WhatsApp Business Chat

How a WhatsApp Business chat integration actually works

A WhatsApp Business chat integration usually combines a click to chat link (wa.me/{phone}?text=) on the operator site with, optionally, a JavaScript widget that opens the conversation in a side panel or a floating chat. The simplest implementation is a button that, when clicked, opens https://wa.me/ with the business phone number and a prefilled message. Heavier implementations rely on the WhatsApp Business API through Meta or a Business Solution Provider (Twilio, MessageBird, 360dialog) and may load a JavaScript widget from facebook.net or the provider domain. The visitor experience can include sending the first message directly from the operator site through the API.

What data WhatsApp and Meta receive

When the visitor clicks the button or, in the case of a widget, when the script loads, Meta and the optional Business Solution Provider receive the page URL, the visitor IP, the User Agent and the phone number the visitor enters or that is prefilled in the conversation. Once the WhatsApp chat starts, all message content, attachments, the WhatsApp account identifier and metadata about the device are processed by Meta. End to end encryption applies to message content, but Meta processes substantial metadata (timestamps, recipient identifier, frequency) outside the E2EE layer.

GDPR, ePrivacy and consent requirements

A pure wa.me link button does not by itself drop cookies and does not require prior consent under Article 5(3) of the ePrivacy Directive: it is a regular link to a third party service. However, the WhatsApp Business widget script (or any equivalent third party chat widget) does load tracking code and must be gated on prior opt in consent. The Article 6 GDPR basis depends on the moment of processing: consent for the widget load, contract or pre contractual measures for the chat content once the visitor sends a message.

Transfers to Meta in the United States

WhatsApp is part of Meta and operates on US infrastructure. Phone numbers, IP, conversation metadata and message content (encrypted) flow to Meta Platforms Inc. The Hamburg Data Protection Commissioner restricted use of WhatsApp by federal authorities in 2024 over transfer concerns, and several EU regulators caution against WhatsApp for sensitive sectors. Operators must rely on the EU US Data Privacy Framework (Meta is self certified), Standard Contractual Clauses, document the transfer impact assessment and disclose the transfer to the visitor.

Practical compliance and safer alternatives

Prefer a simple wa.me link over an embedded widget so no scripts load before the visitor clicks. Display a clear notice on the button that explains that clicking will open WhatsApp and share the phone number and message with Meta. Sign the WhatsApp Business Terms and the relevant Meta business tools terms. Update the privacy policy with the link to the WhatsApp privacy notice. Safer alternatives include Signal (no metadata farming), Threema Work (Swiss based, no phone number required), Matrix or a self hosted webchat tied to your CRM that keeps visitor data inside your own infrastructure.