{"id":249,"date":"2026-10-25T13:03:28","date_gmt":"2026-10-25T13:03:28","guid":{"rendered":"https:\/\/vectalk.com.br\/blog\/lgpd-whatsapp-en\/"},"modified":"2026-10-25T13:11:47","modified_gmt":"2026-10-25T13:11:47","slug":"lgpd-whatsapp-en","status":"publish","type":"post","link":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/","title":{"rendered":"LGPD and WhatsApp: consent, opt-out and best practices for businesses"},"content":{"rendered":"\n<p><em>Updated on October 25, 2026<\/em><\/p>\n\n\n\n<p>To use WhatsApp in line with the LGPD, Brazil&#8217;s General Data Protection Law, a business needs a legal basis for each purpose it messages people for, has to tell customers how their data is used, must honor opt-out and deletion requests, and should keep conversations only as long as necessary. Meta adds its own rules on top: a clear opt-in that names the business, honoring every request to stop, and a ban on sharing conversation data. This article explains how the two layers fit together and how to implement them in your system.<\/p>\n\n\n\n<p>A note before we start: this is general information, not legal advice. It does not replace a lawyer or your company&#8217;s data protection officer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Two sets of rules at once: the law and Meta&#8217;s policy<\/h2>\n\n\n\n<p>If you message people through the WhatsApp Business API, two separate sets of rules apply, and they stack:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Layer<\/th><th>Who sets it<\/th><th>What it requires<\/th><th>Consequence of breaking it<\/th><\/tr><\/thead><tbody><tr><td>LGPD (Law 13,709\/2018)<\/td><td>Brazilian federal law, enforced by the ANPD (the national data protection authority)<\/td><td>Legal basis, transparency, data subject rights, security<\/td><td>Administrative sanctions, including fines<\/td><\/tr><tr><td>WhatsApp Business Messaging Policy<\/td><td>Meta<\/td><td>Opt-in, opt-out, restricted use of conversation data<\/td><td>Messaging restrictions, number or account blocked<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Meeting one does not guarantee the other. A general opt-in may satisfy Meta and still fall short of the LGPD, and vice versa. On the official WhatsApp Cloud API, your business makes the decisions about the data (the &#8220;controller&#8221; under the law). Meta&#8217;s <a href=\"https:\/\/developers.facebook.com\/documentation\/business-messaging\/whatsapp\/data-privacy-and-security\" target=\"_blank\" rel=\"noreferrer noopener\">Cloud API data privacy and security page<\/a> says Meta acts as a processor on the business&#8217;s behalf, to the extent applicable law recognizes that role.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Legal basis: not every message needs consent<\/h2>\n\n\n\n<p>Article 7 of the LGPD lists ten legal bases for processing personal data. Consent is only one of them. For business WhatsApp, four come up most often:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Message type<\/th><th>Most common legal basis (art. 7)<\/th><th>Note<\/th><\/tr><\/thead><tbody><tr><td>Order confirmation, tracking, invoice copy<\/td><td>Performance of a contract (item V)<\/td><td>The message is part of the service purchased<\/td><\/tr><tr><td>Tax receipt, notice required by regulation<\/td><td>Legal or regulatory obligation (item II)<\/td><td>Depends on sector-specific rules<\/td><\/tr><tr><td>Offers, news, campaigns<\/td><td>Consent (item I) or legitimate interest (item IX)<\/td><td>Needs case-by-case analysis<\/td><\/tr><tr><td>Collecting an overdue debt<\/td><td>Contract (V) or credit protection (X)<\/td><td>Watch tone and frequency<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Two remarks about this table. First, choosing the legal basis is a documented decision by the controller, not a label you attach afterwards to justify a send. Second, if you rely on legitimate interest, article 10 limits you to strictly necessary data and requires transparency measures, and article 37 requires a record of processing operations, &#8220;especially when based on legitimate interest&#8221;.