Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
WhatsApp Business Chat is the official click to chat experience by Meta that lets a website visitor open a WhatsApp conversation with a business phone number, either via a wa.me link or through an embedded WhatsApp Business widget. As soon as the visitor clicks (or as soon as a widget script loads), Meta Platforms Inc in the United States receives the phone number, IP, User Agent and page context. GDPR and ePrivacy therefore require a clear notice and, for any widget script loaded before user interaction, prior opt in consent.
A WhatsApp Business chat integration usually combines a click to chat link (wa.me/{phone}?text=) on the operator site with, optionally, a JavaScript widget that opens the conversation in a side panel or a floating chat. The simplest implementation is a button that, when clicked, opens https://wa.me/ with the business phone number and a prefilled message. Heavier implementations rely on the WhatsApp Business API through Meta or a Business Solution Provider (Twilio, MessageBird, 360dialog) and may load a JavaScript widget from facebook.net or the provider domain. The visitor experience can include sending the first message directly from the operator site through the API.
When the visitor clicks the button or, in the case of a widget, when the script loads, Meta and the optional Business Solution Provider receive the page URL, the visitor IP, the User Agent and the phone number the visitor enters or that is prefilled in the conversation. Once the WhatsApp chat starts, all message content, attachments, the WhatsApp account identifier and metadata about the device are processed by Meta. End to end encryption applies to message content, but Meta processes substantial metadata (timestamps, recipient identifier, frequency) outside the E2EE layer.
A pure wa.me link button does not by itself drop cookies and does not require prior consent under Article 5(3) of the ePrivacy Directive: it is a regular link to a third party service. However, the WhatsApp Business widget script (or any equivalent third party chat widget) does load tracking code and must be gated on prior opt in consent. The Article 6 GDPR basis depends on the moment of processing: consent for the widget load, contract or pre contractual measures for the chat content once the visitor sends a message.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
WhatsApp is part of Meta and operates on US infrastructure. Phone numbers, IP, conversation metadata and message content (encrypted) flow to Meta Platforms Inc. The Hamburg Data Protection Commissioner restricted use of WhatsApp by federal authorities in 2024 over transfer concerns, and several EU regulators caution against WhatsApp for sensitive sectors. Operators must rely on the EU US Data Privacy Framework (Meta is self certified), Standard Contractual Clauses, document the transfer impact assessment and disclose the transfer to the visitor.
Prefer a simple wa.me link over an embedded widget so no scripts load before the visitor clicks. Display a clear notice on the button that explains that clicking will open WhatsApp and share the phone number and message with Meta. Sign the WhatsApp Business Terms and the relevant Meta business tools terms. Update the privacy policy with the link to the WhatsApp privacy notice. Safer alternatives include Signal (no metadata farming), Threema Work (Swiss based, no phone number required), Matrix or a self hosted webchat tied to your CRM that keeps visitor data inside your own infrastructure.
Websites using WhatsApp Business Chat must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is strongly recommended whenever WhatsApp Business is used as a customer support or sales channel on EU facing properties, because of the high risk transfer to Meta in the US and the systematic processing of phone numbers and conversation metadata. The DPIA should cover the consent flow for the optional widget, the lawful basis for the chat itself, the residual risk after the EU US Data Privacy Framework, the retention of conversations and the safer alternatives evaluated.
Sample consent text
Clicking the WhatsApp button will open a conversation with our business in WhatsApp. Your phone number and your message will be processed by Meta Platforms Inc in the United States under the WhatsApp privacy policy. If our site uses a WhatsApp widget, it will only load after you accept communication and social media cookies.
Third-party domains contacted
wa.meweb.whatsapp.combusiness.whatsapp.comgraph.facebook.comfacebook.netstatic.whatsapp.netCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| datr | http | 2 years | Meta browser identifier set on facebook.net or facebook.com domain when a WhatsApp Business widget is loaded. |
| fr | http | 90 days | Meta advertising cookie set when a WhatsApp Business widget or Meta Business Suite chat plugin is loaded. |
| wa_account_id | http | 12 months | WhatsApp account identifier exposed when the visitor is logged into WhatsApp Web and opens the widget. |
| wa_csrf_token | http | Session | CSRF token used by the WhatsApp Business widget to secure interactions with wa.me and the Business API. |
WhatsApp Business Chat uses cookies for user preferences — inform visitors with a consent banner.
A plain wa.me link does not set any cookie on the operator domain. An embedded WhatsApp Business widget or a third party provider (Twilio, MessageBird, 360dialog) loads JavaScript and may set provider cookies plus Meta cookies on facebook.net (datr, fr) and on wa.me (visitor session identifiers). Logged in WhatsApp Web users may also expose their wa_account_id to the widget.
A simple wa.me button without widget script does not trigger ePrivacy storage and does not require prior consent for the link itself, only a clear notice. An embedded WhatsApp widget or third party chat script does load tracking code and must be gated on prior opt in consent. As soon as the visitor sends a message, the subsequent processing relies on contract or pre contractual measures plus information duties.
Article 6(1)(a) GDPR (consent) covers the optional widget and any pre interaction tracking. Article 6(1)(b) GDPR (contract or pre contractual measures) is the dominant basis for the chat content once the visitor has initiated the conversation. The lawful basis must be explicit in the privacy policy and the retention of the conversation history defined.
Yes. WhatsApp is operated by Meta Platforms Inc in the United States. Phone numbers, IP, conversation metadata and encrypted message content flow to US infrastructure. Transfers rely on the EU US Data Privacy Framework (Meta is self certified) and Standard Contractual Clauses. The Hamburg DPA restricted use of WhatsApp by federal authorities in 2024 over transfer concerns.
It is strongly recommended in most cases, and required when WhatsApp is used at scale for customer support or sales in regulated sectors. The combination of large scale processing by Meta, high risk international transfer and processing of phone numbers that can identify individuals across multiple Meta services usually crosses the Article 35 GDPR threshold.
Prefer a wa.me link over an embedded widget. Display a notice on the button stating that the chat will open WhatsApp and share the phone number with Meta. If a widget is required, block it until the visitor accepts communication cookies. Sign the WhatsApp Business Terms, document retention of conversations, and update the privacy policy with the link to the WhatsApp privacy notice.
Signal Business (no metadata farming), Threema Work (Swiss based, no phone number required), Matrix self hosted, Microsoft Teams or Webex for B2B contexts, or a self hosted webchat connected to your CRM (LiveChat, Crisp self hosted, Chatwoot). Each alternative keeps visitor data inside infrastructure under your control or under EU adequacy regimes.
Mention Meta Platforms Inc as data recipient, list the Meta cookies (datr, fr) that load with the widget, disclose the transfer to the United States, describe the data shared (phone number, page URL, message), reference the WhatsApp privacy notice and the WhatsApp Business Terms and explain the retention of conversations on your side.