
If you message people through the WhatsApp Business API, two separate sets of rules apply, and they stack:
| Layer | Who sets it | What it requires | Consequence of breaking it |
|---|---|---|---|
| LGPD (Law 13,709/2018) | Brazilian federal law, enforced by the ANPD (the national data protection authority) | Legal basis, transparency, data subject rights, security | Administrative sanctions, including fines |
| WhatsApp Business Messaging Policy | Meta | Opt-in, opt-out, restricted use of conversation data | Messaging restrictions, number or account blocked |
Meeting one does not guarantee the other. A general opt-in may satisfy Meta and still fall short of the LGPD, and vice versa. On the official WhatsApp Cloud API, your business makes the decisions about the data (the “controller” under the law). Meta’s Cloud API data privacy and security page says Meta acts as a processor on the business’s behalf, to the extent applicable law recognizes that role.
Legal basis: not every message needs consent
Article 7 of the LGPD lists ten legal bases for processing personal data. Consent is only one of them. For business WhatsApp, four come up most often:
| Message type | Most common legal basis (art. 7) | Note |
|---|---|---|
| Order confirmation, tracking, invoice copy | Performance of a contract (item V) | The message is part of the service purchased |
| Tax receipt, notice required by regulation | Legal or regulatory obligation (item II) | Depends on sector-specific rules |
| Offers, news, campaigns | Consent (item I) or legitimate interest (item IX) | Needs case-by-case analysis |
| Collecting an overdue debt | Contract (V) or credit protection (X) | Watch tone and frequency |
Two remarks about this table. First, choosing the legal basis is a documented decision by the controller, not a label you attach afterwards to justify a send. Second, if you rely on legitimate interest, article 10 limits you to strictly necessary data and requires transparency measures, and article 37 requires a record of processing operations, “especially when based on legitimate interest”.
Sensitive data changes things. Health, religion, racial origin, sex life and biometrics are sensitive personal data (art. 5, II), and article 11 requires consent given “in a specific and highlighted way” or another basis from that article. Clinics and labs that send test results or appointment reminders need to account for this from the start.
Consent: what the law requires and how to prove it
When consent is the basis, the LGPD sets the bar in article 5, XII: a “free, informed and unambiguous” statement for “a specific purpose”. Article 8 adds that:
- it can be in writing or by any other means that shows the person’s will;
- if it is part of a contract, it must be a clause that stands out from the others;
- the controller has to prove consent was obtained properly (§ 2);
- generic authorizations are void (§ 4);
- it can be withdrawn at any time, through a free and easy procedure (§ 5).
Meta’s requirements are similar but simpler. The Get opt-in for WhatsApp page asks businesses to make clear that the person is agreeing to receive messages, to make clear the business name, and to comply with applicable law. Meta recommends separate opt-ins per message category (orders, offers, recommendations), which fits the LGPD’s “specific purpose” requirement well.
In practice, an unchecked checkbox with specific wording covers both layers:
“I want to receive offers from Example Store on WhatsApp. I can cancel anytime by replying STOP.”
The burden of proof is what matters most for your system. Store the consent record with the contact:
{
"wa_id": "5511999999999",
"consents": [
{
"purpose": "marketing",
"legal_basis": "consent",
"source": "checkout_site",
"text_shown": "I want to receive offers from Example Store on WhatsApp. I can cancel anytime by replying STOP.",
"privacy_policy_version": "2026-09",
"accepted_at": "2026-10-12T14:32:10-03:00",
"revoked_at": null
}
]
}Keeping the exact wording and the privacy policy version avoids arguments about what the person actually agreed to. The guide on building an opt-in list shows ways to capture consent on your site, at checkout and inside the chat.
Opt-out: withdrawing has to be as easy as agreeing
The LGPD guarantees withdrawal “through a free and easy procedure” (art. 8, § 5) and lists it among data subject rights (art. 18, IX). The WhatsApp Business Messaging Policy points the same way: businesses must honor every request, on or off WhatsApp, from people who no longer want to receive messages.
In your system, that means handling at least four exit routes:
- Template button. A quick reply button such as “No more offers”. The webhook arrives with
type: "button"and the text inbutton.text. - Free text. Messages like “stop”, “unsubscribe”, “sair” or “parar” (Portuguese for “leave” and “stop”). Normalize the text and match it against a word list.
- WhatsApp’s own settings. Users can stop a business’s marketing directly in the app. Sends after that come back in the status webhook as
failedwith error131050, according to the marketing templates documentation. - Outside WhatsApp. Email, phone, a privacy form, a request to an agent. All of them must reach the same database.
Minimal handling in Node.js for the first three:
const EXIT_WORDS = ['stop', 'unsubscribe', 'sair', 'parar', 'cancelar'];
function normalize(t) {
return t.toLowerCase().normalize('NFD').replace(/[̀-ͯ]/g, '').trim();
}
export function handleMessage(msg, db) {
const text =
msg.type === 'text' ? msg.text.body :
msg.type === 'button' ? msg.button.text : '';
if (EXIT_WORDS.includes(normalize(text))) {
db.revokeConsent(msg.from, 'marketing', new Date());
return { reply: "Done, you won't receive offers anymore. Messages about your orders will continue." };
}
}
export function handleStatus(status, db) {
if (status.status === 'failed' && status.errors?.[0]?.code === 131050) {
db.revokeConsent(status.recipient_id, 'marketing', new Date());
}
}Note the reply: leaving marketing does not have to end order updates, which rest on a different legal basis. Make that clear to the customer. An opt-out that is ignored turns into complaints and blocks, and blocks drag down your number’s quality rating.
