The WhatsApp Business API — properly the WhatsApp Business Platform — lets your own software send and receive WhatsApp messages at volume, as opposed to the free app you install on a phone. Whether UK businesses should be on the channel is not really a question any more: WhatsApp reached 44.2 million UK online adults in May 2025, 90% of them, and 36.1 million daily (Ofcom, Online Nation 2025). The real questions are what it costs, what Meta forbids, and where UK law diverges from the EU. This article covers all three.
How big is WhatsApp in the UK?
Big enough that the strategic debate is over.
Ofcom’s Online Nation 2025, based on Ipsos iris audience measurement of UK internet users aged 18 and over in May 2025, puts WhatsApp first among messaging services and first across all smartphone app categories, with 92% reach among UK adult smartphone users. Monthly reach was 90% of online adults, up from 87% a year earlier. Daily reach was 74%. Average daily use per person: 17 minutes, up from 15.
Set that against SMS, which is moving in the opposite direction for personal use — UK mobile messages fell to 28.03 billion in 2024 from 31.68 billion in 2023 — while business A2P messaging grows, reaching 21.4 billion messages in 2024/25 (Ofcom).
The honest read: SMS still reaches everyone without an app and without the customer ever having messaged you first. WhatsApp reaches nine in ten and gives you a conversation. They do different jobs, which is the argument for using both rather than switching.
How does the 24-hour window work?
Every rule about what you may send follows from one mechanism.
When a WhatsApp user messages you or calls you, a 24-hour customer service window opens. If they message or call again before it expires, the timer resets to 24 hours (Meta for Developers).
Inside the window you can send free-form messages — text, images, documents, locations, buttons, lists — with no pre-approval. For customer service that is exactly what you want; an engineer sending a photo of a meter cupboard doesn’t need a template for it.
Outside the window you cannot. The only thing you may send is a pre-approved template, and it must sit in a category.
There are three categories, not four (Meta for Developers):
- Utility — follows a user action or request. Must be non-promotional, with no persuasive content, and either specific to or requested by the user, or essential to them. An appointment confirmation belongs here.
- Marketing — anything from awareness to offers and re-engagement.
- Authentication — codes verifying identity.
“Service” is not a template category. It is the name for free-form messages inside the window. Plenty of UK articles list four categories, which is a checkable error.
Meta reclassifies templates that are filed wrongly — a utility template carrying an offer becomes marketing, at marketing prices — and repeat miscategorisation escalates from warnings to rate limiting to portfolio-level restrictions. Templates are reviewed automatically and approval can take up to 24 hours, so build them before you need them, not on a Friday afternoon.
What does it cost, and what changes on 1 October 2026?
Meta has charged per message since 1 July 2025, replacing the old per-conversation model. You are charged on delivery. Marketing templates always cost; utility and authentication cost when sent outside the window (Meta for Developers, pricing).
The part to plan around: free-form service messages inside an open window have been free since November 2024, and utility templates inside the window since July 2025. From 1 October 2026 Meta charges per message for all service messages, and again for utility templates sent in response to users inside the window. Rates will match the utility and authentication rates by market, with no volume discounts for service messages, and specific rates were to be published by 1 September 2026 (Meta for Developers, upcoming pricing updates).
If your business case rests on “the conversation is free once the customer replies”, that case needs redoing.
Two cautions on numbers. Meta’s marketing pages lag its developer documentation and still describe per-conversation pricing and a thousand free monthly conversations — that has been wrong since July 2025. And we could not verify UK-specific per-message rates from Meta’s own rate card, so treat any figure you are quoted as the supplier’s, and ask them to show you Meta’s card.
What Meta forbids, and two of them will matter to you
This is the section most UK coverage skips.
Opt-in is a policy requirement, not just good manners. Meta’s policy: “You may only contact people on WhatsApp if: (a) they have given you their mobile phone number; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you” (WhatsApp Business Messaging Policy). Opt-out requests must be respected, including ones made off WhatsApp.
