WhatsApp Business API: Costs & GDPR 2026 - The Practical Guide
This article was created with AI assistance
The text and images in this article were generated with the help of AI systems. Labelled in accordance with Art. 50(4) of the EU AI Act. Responsible for publication: ArkeonTech.
- WhatsApp Business API
- GDPR
- Pricing 2026
- Conversational Commerce
- SME
WhatsApp is the most-used messenger in Germany and, for many businesses, a direct line to their customers. But two questions decide whether to use it: what does the WhatsApp Business API really cost, and is it GDPR-compliant? This guide answers both for 2026 - with the two cost blocks, the usual hidden costs and a clear compliance path.
Key takeaway: The WhatsApp Business API has two cost blocks: the implementation by a provider and the usage-based fees Meta charges per delivered message, which apply regardless of provider; in Germany they range from 0.0456 to 0.1131 euros per message since 1 October 2026. Since then, replies in the service window are also charged once a phone number sends more than 1,000 of them a month. As a rule, business use only rests on a sound data protection basis via the official Business API with a data processing agreement - the WhatsApp Business App on a company phone usually does not.
What does the WhatsApp Business API cost in 2026?
Total cost consists of two parts: the one-off and ongoing cost for setup and operation, plus Meta's usage-based message fees. The first part is usually offered as a one-off setup plus monthly operation. The second part comes on top, depends on your message volume, and is the item most often missing from quotes.
| Cost block | Charged by | Billing |
|---|---|---|
| Setup (concept, verification, integration) | service provider | one-off |
| Operation (hosting, AI agent, maintenance) | service provider | monthly |
| Message fees | Meta | usage-based, by category and country |
The decisive difference between the two blocks: the first is predictable once it is fixed in the contract, the second grows with your message volume. Comparing only the first block means comparing the wrong half. The other cost types of an AI agent are explained in the article What does an AI chatbot cost for SMBs?; only Meta's fees are WhatsApp-specific.
What fees does Meta charge - and how does billing work?
Meta bills WhatsApp Business Platform usage separately from the provider. Since 1 July 2025, Meta has charged for each delivered message individually rather than per 24-hour conversation as before; the price depends on category and recipient country. On 1 October 2026 Meta changed billing again: service messages, that is, free-form replies within the 24-hour customer service window opened by every customer message, are charged again, as are utility templates within that window.
| Category | Used for | Price per message in Germany |
|---|---|---|
| Marketing | offers, campaigns, re-activation | 0.1131 euros |
| Utility | order confirmation, shipping status, appointment reminder | 0.0456 euros |
| Authentication | one-time passwords, verification codes | 0.0456 euros |
| Service | free-form replies in the service window, including those of an AI agent | first 1,000 per phone number and month free, then 0.0456 euros |
As of: Meta's euro rate card, effective 1 October 2026. Volume discounts exist only for utility and authentication, in Germany only from 100,001 and 300,001 messages a month respectively; for mid-sized companies the list price effectively applies.
Two cases stay free: the first 1,000 service messages per phone number and month, and all messages in the free entry point window. It opens when a customer writes via a click-to-WhatsApp ad and you reply within the service window, and it stays open for up to seven days. Replies from your own AI agent via the API count as service messages; Meta's own AI agent (Meta Business Agent) is billed separately by tokens, including in the free entry point window.
A worked example: if an AI agent sends 3,000 replies a month from one phone number, 1,000 of them are free, and Meta charges 0.0456 euros each for the other 2,000, or 91.20 euros in total. Meta adjusts its rates at the start of a quarter; that is why every quote should include a calculation for your expected volume rather than a flat rate.
Important for assistants already running: if no payment method is set up for the WhatsApp account at Meta, Meta stops delivering service messages once the 1,000 free ones are used up, and the assistant stays silent until the next month begins. The payment method is added in Meta's Billing Hub.
Is WhatsApp GDPR-compliant for businesses?
Yes, when the official WhatsApp Business API is used with the right setup. The key distinction: the WhatsApp Business App (the free phone app) is usually not GDPR-compliant for business use, because, if access is granted, it matches the phone numbers in the device's address book with WhatsApp, including those of contacts who never agreed to this, and because no data processing agreement exists for that use.
Business use rests on a sound legal basis when two requirements are met:
- Official Business API with a data processing agreement (DPA) with the provider operating the connection, including the list of its sub-processors.
