WhatsApp Business API: Costs & GDPR 2026 - The Practical Guide
This article was created with AI assistance
The text and images in this article were generated with the help of AI systems. Labelled in accordance with Art. 50(4) of the EU AI Act. Responsible for publication: ArkeonTech.
WhatsApp is the most-used messenger in Germany and, for many businesses, a direct line to their customers. But two questions decide whether to use it: what does the WhatsApp Business API really cost, and is it GDPR-compliant? This guide answers both for 2026 - with the two cost blocks, the usual hidden costs and a clear compliance path.
Key takeaway: The WhatsApp Business API has two cost blocks: the implementation by a provider and the usage-based fees Meta has charged per delivered template message since July 2025, which apply regardless of provider. As a rule, business use only rests on a sound data protection basis via the official Business API with a data processing agreement - the WhatsApp Business App on a company phone usually does not.
What does the WhatsApp Business API cost in 2026?
Total cost consists of two parts: the one-off and ongoing cost for setup and operation, plus Meta's usage-based message fees. The first part is usually offered as a one-off setup plus monthly operation. The second part comes on top, depends on your message volume, and is the item most often missing from quotes.
| Cost block | Charged by | Billing |
|---|---|---|
| Setup (concept, verification, integration) | service provider | one-off |
| Operation (hosting, AI agent, maintenance) | service provider | monthly |
| Message fees | Meta | usage-based, by category and country |
The decisive difference between the two blocks: the first is predictable once it is fixed in the contract, the second grows with your message volume. Comparing only the first block means comparing the wrong half. The other cost types of an AI agent are explained in the article What does an AI chatbot cost for SMBs?; only Meta's fees are WhatsApp-specific.
What fees does Meta charge - and how does billing work?
Meta bills WhatsApp Business Platform usage separately from the provider. Since 1 July 2025, Meta has charged for each delivered template message individually rather than per 24-hour conversation as before; the price depends on category and recipient country.
The three chargeable message categories:
- Marketing: offers, campaigns, re-activation - the most expensive category.
- Utility: transactional messages such as order confirmations, shipping status, appointment reminders.
- Authentication: one-time passwords and verification codes.
Replies to a customer enquiry are free while the 24-hour customer service window opened by every customer message is still open. Meta also does not charge for utility templates delivered within that window. Meta publishes the exact rates in its official pricing overview and adjusts them regularly. That is why every quote should include a calculation for your expected volume rather than a flat rate.
Is WhatsApp GDPR-compliant for businesses?
Yes, when the official WhatsApp Business API is used with the right setup. The key distinction: the WhatsApp Business App (the free phone app) is usually not GDPR-compliant for business use, because, if access is granted, it matches the phone numbers in the device's address book with WhatsApp, including those of contacts who never agreed to this, and because no data processing agreement exists for that use.
Business use rests on a sound legal basis when two requirements are met:
- Official Business API with a data processing agreement (DPA) with the provider operating the connection, including the list of its sub-processors.
- Documented opt-in before you contact customers on your own initiative, with clear information about the purpose. Meta's Business Policy requires it, and for advertising Section 7(2) UWG does as well.
Recommended, though not a legal requirement, is running the provider's own processing, i.e. the AI agent, logs and connection, in the EU and filtering or pseudonymising personal data before it reaches AI models.
For a deeper look at the legal obligations, see the EU AI Act guide.
What has to be in the data processing agreement?
Article 28(3) GDPR sets the mandatory content, and it is not negotiable. Check every contract against this list before signing:
| Required item | What to look for |
|---|---|
| Subject matter and duration | Must name the specific use, not just "messaging services" |
| Nature and purpose of processing | Scheduling, status enquiries, customer communication |
| Type of data and categories of data subject | Phone number, name, conversation content; customers and prospects |
| Instruction binding | Processing only on documented instructions |
| Confidentiality | Commitment covering everyone involved |
| Technical measures under Article 32 | Encryption, access control, logging |
| Sub-processors | List plus a procedure for changes under Article 28(2) |
| Duties to assist | With data subject requests and impact assessments |
| Deletion or return | After the contract ends, with evidence |
| Audit and evidence rights | Audit or a recognised certification |
The practically most important item is the list of sub-processors. A provider that will not disclose it cannot show you the chain, and you cannot meet your own accountability obligation under Article 5(2).
How far does EU data residency actually reach?
This is where proposals most often overpromise, so here is the honest position.
Your service provider can run its own infrastructure in the EU: the agent, the logs, the connection to your systems. That is sensible and should be contractually assured.
The message itself, however, always travels through Meta's infrastructure, and that is not confined to the EU. For European companies the contracting party is regularly an Irish Meta entity, but processing also takes place in the United States. That transfer relies on the adequacy decision for the EU-US Data Privacy Framework or, additionally, on standard contractual clauses.
For you this means two things. First: a provider's "EU hosting" refers to its own systems, not to the message path at Meta. Anyone claiming otherwise is describing the architecture incorrectly. Second: the third-country transfer belongs in your record of processing activities, together with the legal basis it relies on.
