WhatsApp Business Platform compliance checklist

WhatsApp is not an open messaging channel. Meta decides who you may message, when, and with what wording, and it enforces those rules with number bans.

EW-FLOW sends and receives WhatsApp through Twilio: your Twilio WhatsApp sender, the Twilio Conversations API, and behind Twilio the WhatsApp Business Platform operated by Meta. That chain means Meta's policies apply to your workflow, and a violation shows up as a rejected template, a downgraded quality rating, or a blocked sender, not as a Twilio error you can retry. This page maps each rule to the EW-FLOW Task that implements it. It is a build checklist, not legal advice.

How the chain works

Your workflow (EW-FLOW)  ->  Twilio  ->  Meta / WhatsApp  ->  the user's phone

• EW-FLOW runs your Process, resolves variables, and calls Twilio.
• Twilio is your WhatsApp Business Solution Provider (BSP). It owns the sender number, submits your templates to Meta, and bills you.
• Meta approves templates, applies the policy, prices the message, and rates the quality of your sender.

Each link enforces its own rules. Twilio will happily accept a message that Meta then refuses to deliver, so a 200 OK from a Task is not proof that the message arrived.

Opt-in: before the first business-initiated message

Meta requires a verifiable opt-in before you send the first business-initiated message to a number. The rule is about evidence, not about a checkbox on a screen.

An opt-in is acceptable when all of the following are true:

• The person actively gave their WhatsApp number, or actively agreed to be contacted on WhatsApp at that number.
• WhatsApp is named at the moment of consent. "We will contact you" is not opt-in for WhatsApp. "We will message you on WhatsApp" is.
• Your business is named, with the same name the user will see as the sender.
• You can produce the evidence later: what they saw, when, from which source. Meta can ask.

The opt-in can be collected anywhere: on your website, in a shop, in an IVR, in an existing SMS or email conversation. It does not have to be collected inside WhatsApp.

In EW-FLOW	What to do
Before any TwilioSendWhatsAppTask that opens a conversation	Check your own opt-in record first. A HttpTask against your CRM plus a SwitchTask on the result keeps unconsented numbers out of the flow.
When the user writes to you first on the TwilioWhatsApp Channel	No opt-in is needed to reply inside the 24 hour window. The inbound message is the invitation. It is not an opt-in for later marketing.
Opt-out	Honour STOP and its local equivalents in the user's language, and stop sending. Record the opt-out where your opt-in check reads from, not only in Twilio.

Opt-in does not transfer

Consent to receive SMS or email is not consent to receive WhatsApp, and consent given to one brand does not cover another brand in the same group. Collect it per channel and per sender.

The 24 hour customer service window and templates

WhatsApp splits every conversation into two states.

State	When	What you can send	EW-FLOW
Inside the window	For 24 hours after the user's most recent inbound message	Free-form text, media, anything within policy	The standard OutputTask on the TwilioWhatsApp Channel, or TwilioSendWhatsAppTask with Body filled in
Outside the window	Any other time	Only a template approved by Meta, identified by its content SID	TwilioSendWhatsAppTask with ContentSid filled in

The window is reset by every inbound message and only by an inbound message. Your own messages do not extend it.

Templates are submitted through Twilio and reviewed by Meta. A template can be rejected for promotional wording in a utility category, for placeholder abuse (a template that is almost entirely variables), for misspellings, or for policy breaches. Approval typically takes minutes to a day, so submit templates before the release that needs them, not during it.

Property on TwilioSendWhatsAppTask	Use it for
Body	Free-form text. Delivered only inside the window.
ContentSid	An approved template (HX...). Required when Body is empty and the only thing that works outside the window.
To	Recipient. The whatsapp: prefix is added for you.
From	Sender. Defaults to the Environment's WhatsApp From Number.

Design the flow for the window, not against it

If a workflow may resume after a long pause (a delivery update, a callback the next morning), assume you will be outside the window and build that step on a template from the start. A Body message that silently fails to deliver at 09:00 the next day is the most common WhatsApp bug we see.

Pricing by category

Since 1 July 2025 the WhatsApp Business Platform bills per delivered message, not per 24 hour conversation. What you pay depends on the category of the template and the recipient's country.

Category	Typical content	Notes
Marketing	Promotions, offers, re-engagement, cart reminders	Most expensive. Charged even inside the customer service window.
Utility	Order and delivery updates, appointment reminders, receipts, account changes, all tied to an existing transaction	Not charged when sent inside the customer service window.
Authentication	One-time passcodes and login codes	Charged inside the window as well. Volume tiers apply in some markets.
Service	Free-form replies inside the 24 hour window	Free.

The category is a property of the template, assigned when you submit it and reviewable by Meta. Meta can and does re-categorise a template that behaves like marketing, which changes your bill without changing your code.

Two consequences for how you build:

• Do not smuggle marketing into a utility template. An order confirmation that ends with a discount code is a marketing template. Getting it re-categorised is the good outcome; getting the sender rated poorly is the bad one.
• Keep authentication templates separate and minimal. Reuse of an OTP template for anything else risks the whole template being pulled.

Twilio adds its own per-message fee on top of Meta's. Check the current rates in the Twilio WhatsApp pricing page for the countries you send to, because the country spread is large.

Quality rating, limits and bans

Meta rates each sender on how recipients react: blocks and "report" taps drive the rating down, engagement holds it up.

Signal	Effect
Quality rating (High, Medium, Low)	Visible in the Meta Business Manager and surfaced by Twilio. Low quality is the warning shot.
Messaging limit	The number of business-initiated conversations you may start per rolling 24 hours: typically 250, then 1K, 10K, 100K, then unlimited. It scales up with sustained good quality and volume, and down after quality drops.
Template pausing	A template with poor quality is paused for a period. Sends against it fail while paused.
Sender restriction or ban	Repeated violations block the number. Recovering it is slow and sometimes impossible.