- Documented opt-in before you contact customers on your own initiative, with clear information about the purpose. Meta's Business Policy requires it, and for advertising Section 7(2) UWG does as well.
Recommended, though not a legal requirement, is running the provider's own processing, i.e. the AI agent, logs and connection, in the EU and filtering or pseudonymising personal data before it reaches AI models.
For a deeper look at the legal obligations, see the EU AI Act guide.
What has to be in the data processing agreement?
Article 28(3) GDPR sets the mandatory content, and it is not negotiable. Check every contract against this list before signing:
| Required item | What to look for |
|---|---|
| Subject matter and duration | Must name the specific use, not just "messaging services" |
| Nature and purpose of processing | Scheduling, status enquiries, customer communication |
| Type of data and categories of data subject | Phone number, name, conversation content; customers and prospects |
| Instruction binding | Processing only on documented instructions |
| Confidentiality | Commitment covering everyone involved |
| Technical measures under Article 32 | Encryption, access control, logging |
| Sub-processors | List plus a procedure for changes under Article 28(2) |
| Duties to assist | With data subject requests and impact assessments |
| Deletion or return | After the contract ends, with evidence |
| Audit and evidence rights | Audit or a recognised certification |
The practically most important item is the list of sub-processors. A provider that will not disclose it cannot show you the chain, and you cannot meet your own accountability obligation under Article 5(2).
How far does EU data residency actually reach?
This is where proposals most often overpromise, so here is the honest position.
Your service provider can run its own infrastructure in the EU: the agent, the logs, the connection to your systems. That is sensible and should be contractually assured.
The message itself, however, always travels through Meta's infrastructure, and that is not confined to the EU. For European companies the contracting party is regularly an Irish Meta entity, but processing also takes place in the United States. That transfer relies on the adequacy decision for the EU-US Data Privacy Framework or, additionally, on standard contractual clauses.
For you this means two things. First: a provider's "EU hosting" refers to its own systems, not to the message path at Meta. Anyone claiming otherwise is describing the architecture incorrectly. Second: the third-country transfer belongs in your record of processing activities, together with the legal basis it relies on.
Where special categories of personal data under Article 9 are involved, for instance in healthcare, the channel is therefore only suitable for purely organisational communication. The additional requirements for professionals bound by secrecy are covered in our article on LLM hosting under Section 203 StGB.
WhatsApp Business App vs. Business API: what is the difference?
The free app targets very small businesses with manual handling; the API targets companies that work with several people or automation and need to secure data protection contractually.
| Criterion | Business App (free) | Business API |
|---|---|---|
| Operation | manual in the app | via a platform, including automation |
| Use | one account on the phone plus a few linked devices | several staff members and automation |
| GDPR in business | problematic | sound with DPA and opt-in |
| Address book matching | yes, if access is granted | no |
| Cost | free | setup, operation and Meta fees |
| Suitable for | very small businesses with few chats | companies with a team, automation or higher volume |
How do I set up the WhatsApp Business API GDPR-compliantly?
In four steps: (1) registering a dedicated number and verifying your business with Meta, (2) connecting via a provider with a data processing agreement, (3) building the opt-in process and privacy documentation, (4) integrating the AI agent and testing with real scenarios. How long it takes depends mainly on verification with Meta and the scope of the integration.
Is WhatsApp AI worth it despite Meta's fees?
It depends on your message mix. Since 1 October 2026, replies in the service window also cost money once a phone number sends more than 1,000 service messages a month; below that they stay free. Marketing messages are the most expensive. So calculate with your expected share of service, utility and marketing messages and set the fees against the value of an answered enquiry. That an AI agent for your own customers is permitted on WhatsApp at all, and what the channel is good for in sales, is covered in the article on WhatsApp Business API and AI in sales.
How channel fees fit into the total cost of an automation, with setup, operation and hidden costs, is set out in What does AI automation cost in 2026?.
Frequently asked questions about WhatsApp Business API cost and GDPR
What does the WhatsApp Business API cost per month?
It depends on two separate blocks. The service provider charges for setup and operation, usually as a one-off amount plus a monthly fee. On top come Meta's usage-based message fees, which apply with any provider because Meta charges them directly. A comparable quote calculates them for your expected volume.
Is the free WhatsApp Business App GDPR-compliant?