<\/p>\n\n\n\n<p>Sensitive data changes things. Health, religion, racial origin, sex life and biometrics are sensitive personal data (art. 5, II), and article 11 requires consent given &#8220;in a specific and highlighted way&#8221; or another basis from that article. Clinics and labs that send test results or appointment reminders need to account for this from the start.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Consent: what the law requires and how to prove it<\/h2>\n\n\n\n<p>When consent is the basis, the LGPD sets the bar in article 5, XII: a &#8220;free, informed and unambiguous&#8221; statement for &#8220;a specific purpose&#8221;. Article 8 adds that:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>it can be in writing or by any other means that shows the person&#8217;s will;<\/li>\n\n\n<li>if it is part of a contract, it must be a clause that stands out from the others;<\/li>\n\n\n<li><strong>the controller has to prove<\/strong> consent was obtained properly (\u00a7 2);<\/li>\n\n\n<li>generic authorizations are void (\u00a7 4);<\/li>\n\n\n<li>it can be withdrawn at any time, through a free and easy procedure (\u00a7 5).<\/li>\n\n<\/ul>\n\n\n\n<p>Meta&#8217;s requirements are similar but simpler. The <a href=\"https:\/\/developers.facebook.com\/documentation\/business-messaging\/whatsapp\/getting-opt-in\" target=\"_blank\" rel=\"noreferrer noopener\">Get opt-in for WhatsApp<\/a> page asks businesses to make clear that the person is agreeing to receive messages, to make clear the business name, and to comply with applicable law. Meta recommends separate opt-ins per message category (orders, offers, recommendations), which fits the LGPD&#8217;s &#8220;specific purpose&#8221; requirement well.<\/p>\n\n\n\n<p>In practice, an unchecked checkbox with specific wording covers both layers:<\/p>\n\n\n\n<p><em>&#8220;I want to receive offers from Example Store on WhatsApp. I can cancel anytime by replying STOP.&#8221;<\/em><\/p>\n\n\n\n<p>The burden of proof is what matters most for your system. Store the consent record with the contact:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"language-json\">{\n  \"wa_id\": \"5511999999999\",\n  \"consents\": [\n    {\n      \"purpose\": \"marketing\",\n      \"legal_basis\": \"consent\",\n      \"source\": \"checkout_site\",\n      \"text_shown\": \"I want to receive offers from Example Store on WhatsApp. I can cancel anytime by replying STOP.\",\n      \"privacy_policy_version\": \"2026-09\",\n      \"accepted_at\": \"2026-10-12T14:32:10-03:00\",\n      \"revoked_at\": null\n    }\n  ]\n}<\/code><\/pre>\n\n\n\n<p>Keeping the exact wording and the privacy policy version avoids arguments about what the person actually agreed to. The guide on <a href=\"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-opt-in-list\/\">building an opt-in list<\/a> shows ways to capture consent on your site, at checkout and inside the chat.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Opt-out: withdrawing has to be as easy as agreeing<\/h2>\n\n\n\n<p>The LGPD guarantees withdrawal &#8220;through a free and easy procedure&#8221; (art. 8, \u00a7 5) and lists it among data subject rights (art. 18, IX). The <a href=\"https:\/\/business.whatsapp.com\/policy\" target=\"_blank\" rel=\"noreferrer noopener\">WhatsApp Business Messaging Policy<\/a> points the same way: businesses must honor every request, on or off WhatsApp, from people who no longer want to receive messages.<\/p>\n\n\n\n<p>In your system, that means handling at least four exit routes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Template button.<\/strong> A quick reply button such as &#8220;No more offers&#8221;. The webhook arrives with <code>type: \"button\"<\/code> and the text in <code>button.text<\/code>.<\/li>\n\n\n<li><strong>Free text.<\/strong> Messages like &#8220;stop&#8221;, &#8220;unsubscribe&#8221;, &#8220;sair&#8221; or &#8220;parar&#8221; (Portuguese for &#8220;leave&#8221; and &#8220;stop&#8221;). Normalize the text and match it against a word list.<\/li>\n\n\n<li><strong>WhatsApp&#8217;s own settings.<\/strong> Users can stop a business&#8217;s marketing directly in the app. Sends after that come back in the status webhook as <code>failed<\/code> with error <code>131050<\/code>, according to the <a href=\"https:\/\/developers.facebook.com\/documentation\/business-messaging\/whatsapp\/templates\/marketing-templates\" target=\"_blank\" rel=\"noreferrer noopener\">marketing templates documentation<\/a>.