How to protect the rating from inside a workflow:

• Do not blast. Spread bulk sends and use the DelayTask or the Scheduler Module to pace them rather than firing a loop at full speed.
• Give people something to do with the message. A template that invites a reply generates engagement, which is the signal Meta measures.
• Send marketing in office hours, in the recipient's timezone.
• Watch Logs for delivery failures on WhatsApp Tasks. A sudden cluster of failures usually means a paused template or a hit limit, not a bug in your Process.

Prohibited content

Meta's Commerce and Business Messaging policies forbid whole categories outright. If your workflow exists to sell any of these, WhatsApp is not the channel:

• Alcohol, tobacco, vaping and other controlled or age restricted goods
• Drugs, including pharmaceuticals and supplements in most configurations
• Weapons, ammunition and explosives
• Gambling and real money gaming
• Adult content and services
• Unapproved financial products, loans and money making schemes
• Animals, body parts and fluids
• Anything illegal in the recipient's country

Beyond the categories, the policy also bans deception: a sender that impersonates another business, a template that hides its commercial purpose, or a flow that harvests data it does not need.

Italy: SMS and voice marketing rules

If the same workflow also sends SMS or places calls to Italian numbers, two national rules apply on top of everything above.

Consent for SMS and email is opt-in. Article 130 of the Italian Codice Privacy (d.lgs. 196/2003), read with the GDPR, requires prior, specific, documented consent before sending a commercial SMS. There is no opt-out mechanism that replaces it. The consent must be separate from consent for other purposes, freely given, and withdrawable as easily as it was given. Keep the evidence: the Garante asks for it, and the fines for marketing SMS without consent are routine.

The Registro Pubblico delle Opposizioni (RPO) covers calls, not SMS. The RPO is an opt-out register for telephone marketing calls made with an operator, and for paper mail. Since 27 July 2022 it accepts mobile numbers as well as landlines, and registering wipes previously given consents for marketing calls. If your workflow makes outbound marketing calls (the ACS, Twilio Voice or Aculab Modules), you must screen the list against the RPO before dialling. It does not exempt you from collecting consent for SMS or WhatsApp, and it is not a substitute for the WhatsApp opt-in described above.

One Italian delivery quirk worth knowing. Italian carriers sometimes rewrite the sender of an SMS and deliver it from a shared short code, so the user cannot reply. See Italian SMS carrier rewrites in the Twilio Module page for the workaround. This is a deliverability problem rather than a compliance one, but it breaks any flow that expects a reply.

Data flow to put in your privacy notice

Your users are entitled to know where their message goes. The chain for a WhatsApp conversation built on EW-FLOW is:

Step	Who	What happens there
1	The user	Writes a WhatsApp message, or receives one from your sender.
2	Meta Platforms	Operates WhatsApp and carries the message. Transport is end to end encrypted between the user and the Business API endpoint.
3	Twilio	Your WhatsApp BSP. Receives and sends on your behalf, and holds message content and metadata according to your Twilio account settings.
4	EW-FLOW	Runs your Process on Microsoft Azure in the Italy North region. Stores the conversation on the Session, together with the variables your Process sets, for the retention period configured on your Workspace.
5	Your own systems	Anything an HttpTask, a Storage Task or a Module in your Process sends onward, for example a CRM or a ticketing system. Only you know this part.

Points to reflect in the notice you give your users:

• Name WhatsApp and Meta as the channel, and Twilio as the provider that carries the messages for you.
• State where the conversation is stored (EW-FLOW, Azure Italy North) and for how long, matching your Workspace retention setting.
• If any step in your Process sends data outside the EU, for example a model provider or a CRM in another region, say so and name the safeguard you rely on.
• Name the controller. For the conversations your workflow runs, that is you, not EW-FLOW.
• If an AI model writes the replies, add the AI disclosure as well. See AI Act transparency.

Check your own steps

The table above covers the platform. It cannot cover the Tasks you added. Walk your own Process once with the data flow in hand and write down every Task that sends content to a third party, then reconcile that list with your privacy notice.

Checklist

Before you deploy a WhatsApp Process to production:

Consent and audience

• Verifiable opt-in exists for every number the flow can start a conversation with, naming WhatsApp and your business.
• The opt-in record is reachable from the workflow, or from the system that feeds it.
• STOP and its local equivalents are handled, and the opt-out is written back to the same record.

Messages

• Every conversation-opening send uses an approved template through ContentSid, not Body.
• Templates exist and are approved in every language the flow supports.
• Template categories match the content: no offers inside a utility template.
• Free-form Body sends only happen on paths that are provably inside the 24 hour window.
• The first outbound message carries the AI disclosure when a model writes the replies.

Operations

• The Environment has a real approved WhatsApp sender configured, not the Twilio sandbox number.
• Bulk sends are paced rather than looped at full speed.
• Someone watches the sender's quality rating and messaging limit in the Meta Business Manager.
• Logs are checked after each campaign for delivery failures.

Legal and data

• Italian SMS or email marketing in the same flow has documented prior consent.
• Outbound marketing calls are screened against the RPO.
• The privacy notice names Meta, Twilio, EW-FLOW and the storage region, and matches the retention setting on the Workspace.
• Nothing in the flow touches a prohibited content category.

References

• Twilio Module, including TwilioSendWhatsAppTask and the WhatsApp Configuration section
• AI Act transparency for conversational workflows
• WhatsApp Business Messaging Policy
• WhatsApp Commerce Policy
• Twilio WhatsApp pricing
• Garante per la protezione dei dati personali and the Registro Pubblico delle Opposizioni