Debt collection is prohibited under the Commerce Policy. For a property manager chasing rent arrears, WhatsApp is a policy risk however well people respond to it.
Health content is restricted. Meta states you should not use WhatsApp for telemedicine or to send or request health-related information where applicable regulation prohibits distribution to systems without heightened requirements. For a dental or medical practice that is a hard line: appointment confirmations yes, discussion of symptoms no.
Automation is allowed, with a condition. You may automate replies inside the 24-hour window, but you must also have “prompt, clear, and direct escalation paths” — in-chat transfer to a human, a phone number, an email address, a support form. That is a design requirement, not a formality.
Quality is enforced. People can block or report a business, and Meta’s systems limit how much a business can send if its quality tier stays low. Over-messaging eventually costs you the channel.
The UK legal position, and where it differs from Ireland
Two layers sit on top of Meta’s rules.
PECR. Regulation 22 governs “electronic mail” to individual subscribers, which the ICO reads as covering text messages. Whether a WhatsApp message is “electronic mail” for PECR purposes has not been settled by the ICO or the courts as far as we can find, and the prudent assumption is that it is, since the definition is technology-neutral. Either way the ICO’s service-message doctrine applies: appointment reminders appear in the ICO’s own list of service messages, and “if your service message has elements that are direct marketing, even if that is not the main purpose of your message, then it will count as direct marketing” (ICO). One message, one purpose.
Since 5 February 2026 a PECR breach carries up to £17.5 million or 4% of global turnover (ICO).
And now the divergence, which is the most useful thing in this article if you trade across the Irish Sea.
The UK has no AI Act. The House of Lords Library stated in May 2026 that “the UK does not have AI-specific legislation or regulators,” that AI is regulated contextually through existing regulators, and that the 2026 King’s Speech contained no cross-sector AI bill (House of Lords Library). The only AI bill before Parliament is a Lords private member’s bill with no government backing. So there is no UK statutory duty to tell someone a bot is replying.
That does not make it a free-for-all. UK GDPR transparency and the fairness principle still require you to be straight about how data is processed, and an undisclosed AI handling a customer’s conversation is a transparency problem without an AI Act. But it is a materially lighter regime than the EU’s.
In Ireland and the EU, Article 50 of the EU AI Act has applied since 2 August 2026 and requires that people be informed when they are interacting with an AI system, unless it is obvious — and the European Commission reads that exception narrowly. Irish rules are also stricter on mixed messages: the ePrivacy Regulations expressly catch a non-marketing SMS “which includes information intended for the purpose of direct marketing” unless the recipient consented (SI 336/2011, regulation 13), and the Irish existing-customer exception expires 12 months after the purchase, where PECR has no time limit.
If you serve both markets, build to the Irish standard and you are compliant in both. Build to the UK standard and you are not.
App or Platform?
A practical fork, and the answer is usually simpler than suppliers suggest.
The free WhatsApp Business app has greeting messages, away messages, quick replies and labels, and supports up to ten linked devices or agents. Under about a hundred conversations a week, with no need to connect to your diary, it is enough.
The Platform is for volume and integration — connecting to your workshop system, practice software or job management. But note what you lose: Meta’s own migration documentation lists messaging tools including the greeting message, away message, quick replies and labels as “Not supported” on the Cloud API (Meta for Developers). Those get rebuilt in whatever software you connect. Businesses usually discover that after migrating.
What this means for your business
WhatsApp is the right channel for short practical traffic — confirming, moving, sending a photo, answering a quick question. It is the wrong channel for arrears chasing and clinical discussion, and that is Meta’s policy rather than your judgement.
Three questions for any supplier: how is the away message rebuilt now that button has gone, what happens to my costs on 1 October 2026, and where is the route to a human?
Sono builds voice AI agents and WhatsApp agents, so the same follow-up can run by phone or in WhatsApp depending on where the customer actually answers — including the disclosure at the start of the conversation that EU customers are now entitled to. If you want to work out which of your recurring contacts belong on which channel, book a free call. For the SMS side of the same job, see our guide to running an SMS reminder service.