<\/li>\n\n\n<li><strong>Outside WhatsApp.<\/strong> Email, phone, a privacy form, a request to an agent. All of them must reach the same database.<\/li>\n\n<\/ol>\n\n\n\n<p>Minimal handling in Node.js for the first three:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"language-js\">const EXIT_WORDS = ['stop', 'unsubscribe', 'sair', 'parar', 'cancelar'];\n\nfunction normalize(t) {\n  return t.toLowerCase().normalize('NFD').replace(\/[\u0300-\u036f]\/g, '').trim();\n}\n\nexport function handleMessage(msg, db) {\n  const text =\n    msg.type === 'text' ? msg.text.body :\n    msg.type === 'button' ? msg.button.text : '';\n\n  if (EXIT_WORDS.includes(normalize(text))) {\n    db.revokeConsent(msg.from, 'marketing', new Date());\n    return { reply: \"Done, you won't receive offers anymore. Messages about your orders will continue.\" };\n  }\n}\n\nexport function handleStatus(status, db) {\n  if (status.status === 'failed' &amp;&amp; status.errors?.[0]?.code === 131050) {\n    db.revokeConsent(status.recipient_id, 'marketing', new Date());\n  }\n}<\/code><\/pre>\n\n\n\n<p>Note the reply: leaving marketing does not have to end order updates, which rest on a different legal basis. Make that clear to the customer. An opt-out that is ignored turns into complaints and blocks, and blocks drag down your <a href=\"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-phone-number-quality-rating\/\">number&#8217;s quality rating<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Retention: how long to keep conversations<\/h2>\n\n\n\n<p>The LGPD does not set a single deadline. Article 15 says processing ends when its purpose is achieved, when the agreed period ends, when the data subject asks, or when the ANPD orders it. Article 16 requires deleting the data after that, with exceptions such as legal or regulatory obligations.<\/p>\n\n\n\n<p>On Meta&#8217;s side, the Cloud API privacy page states that messages have a maximum retention period of 30 days on Meta&#8217;s infrastructure, for functions like retransmission. Long-term history therefore lives in <strong>your<\/strong> system, and the retention policy is yours.<\/p>\n\n\n\n<p>A practical way to organize it:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Data<\/th><th>Example rule<\/th><th>Why<\/th><\/tr><\/thead><tbody><tr><td>Consent and withdrawal records<\/td><td>Keep while the relationship exists and for as long as you may need to prove it<\/td><td>Burden of proof, art. 8, \u00a7 2<\/td><\/tr><tr><td>Support conversations<\/td><td>Period set by your legal team for your sector<\/td><td>Support purpose and defense of rights<\/td><\/tr><tr><td>Received media (documents, photos)<\/td><td>Delete or anonymize when the purpose ends<\/td><td>Often contains sensitive data<\/td><\/tr><tr><td>Contacts who asked for deletion<\/td><td>Delete data, keep only what you need to avoid contacting them again<\/td><td>Art. 18, VI and art. 16<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Concrete periods depend on your sector and other laws. Set them with your legal team and automate cleanup with a scheduled job.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Best practices Meta already requires<\/h2>\n\n\n\n<p>The WhatsApp Business Messaging Policy has rules that reinforce the LGPD and apply to every business on the API:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Do not use conversation data for other purposes<\/strong>, and do not forward or share information from a conversation with third parties.<\/li>\n\n\n<li><strong>Do not ask for full payment card numbers<\/strong>, financial account numbers or ID document numbers in the chat.<\/li>\n\n\n<li><strong>Offer a path to a human<\/strong> when service is automated, with clear and direct escalation.<\/li>\n\n\n<li><strong>Keep customer support contact details<\/strong> on your WhatsApp Business profile.<\/li>\n\n<\/ul>\n\n\n\n<p>If you run an AI chatbot on WhatsApp, these rules also apply to what the model asks for and to what gets sent to the AI provider.