| Rule | What it says | Source |
|---|---|---|
| Banks and finance companies | SAMA tells the financial institutions it supervises not to use WhatsApp and similar apps with customers, to treat them as unreliable channels, and to consider chat inside their own app or website. | SAMA Rulebook, dated 29 October 2024 |
| Advertising needs prior consent | Article 25 of the Personal Data Protection Law: personal means of communication may not be used to send advertising unless the recipient consented first, with a clear way to stop receiving it. | SDAIA, PDPL |
| The law reaches work done from abroad | The PDPL covers processing of personal data of people in the Kingdom, including when it is done outside it. Running an agent from Dubai does not take a Saudi deployment out of scope. | SDAIA, PDPL Article 2 |
| Insurers | The Insurance Authority now supervises insurers. Whether SAMA’s WhatsApp rule reaches them today is for your counsel. We take no position. | Open question |
WhatsApp rules · checked 10 October 2026
WhatsApp rules for UAE and Saudi teams, in plain English.
The rules we build into every WhatsApp setup, each linked to its source. This page is not legal advice. Check your own case with your counsel.
Works with the WhatsApp Business Platform. Your number, your Meta account.
Saudi Arabia
Consent first, and no WhatsApp for banks.
UAE
WhatsApp marketing counts as telemarketing.
| Rule | What it says | Source |
|---|---|---|
| WhatsApp marketing is telemarketing | Cabinet Resolution 56 of 2024 defines telemarketing to include “marketing text messages and marketing messages through social media applications”. | UAE Legislation, Article 1 |
| Market only to people who asked | Companies create a channel for consumers who want marketing and market only to them, and must not contact numbers on the Do Not Call Register. | Same resolution, Article 4 |
| Hours | Marketing calls are allowed from 9 am to 6 pm. The text names calls; we use the same window for marketing messages as our default. | Same resolution |
| Company numbers, not personal ones | Natural persons may not market on a number licensed in their own name, and companies must not use numbers not registered to or owned by the company. How far this reaches is for your counsel; we move agents to a company number. | Same resolution, Articles 3.2 and 4.13 |
| Banks and insurers | The Central Bank’s telemarketing rules for licensed institutions also cover the providers they outsource to. | CBUAE consumer protection standards |
Meta
The platform’s own rules, in both countries.
| Rule | What it means for a build | Source |
|---|---|---|
| Free-form replies only inside 24 hours | After 24 hours from the customer’s last message, only approved templates. We track the window for each contact. | WhatsApp Business Messaging Policy |
| A clear way to reach a person | Automation must come with a prompt, clear way to escalate, such as a transfer to a person in the chat, a phone number, email or a support form. | Same policy |
| Opt-in, and opt-outs honoured anywhere | You may only message people who gave you their number and opted in, and you must honour an opt-out made on or off WhatsApp. | Same policy |
| No debt collection | The policy does not allow debt collection on the platform. We do not build collections agents on WhatsApp. | Same policy |
| No general-purpose assistants | AI providers may not offer a general assistant on the platform. An agent serving your own customers is fine, so ours stay on your business. | WhatsApp Business Solution Terms |
| No training shared models on your chats | Chat data may not train or improve AI models other than one fine-tuned for your exclusive use. | Same terms |
| Sending limits | New business portfolios start at 250 people a day outside open chats, rising to 2,000 and beyond after a scaling path such as verification. | Meta, messaging limits |
| Template review | Review can take up to 24 hours. Meta can move a utility template to marketing with a day’s notice, or at once after warnings. | Meta, templates |
What we build in
Six controls in every setup.
The brief · one email
Tell us the job and the country.
We say which of these rules apply before any work starts.