WhatsApp chatbot for companies: what is legal, what works and what it really costs

1. What the law requires: disclosing that there is an AI behind it

Let's start where almost nobody starts, because this is the part that can actually cost you money. The European AI Regulation (AI Act, Regulation (EU) 2024/1689) has an article that hits you directly if you set up a bot: article 50, on transparency. Its obligations have applied since 2 August 2026. That is, already.

The text is clear. Article 50.1 states that «providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious». Translated to your WhatsApp: when someone messages your number and a bot answers, they have to know they are talking to a machine.

Hiding it in the privacy policy or in the small print does not count. The disclosure must be clear and appear at the start of the conversation. One line is enough: «Hi, I'm the virtual assistant for [your company]. If you need to talk to a person, type agent». That gets you compliant and, at the same time, gives an out to anyone who does not want to talk to a robot.

• Who is responsible: the design obligation falls on the provider of the system, but you, as the company deploying it, are the one who has to make sure the notice is in place and works.
• When to disclose it: in the bot's first message, not halfway through the conversation.
• Exception: if it is obvious that it is an AI, the law does not force you to repeat it. But a one-line notice costs nothing and takes the problem off the table.

And the penalties?

Failing to meet the transparency obligations can bring fines of up to 15 million euros or 3% of worldwide annual turnover, whichever is higher. For SMEs and startups, the lower of the two applies. In Spain, the supervising authority is AESIA (Agencia Española de Supervisión de la Inteligencia Artificial). It is not that they are going to knock on your door over a badly worded disclosure line, but the framework exists and it carries your tax ID.

2. GDPR: what data a WhatsApp bot touches and what you cannot do

The AI Act does not replace GDPR, it adds to it. A WhatsApp chatbot processes personal data by definition: the phone number already is one, and often so are the name, the order, the issue. That puts you under the usual obligations, applied to this channel.

There are three points where we see small businesses fail over and over. The first: using the sales rep's personal phone contact list to blast out messages. That has no clean legal basis. You need consent or a well documented legitimate interest, and the ability to show where each number came from.

The second: not informing people. Before the bot asks for any data, the person must be able to find out who is processing their information and for what purpose. A link to your privacy policy in the first message solves most of it.

• Legal basis: be clear about why you can message each contact (prior consent or legitimate interest) and keep the proof.
• Information: link your privacy policy and explain the purpose before collecting data.
• Minimisation: have the bot ask only for what it needs. Do not ask for a national ID number if the order number is enough.
• Data processor: sign the article 28 GDPR contract with your API provider and with whoever builds the bot for you.
• Sensitive data: if the bot could end up handling health, ideology or similar, stop and get advice before launching.

3. Official versus unofficial API: what each route means

Here is the decision that shapes the project the most, and it is worth laying it out plainly. There are two ways to connect a bot to WhatsApp. The official one is the WhatsApp Business Platform, Meta's API: you contract it through a solutions provider (a BSP) and it gives you a verified number, approved templates and a predictable per-message price. The unofficial one uses tools that connect by simulating the WhatsApp app, like the well known Evolution API, which you can host on your own server. Neither is illegal in itself; the difference lies in Meta's terms, the risk and the cost.

The unofficial route breaches WhatsApp's terms of service. That will not land you in court, but it does carry a concrete risk: Meta detects the pattern and can block the number. If the one blocked is your company's support number, the problem stops being technical. In exchange it has real advantages: you do not pay Meta per message, you keep the data on your own server and you build the bot with more freedom. It is a reasonable option for anyone who wants to test the channel, moves a lot of volume or prefers not to depend on the per-message rate, as long as they take on the blocking risk with their eyes open.

The official route removes that blocking risk and gives you something the other does not offer with the same solidity: a data processing agreement with the BSP and templates reviewed by Meta. You pay for it in two ways, with the per-message cost and a more structured rollout. If the channel is critical and you cannot afford to lose the number, it is the calmer option. Both routes can be connected to your CRM or your order system; when you want to link WhatsApp with your customer record, that work is sales automation on top of your CRM, and it can be built on either route.

• Blocking risk: the official route uses a number verified by Meta; the unofficial one breaches its terms and can end up blocked.
• Cost: the official route is paid per message delivered; the unofficial one avoids that cost and is paid for with the server and the maintenance.
• GDPR: the official route comes with a data processing agreement with the BSP; on the unofficial one you keep the data on your server, but you still have to sign a processing agreement with whoever builds it for you.
• Integration with CRM and orders: viable on both; the official route comes with it more structured, the unofficial one handles it with webhooks and its own API.
• When to pick each one: the official route if the number is critical and you want zero blocking risk; the unofficial one if you prioritise cost and control and accept that risk.

4. What it really costs: per message or per server

Here we need to separate the two routes, because they cost very differently. Let's start with the official one. Forget the idea of a flat fee: since 1 July 2025 Meta charges per message delivered, not per conversation. Every template that reaches a client's phone is billed on two variables: the category of the message and the recipient's country. The same message costs a different amount in Spain than in Mexico.

There are four categories. Marketing (promotions, updates), utility (order confirmations, appointment notices, delivery reminders), authentication (one-time codes) and service (replies within a conversation the client opens). The cost trick is the service window: when a client messages you, a 24-hour window opens in which replying to them is free.