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security and incidents<\/h2>\n\n\n\n<p>Article 46 of the LGPD requires technical and administrative security measures against unauthorized access, from the product design stage onward. On WhatsApp, the most common leak points are API tokens exposed in code repositories, support dashboards with overly broad access, and shared agent logins. The guide on <a href=\"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-business-account-security\/\">WhatsApp Business account security<\/a> covers the PIN, permissions and scams.<\/p>\n\n\n\n<p>If an incident may cause relevant risk or harm to data subjects, article 48 requires notifying the ANPD and the people affected. The ANPD&#8217;s <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\/canais_atendimento\/agente-de-tratamento\/comunicado-de-incidente-de-seguranca-cis\" target=\"_blank\" rel=\"noreferrer noopener\">Security Incident Reporting Regulation<\/a> (CD\/ANPD Resolution No. 15\/2024) sets a deadline of three business days.<\/p>\n\n\n\n<p>The stakes are real: article 52 provides for warnings, blocking and deletion of the data, suspension of processing, and a fine of up to 2% of revenue in Brazil, capped at R$ 50 million (Brazilian reais) per violation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">LGPD checklist for business WhatsApp<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A legal basis defined and recorded for each message type.<\/li>\n\n\n<li>A privacy policy that mentions WhatsApp, the purpose and data subject rights (art. 9).<\/li>\n\n\n<li>Consent per purpose, with wording, date and source stored.<\/li>\n\n\n<li>Exit buttons and keywords handled automatically, and error <code>131050<\/code> treated as opt-out.<\/li>\n\n\n<li>Requests made outside WhatsApp reaching the same database.<\/li>\n\n\n<li>A retention period defined and a cleanup job running.<\/li>\n\n\n<li>A data protection officer appointed and their contact published (art. 41).<\/li>\n\n\n<li>Dashboard and token access limited to the people who need it.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How to do this with Vectalk<\/h2>\n\n\n\n<p>Vectalk is a proxy for Meta&#8217;s official WhatsApp Cloud API: the webhooks your system receives are Meta&#8217;s, with the same fields used above (<code>button.text<\/code>, <code>statuses[].errors<\/code>). You can register as many URLs as you need per instance with <code>POST \/api\/webhooks<\/code>, and query history with <code>GET \/api\/messages<\/code>, filtering by date, status and direction, to feed your retention policy. Details are at <a href=\"https:\/\/docs.vectalk.com.br\/concepts\/webhooks\">docs.vectalk.com.br<\/a>. To get started, create an account at <a href=\"https:\/\/apps.vectalk.com.br\/register\">apps.vectalk.com.br\/register<\/a>.<\/p>\n\n\n\n<p>Related reading: <a href=\"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-billing-reminders\/\">collections workflows on WhatsApp<\/a> and <a href=\"https:\/\/vectalk.com.br\/blog\/en\/whatsapp-nps-survey\/\">post-sale and NPS without being annoying<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Do I need consent to message someone on WhatsApp?<\/h3>\n\n\n\n<p>Not for every message. The LGPD accepts other legal bases, such as performance of a contract for order confirmations. Meta, however, requires an opt-in before you start a conversation, whatever legal basis you choose. In practice you need both: a legal basis for the law and an opt-in for Meta.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does Meta&#8217;s opt-in replace LGPD consent?<\/h3>\n\n\n\n<p>Not necessarily. Meta accepts a general opt-in as long as it complies with local law. The LGPD treats generic authorizations as void when consent is the basis. Specific wording per purpose meets both sets of rules.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">A customer asked us to delete their data. Do we have to delete the chats?<\/h3>\n\n\n\n<p>Article 18, VI guarantees deletion of data processed under consent, with the exceptions in article 16, such as legal obligations. Review with your legal team what can be deleted and what must be kept, and record the decision.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does Meta store my business&#8217;s messages?