Retention: how long to keep conversations
The LGPD does not set a single deadline. Article 15 says processing ends when its purpose is achieved, when the agreed period ends, when the data subject asks, or when the ANPD orders it. Article 16 requires deleting the data after that, with exceptions such as legal or regulatory obligations.
On Meta’s side, the Cloud API privacy page states that messages have a maximum retention period of 30 days on Meta’s infrastructure, for functions like retransmission. Long-term history therefore lives in your system, and the retention policy is yours.
A practical way to organize it:
| Data | Example rule | Why |
|---|---|---|
| Consent and withdrawal records | Keep while the relationship exists and for as long as you may need to prove it | Burden of proof, art. 8, § 2 |
| Support conversations | Period set by your legal team for your sector | Support purpose and defense of rights |
| Received media (documents, photos) | Delete or anonymize when the purpose ends | Often contains sensitive data |
| Contacts who asked for deletion | Delete data, keep only what you need to avoid contacting them again | Art. 18, VI and art. 16 |
Concrete periods depend on your sector and other laws. Set them with your legal team and automate cleanup with a scheduled job.
Best practices Meta already requires
The WhatsApp Business Messaging Policy has rules that reinforce the LGPD and apply to every business on the API:
- Do not use conversation data for other purposes, and do not forward or share information from a conversation with third parties.
- Do not ask for full payment card numbers, financial account numbers or ID document numbers in the chat.
- Offer a path to a human when service is automated, with clear and direct escalation.
- Keep customer support contact details on your WhatsApp Business profile.
If you run an AI chatbot on WhatsApp, these rules also apply to what the model asks for and to what gets sent to the AI provider.
Security and incidents
Article 46 of the LGPD requires technical and administrative security measures against unauthorized access, from the product design stage onward. On WhatsApp, the most common leak points are API tokens exposed in code repositories, support dashboards with overly broad access, and shared agent logins. The guide on WhatsApp Business account security covers the PIN, permissions and scams.
If an incident may cause relevant risk or harm to data subjects, article 48 requires notifying the ANPD and the people affected. The ANPD’s Security Incident Reporting Regulation (CD/ANPD Resolution No. 15/2024) sets a deadline of three business days.
The stakes are real: article 52 provides for warnings, blocking and deletion of the data, suspension of processing, and a fine of up to 2% of revenue in Brazil, capped at R$ 50 million (Brazilian reais) per violation.
LGPD checklist for business WhatsApp
- A legal basis defined and recorded for each message type.
- A privacy policy that mentions WhatsApp, the purpose and data subject rights (art. 9).
- Consent per purpose, with wording, date and source stored.
- Exit buttons and keywords handled automatically, and error
131050treated as opt-out. - Requests made outside WhatsApp reaching the same database.
- A retention period defined and a cleanup job running.
- A data protection officer appointed and their contact published (art. 41).
- Dashboard and token access limited to the people who need it.
How to do this with Vectalk
Vectalk is a proxy for Meta’s official WhatsApp Cloud API: the webhooks your system receives are Meta’s, with the same fields used above (button.text, statuses[].errors). You can register as many URLs as you need per instance with POST /api/webhooks, and query history with GET /api/messages, filtering by date, status and direction, to feed your retention policy. Details are at docs.vectalk.com.br. To get started, create an account at apps.vectalk.com.br/register.
Related reading: collections workflows on WhatsApp and post-sale and NPS without being annoying.
Frequently asked questions
Do I need consent to message someone on WhatsApp?
Not for every message. The LGPD accepts other legal bases, such as performance of a contract for order confirmations. Meta, however, requires an opt-in before you start a conversation, whatever legal basis you choose. In practice you need both: a legal basis for the law and an opt-in for Meta.
Does Meta’s opt-in replace LGPD consent?
Not necessarily. Meta accepts a general opt-in as long as it complies with local law. The LGPD treats generic authorizations as void when consent is the basis. Specific wording per purpose meets both sets of rules.
A customer asked us to delete their data. Do we have to delete the chats?
Article 18, VI guarantees deletion of data processed under consent, with the exceptions in article 16, such as legal obligations. Review with your legal team what can be deleted and what must be kept, and record the decision.
Does Meta store my business’s messages?
According to the Cloud API documentation, messages stay on Meta’s infrastructure for at most 30 days, for functions like retransmission. Permanent history is your system’s responsibility.
Is this article a legal opinion?
No. It summarizes the law and Meta’s rules to guide technical implementation. Decisions about legal basis, retention periods and contracts should go through a lawyer or your data protection officer.
Official sources consulted on October 25, 2026: Law No. 13,709/2018 (LGPD), ANPD: security incident reporting, WhatsApp Business Messaging Policy (updated September 23, 2026), Get opt-in for WhatsApp, Marketing templates, Cloud API data privacy and security.