For Spain, indicative rates run around €0.05 per marketing message and about €0.017 per utility or authentication message. That is cents per message, but multiply it by your volume before deciding. And watch out: these are figures Meta changes. Check the live price in its documentation before you budget, because on 1 October 2026 there are rate adjustments in several markets. On top of that add whatever the BSP charges and what it costs to build and maintain the bot, which is usually the real bulk of the investment.

The unofficial route flips this model around. By hosting the tool (Evolution API, for example) on your own server, you do not pay Meta per message: you send within whatever limits the number tolerates. In exchange you pay for the server and, above all, the maintenance, which is the real work. It comes out cheaper per message and more expensive in technical dependency and in the risk of the number going down. Which one pays off depends on your volume: at low volume the official route is simpler; at high volume, the per-message difference adds up.

5. What a bot handles well (and where a person has to step in)

A WhatsApp bot is not a cheaper employee. It is good at specific tasks and bad at others, and getting that confused costs you in reputation. Where it truly delivers is on the repetitive and the predictable.

A logistics operator we work with uses WhatsApp to notify delivery status and confirm time slots. The bot sends the notice, the client replies, and it only escalates to a person when there is a real issue. Calls asking «where's my order?» dropped noticeably, and the ones that remain are the ones that actually need someone. That kind of flow fits with what we automate in AI for logistics.

Good ground for the bot

Reactivating a database of dormant clients with a well thought out message. First contact and qualification of whoever messages for the first time. Frequently asked questions with a stable answer (opening hours, order status, how to make a return). Simple data collection before handing off to a human. In all these cases the bot filters, and the person only gets what actually matters.

Ground where a person steps in

Complaints, emotionally charged grievances, negotiations and any ambiguous case. There, a bot that keeps insisting with canned answers annoys more than it helps. The rule we apply: the bot handles what is frequent and clear, and as soon as it detects anger, complexity or an escalation keyword, it hands the conversation to a person without making the client repeat everything. A good bot shows itself as much by what it answers as by how quickly it knows to step aside.

6. When a WhatsApp chatbot is NOT worth it

Not every business needs this, and promising otherwise would be empty talk. There are clear cases where we tell you not to build it, or at least not yet.

The most important one for us: WhatsApp is not a collections channel. Chasing an overdue invoice on a client's personal phone is informal, does not leave the documented trail you need and mixes admin with sales. Collecting payment is a formal matter between companies and goes by email, addressed to the person responsible and from a real inbox, not from a support number. If your problem is unpaid invoices, the channel is email, and we cover it in how to recover overdue payments with automatic email reminders, not a WhatsApp bot.

• Collections and money claims: go by email, never WhatsApp. Collecting is administrative; sales reactivation is what actually fits this channel.
• Very low volume: if you get three enquiries a day, a bot is using a sledgehammer to crack a nut. Answer them by hand.
• Databases with no consent: if you cannot prove where the numbers came from, do not launch anything until you sort that out.
• Conversations that always end up with a person (complex sales, advisory work): the bot just adds a step of friction.
• Expecting it to replace your whole support team: that is not what this is about. It is about taking the repetitive work off your plate so your people can handle what matters.

7. How we build it so it does not cause you problems

When we roll out a WhatsApp bot we always follow the same order, and it is deliberate. Legal first, because a fast bot that breaks the rules is a liability, not an asset. And before anything else, the route decision: we explain the official and unofficial options with their risks, so you choose with the information in front of you.

We will be clear about what we deliver today: we build the bot on Evolution API on our own server (a VPS we manage), which is an unofficial route, not Meta's API. We choose that path because it gives us control over the data and avoids the per-message cost, and we do it knowing, and telling you, that it carries the blocking risk we already explained. If your case calls for Meta's official route, we explain it and point you toward contracting it with a BSP, but we do not present it as something we already provide.

The work order does not change depending on the route. We start by checking the database and its legal basis. We set up the channel with the article 50 AI disclosure in place from the first message, plus the link to the privacy policy. We define the specific flows (what the bot resolves and what escalates to a person) and the escalation rules. We connect it to the CRM or the order system when the bot needs to know the client. And we measure: how many enquiries it resolves on its own, how many it escalates and what it costs each month.

It is not a months-long project. A well scoped bot for first contact and FAQs goes live in weeks. What takes time is the usual thing: deciding properly what it does and does not do, and cleaning up the database. If you want to see it applied to your case, we are an AI agency in Barcelona and we build it ourselves, we do not leave it on a slide.

Frequently asked questions

Sources

• Reglamento (UE) 2024/1689 (AI Act), artículo 50, transparencia (EUR-Lex, Unión Europea)
• Article 50: Transparency Obligations for Providers and Deployers (EU Artificial Intelligence Act (artificialintelligenceact.eu))
• Pricing on the WhatsApp Business Platform (Meta for Developers)
• WhatsApp Business API Pricing in Europe 2026: EUR per-message rates by category (Blueticks)
• AESIA, Agencia Española de Supervisión de la Inteligencia Artificial (Gobierno de España)
• Evolution API, API REST de código abierto para WhatsApp (Baileys y Cloud API) (Evolution Foundation (GitHub))

Keep reading