<\/h3>\n\n\n\n<p>According to the Cloud API documentation, messages stay on Meta&#8217;s infrastructure for at most 30 days, for functions like retransmission. Permanent history is your system&#8217;s responsibility.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is this article a legal opinion?<\/h3>\n\n\n\n<p>No. It summarizes the law and Meta&#8217;s rules to guide technical implementation. Decisions about legal basis, retention periods and contracts should go through a lawyer or your data protection officer.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p><strong>Official sources consulted on October 25, 2026:<\/strong> <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" target=\"_blank\" rel=\"noreferrer noopener\">Law No. 13,709\/2018 (LGPD)<\/a>, <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\/canais_atendimento\/agente-de-tratamento\/comunicado-de-incidente-de-seguranca-cis\" target=\"_blank\" rel=\"noreferrer noopener\">ANPD: security incident reporting<\/a>, <a href=\"https:\/\/business.whatsapp.com\/policy\" target=\"_blank\" rel=\"noreferrer noopener\">WhatsApp Business Messaging Policy<\/a> (updated September 23, 2026), <a href=\"https:\/\/developers.facebook.com\/documentation\/business-messaging\/whatsapp\/getting-opt-in\" target=\"_blank\" rel=\"noreferrer noopener\">Get opt-in for WhatsApp<\/a>, <a href=\"https:\/\/developers.facebook.com\/documentation\/business-messaging\/whatsapp\/templates\/marketing-templates\" target=\"_blank\" rel=\"noreferrer noopener\">Marketing templates<\/a>, <a href=\"https:\/\/developers.facebook.com\/documentation\/business-messaging\/whatsapp\/data-privacy-and-security\" target=\"_blank\" rel=\"noreferrer noopener\">Cloud API data privacy and security<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How Brazil&#8217;s data protection law (LGPD) applies to business WhatsApp: legal basis per message type, proof of consent, working opt-out and chat retention.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-249","post","type-post","status-publish","format-standard","hentry","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>LGPD and WhatsApp: consent and opt-out | Vectalk<\/title>\n<meta name=\"description\" content=\"LGPD WhatsApp compliance: legal basis per message, consent, opt-out, chat retention and what Meta requires from businesses in Brazil.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LGPD and WhatsApp: consent and opt-out | Vectalk\" \/>\n<meta property=\"og:description\" content=\"LGPD WhatsApp compliance: legal basis per message, consent, opt-out, chat retention and what Meta requires from businesses in Brazil.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog Vectalk\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-25T13:03:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-25T13:11:47+00:00\" \/>\n<meta name=\"author\" content=\"wanderleyfcunha\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"wanderleyfcunha\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/lgpd-whatsapp-en\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/lgpd-whatsapp-en\\\/\"},\"author\":{\"name\":\"wanderleyfcunha\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#\\\/schema\\\/person\\\/ff36ecd9d8257856f227f8e5d639db2b\"},\"headline\":\"LGPD and WhatsApp: consent, opt-out and best practices for businesses\",\"datePublished\":\"2026-10-25T13:03:28+00:00\",\"dateModified\":\"2026-10-25T13:11:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/lgpd-whatsapp-en\\\/\"},\"wordCount\":1840,\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/lgpd-whatsapp-en\\\/\",\"url\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/lgpd-whatsapp-en\\\/\",\"name\":\"LGPD and WhatsApp: consent and opt-out | Vectalk\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#website\"},\"datePublished\":\"2026-10-25T13:03:28+00:00\",\"dateModified\":\"2026-10-25T13:11:47+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#\\\/schema\\\/person\\\/ff36ecd9d8257856f227f8e5d639db2b\"},\"description\":\"LGPD WhatsApp compliance: legal basis per message, consent, opt-out, chat retention and what Meta requires from businesses in Brazil.