This is general information, not legal advice. Check the current rules with the relevant authority or your adviser.
WhatsApp marketing compliance in the UAE comes down to four layers: Meta’s own WhatsApp policies, the UAE personal data protection law, the national telemarketing rules and any rules for your sector. If you collect clear permission, identify your business, respect opt-outs and keep records, you cover most of what these layers ask of a small business.
This guide sets out each layer and finishes with a checklist you can use before every campaign. Each topic has its own detailed article, linked below.
In this guide
- UAE PDPL basics for small businesses
- WhatsApp opt-in rules: getting permission right
- UAE telemarketing rules and WhatsApp messages
- Handling WhatsApp opt-outs and STOP requests
- Using AI with customer data: a checklist
- UAE e-commerce law: key points for online sellers
- Staff access and roles: protecting customer chats
The four layers of rules
| Layer | Who sets it | What it mainly covers |
|---|---|---|
| Platform policy | Meta (WhatsApp Business Messaging Policy) | Opt-in, opt-out, business identity, message quality |
| Data protection | UAE federal law (Federal Decree-Law No. 45 of 2021), plus free-zone laws such as DIFC’s | Consent, customer rights, security of personal data |
| Telemarketing | UAE Cabinet Resolutions Nos. 56 and 57 of 2024 | Consent, permitted hours, identity, records, the Do Not Call Registry |
| Sector rules | Health and property regulators, among others | Advertising claims and how you may contact people |
The layers overlap. A campaign that passes Meta’s checks can still break a local rule, and the reverse is also true. Treat the strictest applicable rule as your standard.
Consent and opt-in
Consent is the foundation of every layer. Meta’s WhatsApp Business Messaging Policy says you may contact people only if they have given you their number and you have received opt-in permission from them.
Meta’s developer guidance on getting opt-in for WhatsApp adds that businesses must clearly state that a person is opting in to receive communication, must clearly state the business’s name, and must comply with applicable law.
On the local side, the UAE government’s data protection laws page explains that the PDPL prohibits processing personal data without the owner’s consent, except in some cases. Our PDPL basics article covers the other lawful bases.
A clear opt-in line on a website form might read:
“Yes, I would like to receive offers and updates from Bloom Spa on WhatsApp. I can reply STOP at any time.”
The WhatsApp opt-in rules article includes Arabic wording and accepted methods.
Timing and identity
The UAE telemarketing rules are mostly about calls, but they reach further. Middle East Briefing’s summary of Cabinet Resolutions Nos. 56 and 57 of 2024 reports that the regulations extend to marketing text messages and promotional messages sent via social media platforms, and that calls are permitted between 9:00 a.m. and 6:00 p.m.
The same summary reports that companies must clearly identify themselves and the purpose of their communication. On WhatsApp, that means:
- Your verified business name and profile, with contact details, on the number you send from.
- The business name in the first line of every marketing template.
- Marketing sends scheduled within daytime hours. Many businesses keep campaigns inside the 9:00 a.m. to 6:00 p.m. window as a cautious default.
The detail is in our article on the UAE telemarketing rules.
Opt-outs and records
Meta’s policy requires businesses to respect all requests, on or off WhatsApp, to block, discontinue or otherwise opt out of communications. A customer who says “stop” by phone, email or in the shop has opted out of WhatsApp marketing too.
Good practice for a small team:
- Offer an opt-out in every marketing template, such as a “Stop promotions” button or “Reply STOP”.
- Apply the opt-out to every list and every staff member’s sends, not just the campaign it came from.
- Keep a record of when and how each person opted in and out.
- Check numbers against the Do Not Call Registry where the telemarketing rules require it.
Easy opt-outs also protect your number. Customers who cannot find the exit tend to block or report, which can lower your quality rating. See handling WhatsApp opt-outs and STOP requests.
Records also include who in your team can see customer chats. Our article on staff access and roles explains how to limit access, and the AI and customer data checklist covers questions for any AI provider.
Sector rules: health and property
Healthcare. Clinics in the UAE are subject to health-authority rules on advertising and patient information. Keep messages factual, avoid claims about results, do not share patient details in marketing lists and route clinical questions to clinicians. Medical emergencies go to 999 or 998, never to a WhatsApp chat.
Real estate. Property regulators restrict unsolicited calls and messages. Focus WhatsApp on replying quickly to inbound enquiries from portals, ads and your website, rather than sending broadcasts to lists of property owners.
Online selling. If you take orders in chat, the consumer rules for online sales apply. Our summary of the UAE e-commerce law covers clear terms, returns and records.
A compliance checklist
Use this before every campaign:
- Every recipient opted in to WhatsApp messages from your business, and you can show when and how.
- Imported contacts were checked for consent before they were added to a list.
- Anyone who opted out, on any channel, is excluded.
- The template names your business and states the purpose of the message.
- The send is scheduled within daytime hours.
- The message contains an easy opt-out.
- Claims are factual: no guarantees, no medical outcomes, no unapproved prices.
- Only staff who need access can see the replies.
- You keep a record of the campaign: list, template, date and opt-outs received.
- If you are in a free zone with its own data protection law, you have checked which law applies.
How Dub Ai helps
Dub Ai is built around the habits on this checklist. Broadcasts use approved WhatsApp templates sent to contact groups the Dub Ai team sets up with you, and contacts who ask not to receive messages are excluded from future sends. Imported contacts must have agreed to hear from you before they receive campaigns. Your Dub Ai assistant asks you to confirm before sending a broadcast, and you can ask for delivery and read figures afterwards.
On access, the team roles and permissions feature gives each person a role, protects admin actions with a password and keeps an activity log. You can see the kind of work we do for clinics and shops in our case studies.
Frequently asked questions
Is WhatsApp marketing legal in the UAE?
Yes, when it follows the rules. Use the official WhatsApp Business Platform, send only to people who opted in, identify your business, respect opt-outs and follow the telemarketing rules on timing and consent. Sector regulators such as health and property authorities may add their own limits, so check those as well before running campaigns.
Do free-zone companies follow the same rules?
Partly. Meta’s policy applies to every business on WhatsApp. For data protection, some free zones, such as DIFC, have their own data protection law, and companies there follow that regime rather than the federal PDPL. Telemarketing rules and sector rules may still apply. Confirm your position with your free-zone authority or adviser.
What are the penalties?
They vary by layer. Meta can restrict or ban a number that breaks its policy. For the telemarketing rules, Middle East Briefing reports fines rising from AED 50,000 for a first violation to AED 150,000 for repeat ones. PDPL penalties are set by executive regulations, so check the current text.
Book your demo on WhatsApp: +971 56 552 6662
One Response