Where special categories of personal data under Article 9 are involved, for instance in healthcare, the channel is therefore only suitable for purely organisational communication. The additional requirements for professionals bound by secrecy are covered in our article on LLM hosting under Section 203 StGB.
WhatsApp Business App vs. Business API: what is the difference?
The free app targets very small businesses with manual handling; the API targets companies that work with several people or automation and need to secure data protection contractually.
| Criterion | Business App (free) | Business API |
|---|---|---|
| Operation | manual in the app | via a platform, including automation |
| Use | one account on the phone plus a few linked devices | several staff members and automation |
| GDPR in business | problematic | sound with DPA and opt-in |
| Address book matching | yes, if access is granted | no |
| Cost | free | setup, operation and Meta fees |
| Suitable for | very small businesses with few chats | companies with a team, automation or higher volume |
How do I set up the WhatsApp Business API GDPR-compliantly?
In four steps: (1) registering a dedicated number and verifying your business with Meta, (2) connecting via a provider with a data processing agreement, (3) building the opt-in process and privacy documentation, (4) integrating the AI agent and testing with real scenarios. How long it takes depends mainly on verification with Meta and the scope of the integration.
Is WhatsApp AI worth it despite Meta's fees?
It depends on your message mix. Replies to customer enquiries within the 24-hour customer service window are free; fees mainly arise for templates you send outside that window, highest for marketing messages. So calculate with your expected share of service, utility and marketing messages and set the fees against the value of an answered enquiry.
How channel fees fit into the total cost of an automation, with setup, operation and hidden costs, is set out in What does AI automation cost in 2026?.
Frequently asked questions about WhatsApp Business API cost and GDPR
What does the WhatsApp Business API cost per month? It depends on two separate blocks. The service provider charges for setup and operation, usually as a one-off amount plus a monthly fee. On top come Meta's usage-based message fees, which apply with any provider because Meta charges them directly. A comparable quote calculates them for your expected volume.
Is the free WhatsApp Business App GDPR-compliant? Usually not for business use: if access is granted, it matches the phone numbers in the device's address book with WhatsApp, including those of contacts who never agreed to this, and no data processing agreement exists for that use. As a rule, only the official Business API with a data processing agreement is a sound basis.
How does Meta bill the WhatsApp Business API? Since 1 July 2025 per delivered template message rather than per conversation, tiered by category (Marketing, Utility, Authentication) and recipient country. Replies to a customer message within the 24-hour customer service window are free, as are utility templates delivered within that window.
Do I need a dedicated number for the WhatsApp Business API? Yes, a dedicated number is registered and your business is verified with Meta. The service provider connecting the API usually handles both; make sure the WhatsApp Business account belongs to your company.
Am I allowed to send marketing via WhatsApp? Yes, with documented consent. Under Section 7(2) of the German Unfair Competition Act (UWG), advertising by messenger generally requires prior express consent, and Meta's Business Policy requires opt-in before a business contacts someone. Promotional messages fall into the Marketing category, which Meta usually charges at the highest rate.
What has to be in the data processing agreement for the WhatsApp Business API? Article 28(3) GDPR sets the mandatory content: subject matter and duration, nature and purpose of processing, types of data and categories of data subject, instruction binding, confidentiality, technical measures under Article 32, sub-processors including a change procedure, duties to assist with data subject requests, deletion after the contract ends, and audit and evidence rights. The practically most important item is the list of sub-processors: a provider that will not disclose it makes it impossible for you to meet your own accountability obligation under Article 5(2).
With a European provider, does the data really stay in the EU? Only partly, and this is often misrepresented. The service provider's own infrastructure can run entirely in the EU. The message itself, however, always travels through Meta's infrastructure, which is not confined to the EU: the contracting party is regularly an Irish Meta entity, but processing also takes place in the United States. The transfer relies on the adequacy decision for the EU-US Data Privacy Framework or, additionally, on standard contractual clauses. This third-country transfer belongs in your record of processing activities.
Sources
- Meta: WhatsApp Business Platform Pricing
- European Union (2016): General Data Protection Regulation (GDPR)
- Meta for Developers: Pricing on the WhatsApp Business Platform
- WhatsApp: Business Policy
- German Unfair Competition Act: Gesetz gegen den unlauteren Wettbewerb (UWG), Section 7
WhatsApp AI for business
Answer enquiries automatically, qualify leads and book appointments - via the official WhatsApp Business API.
More Articles
AI Policy in the Company: What It Must Contain to Work
42 percent of companies observe or suspect private AI accounts at work, only 23 percent have binding rules. What belongs in an AI usage policy, how the approval matrix for data and tools works, when the works council has a say and why a total ban fuels shadow AI rather than stopping it.
AI Disclosure Duty: What Has Applied Since 2 August 2026
Since 2 August 2026, Article 50 of the EU AI Act applies: chatbots, voice bots and AI assistants must identify themselves. What that requires in practice, which deadline applies to existing systems, and why the Omnibus postponement does not cover it.