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/lgpd-whatsapp-en\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/lgpd-whatsapp-en\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/en\\\/lgpd-whatsapp-en\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"LGPD and WhatsApp: consent, opt-out and best practices for businesses\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/\",\"name\":\"Blog Vectalk\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/vectalk.com.br\\\/blog\\\/#\\\/schema\\\/person\\\/ff36ecd9d8257856f227f8e5d639db2b\",\"name\":\"wanderleyfcunha\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g\",\"caption\":\"wanderleyfcunha\"},\"sameAs\":[\"https:\\\/\\\/vectalk.com.br\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LGPD and WhatsApp: consent and opt-out | Vectalk","description":"LGPD WhatsApp compliance: legal basis per message, consent, opt-out, chat retention and what Meta requires from businesses in Brazil.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/","og_locale":"en_US","og_type":"article","og_title":"LGPD and WhatsApp: consent and opt-out | Vectalk","og_description":"LGPD WhatsApp compliance: legal basis per message, consent, opt-out, chat retention and what Meta requires from businesses in Brazil.","og_url":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/","og_site_name":"Blog Vectalk","article_published_time":"2026-10-25T13:03:28+00:00","article_modified_time":"2026-10-25T13:11:47+00:00","author":"wanderleyfcunha","twitter_card":"summary_large_image","twitter_misc":{"Written by":"wanderleyfcunha","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/#article","isPartOf":{"@id":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/"},"author":{"name":"wanderleyfcunha","@id":"https:\/\/vectalk.com.br\/blog\/#\/schema\/person\/ff36ecd9d8257856f227f8e5d639db2b"},"headline":"LGPD and WhatsApp: consent, opt-out and best practices for businesses","datePublished":"2026-10-25T13:03:28+00:00","dateModified":"2026-10-25T13:11:47+00:00","mainEntityOfPage":{"@id":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/"},"wordCount":1840,"articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/","url":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/","name":"LGPD and WhatsApp: consent and opt-out | Vectalk","isPartOf":{"@id":"https:\/\/vectalk.com.br\/blog\/#website"},"datePublished":"2026-10-25T13:03:28+00:00","dateModified":"2026-10-25T13:11:47+00:00","author":{"@id":"https:\/\/vectalk.com.br\/blog\/#\/schema\/person\/ff36ecd9d8257856f227f8e5d639db2b"},"description":"LGPD WhatsApp compliance: legal basis per message, consent, opt-out, chat retention and what Meta requires from businesses in Brazil.","breadcrumb":{"@id":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/vectalk.com.br\/blog\/en\/lgpd-whatsapp-en\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/vectalk.com.br\/blog\/"},{"@type":"ListItem","position":2,"name":"LGPD and WhatsApp: consent, opt-out and best practices for businesses"}]},{"@type":"WebSite","@id":"https:\/\/vectalk.com.br\/blog\/#website","url":"https:\/\/vectalk.com.br\/blog\/","name":"Blog Vectalk","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/vectalk.com.br\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/vectalk.com.br\/blog\/#\/schema\/person\/ff36ecd9d8257856f227f8e5d639db2b","name":"wanderleyfcunha","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/21c37077f1731eb558973f27a7b647d55f72fde5200a843ac5f5345b247ea725?s=96&d=mm&r=g","caption":"wanderleyfcunha"},"sameAs":["https:\/\/vectalk.com.br\/blog"]}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/posts\/249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/comments?post=249"}],"version-history":[{"count":2,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/posts\/249\/revisions"}],"predecessor-version":[{"id":437,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/posts\/249\/revisions\/437"}],"wp:attachment":[{"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/media?parent=249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/categories?post=249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vectalk.com.br\/blog\/wp-json\/wp\/v2\/tags?post=249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}