Usually not for business use: if access is granted, it matches the phone numbers in the device's address book with WhatsApp, including those of contacts who never agreed to this, and no data processing agreement exists for that use. As a rule, only the official Business API with a data processing agreement is a sound basis.
How does Meta bill the WhatsApp Business API?
Since 1 July 2025 per delivered message rather than per conversation, tiered by category (Marketing, Utility, Authentication, Service) and recipient country. Since 1 October 2026 Meta charges for service messages again, that is, free-form replies within the 24-hour customer service window: the first 1,000 per phone number and month are free, after that every reply is charged. Utility templates within the service window have been charged again since then as well.
What does a WhatsApp message cost in Germany?
According to Meta's euro rate card effective 1 October 2026, a marketing message costs 0.1131 euros, a utility, authentication or service message 0.0456 euros. The first 1,000 service messages per phone number and month are free; volume discounts for utility and authentication only start at 100,001 and 300,001 messages a month respectively.
Do I need a dedicated number for the WhatsApp Business API?
Yes, a dedicated number is registered and your business is verified with Meta. The service provider connecting the API usually handles both; make sure the WhatsApp Business account belongs to your company.
Am I allowed to send marketing via WhatsApp?
Yes, with documented consent. Under Section 7(2) of the German Unfair Competition Act (UWG), advertising by messenger generally requires prior express consent, and Meta's Business Policy requires opt-in before a business contacts someone. Promotional messages fall into the Marketing category, which Meta usually charges at the highest rate.
What has to be in the data processing agreement for the WhatsApp Business API?
Article 28(3) GDPR sets the mandatory content: subject matter and duration, nature and purpose of processing, types of data and categories of data subject, instruction binding, confidentiality, technical measures under Article 32, sub-processors including a change procedure, duties to assist with data subject requests, deletion after the contract ends, and audit and evidence rights. The practically most important item is the list of sub-processors: a provider that will not disclose it makes it impossible for you to meet your own accountability obligation under Article 5(2).
With a European provider, does the data really stay in the EU?
Only partly, and this is often misrepresented. The service provider's own infrastructure can run entirely in the EU. The message itself, however, always travels through Meta's infrastructure, which is not confined to the EU: the contracting party is regularly an Irish Meta entity, but processing also takes place in the United States. The transfer relies on the adequacy decision for the EU-US Data Privacy Framework or, additionally, on standard contractual clauses. This third-country transfer belongs in your record of processing activities.
May I use an AI chatbot for my customers on WhatsApp?
Yes. Since 15 January 2026, Meta's terms restrict only providers whose main product is a general-purpose AI assistant, and even those have been allowed again in Germany since 11 March 2026; an AI agent serving your own customers was never affected, according to Meta. Since 1 October 2026, its free-form replies within the service window are charged from the 1,001st message per phone number and month. What exactly the rule covers and how the European Commission is reviewing it is set out in the article on WhatsApp and AI in sales.
Sources
- Meta: WhatsApp Business Platform Pricing
- European Union (2016): General Data Protection Regulation (GDPR)
- Meta for Developers: Pricing on the WhatsApp Business Platform, updated 30 Sep 2026, with the rate cards per currency effective 1 October 2026
- WhatsApp: Business Policy
- German Unfair Competition Act: Gesetz gegen den unlauteren Wettbewerb (UWG), Section 7
About the author
Michael Kaiser
Founder and owner of ArkeonTech, Aalen
Business informatics graduate (DHBW Heidenheim) with a bachelor's degree in Business Analytics from Aalen University, previously several years as an ERP consultant for mid-sized companies in Baden-Württemberg. He has run ArkeonTech in Aalen since September 2025.
Matching ArkeonTech service
WhatsApp AI for business
Answer enquiries automatically, qualify leads and book appointments - via the official WhatsApp Business API.
More Articles
-
AI Policy in the Company: What It Must Contain for ChatGPT and Co. to Be Used Safely
42 percent of companies observe or suspect private AI accounts at work, only 23 percent have binding rules. What the German Trade Secrets Act requires, which ChatGPT version tolerates which data, what belongs in an AI usage policy, when the works council has a say and why a company account replaces the ban.
-
AI Disclosure Duty: What Has Applied Since 2 August 2026
Since 2 August 2026, Article 50 of the EU AI Act applies: chatbots, voice bots and AI assistants must identify themselves. What that requires in practice, why running systems get no grace period, and why the Omnibus postponement does not cover it.
