Is bulk messaging on WhatsApp legal? What the LGPD and WhatsApp allow

There are two questions hidden inside one. The first is legal: under Brazilian law, can I send commercial messages in bulk? The answer is generally yes, as long as there is a legal basis to process that contact and the communication respects the consumer. The second is contractual: does WhatsApp, as a private platform, allow me to use the account this way? Here the answer depends a lot on how you send, at what pace and to whom.

Mixing the two up leads to wrong decisions. Some people believe that a "sort of legal" list is enough to blast thousands of messages without consequences, and end up with a banned number because they violated WhatsApp's Terms, not the law. Others stop all communication out of fear of the LGPD, even though they have consent and a relationship with the customer. Both extremes cost money.

The right way to think about it: the LGPD defines whether you have the right to talk to that person. WhatsApp's Terms define whether you can use that specific channel for it, and how. You need to pass both filters at the same time. Passing only one does not protect you from the other.

The LGPD does not forbid marketing by message. It requires a legal basis to process personal data (a phone number and contact history are already personal data). For commercial communication, the most used bases are the data subject's consent and legitimate interest, when there is a reasonable prior relationship, such as a customer who has already bought from you.

Consent under the LGPD must be freely given, informed and unambiguous. In practice this means the person understood they would receive your messages and clearly agreed, whether by ticking a box on a form, asking to be notified, or starting the conversation. A purchased list, a number scraped from a group and a third party's spreadsheet have no legal basis at all, and that is where the real legal risk lives, including complaints and actions with Procon (Brazil's consumer protection agency).

Besides the legal basis, three obligations are often forgotten. First, the right to unsubscribe: every marketing communication must offer an easy way out, and the request to stop must be honored. Second, transparency about who is speaking and why. Third, purpose: you can only use the number for what the person expected, not sell the list or reuse it for completely different campaigns without a new basis. Recording where each contact came from and the date of the opt-in is what saves you in an inspection.

WhatsApp splits the world in two. The official API (WhatsApp Business Platform, via Meta or providers) allows messages at scale, but within strict rules: pre-approved message templates, a 24-hour service window, provable opt-in and per-message pricing. It is the path with the most contractual protection, but also more expensive, more bureaucratic and with content approval that stiffens campaigns.

The regular app and unofficial solutions work on a different logic. WhatsApp's Terms prohibit automated or bulk use outside the official platform, and Meta detects abuse patterns: high volume of identical messages, sends to numbers that never talked to you, many messages in a short time, and above all the block and report rate that recipients generate. When many people mark you as spam, the number is deactivated, regardless of whether your list is legal.

The point almost nobody understands: who decides whether you are spam is not only the algorithm, it is the people who receive the messages. A cold list, even with formal consent, generates reports if the message arrives without context. That is why the conversation about ban risk is less about a "magic tool" and more about number reputation, list quality and sending behavior.

Start with where the list comes from. Send only to people who have a legal basis and some context with you: customers, leads who filled in a form, people who asked to be notified. Keep proof of the opt-in. This takes care of the LGPD layer and, as a bonus, reduces reports, because people who recognize you rarely mark you as spam.

Take care of sending behavior. Warm up the number before sending, respect intervals between messages, vary the text instead of sending exactly the same thing to everyone, and start slowly on a new number. Personalizing with the name and a real reason for contact changes the reply rate and lowers the block rate. For an operational step-by-step focused on this, see the guide on bulk messaging on WhatsApp.

Make unsubscribing easy and honor it right away. A line like "reply STOP to stop receiving messages" already satisfies the LGPD and protects your reputation: it is better to lose a contact than to earn a report. Monitor negative replies and clean the list of people who never interact, because dead numbers and complaints are exactly what Meta uses to ban.

Document everything. A published privacy policy, a consent record, a contact channel for the person responsible for the data and a simple process to handle deletion requests. In a complaint, the difference between a scare and a fine is usually having these records organized.

A tool does not make you legal or immune to bans. Your list and your behavior define that. What good infrastructure does is give you control: sending pace, warm-up, personalization, multiple numbers and visibility into what is happening, so you operate in a way that looks more like human use and react fast when something gets worse.

ZapZap API is an instance-based unofficial WhatsApp API, designed for this kind of controlled operation. The model is prepaid, R$15 per active number per month, with a welcome credit when you create your account, subject to the current campaign. It includes community warm-up for instances, anti-ban features to reduce risk, AI per instance to reply and qualify, and modules and webhooks to integrate with your system. Because it is unofficial, it is more flexible and cheaper than the official API, and for that very reason the responsibility for the list and the behavior is even more yours.

On the technical side, you can plug it into your flow with webhooks. A simple Express handler already receives message events so you can log replies, handle opt-outs and feed your CRM. The exact endpoints and formats are documented in a machine-readable way at api.zapzapapi.com/llms.txt, so it is worth checking the source instead of memorizing routes. Below, an illustrative example of receiving a webhook:

• ```js
• // illustrative example, check api.zapzapapi.com/llms.txt
• import express from 'express';
• const app = express();
• app.use(express.json());
• app.post('/webhook', (req, res) => {
• const evento = req.body;
• // log message, treat 'STOP' as opt-out, update CRM
• res.sendStatus(200);
• });
• app.listen(3000);
• ```

To decide without scares: a list with a legal basis, honored opt-outs, a human pace and a warmed-up number. With that in place, ZapZap API is the infrastructure that gives you control (instances, warm-up, anti-ban and webhooks). The responsibility for the list and the behavior stays with you, and that is what keeps the operation standing.