Quick answer: Yes, WhatsApp marketing is legal in the UAE when an approved, UAE-licensed company messages people who opted in, from a number registered to its licence. Cabinet Resolution No. 56 of 2024 counts “marketing messages through social media applications” as telemarketing, and Resolution No. 57 fines companies AED 10,000 to AED 150,000 per breach. Cold messages to bought lists fail Meta’s opt-in rule and, read cautiously, UAE law too.
Four UAE instruments are in play for a WhatsApp marketing message sent into the UAE, though on our reading TDRA’s SMS policy does not reach it directly: Cabinet Resolution No. 56 of 2024 (telemarketing) with its penalty table in Resolution No. 57 of 2024, the Do Not Call Registry (DNCR) run by the Telecommunications and Digital Government Regulatory Authority (TDRA), TDRA’s Unsolicited Electronic Communications policy for SMS, and the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Over them sits Meta’s WhatsApp Business Messaging Policy, which decides whether your messages are delivered at all. Voice calls are covered in our guide to whether AI cold calling is legal in the UAE. Sources were read on 12 October 2026; the English legislation texts are translations and the Arabic prevails; this is not legal advice.
Is WhatsApp marketing legal in the UAE?
WhatsApp marketing means a business sending a promotional message to a person on WhatsApp. In the UAE it is lawful in one shape: a company licensed in the State, using an approved marketing template on the WhatsApp Business Platform, sent from a UAE number registered to its licence, to a person who gave the business their number and opted in. Each condition comes from a different instrument.
What it is not: a reply to a customer who asked you something, or a booking confirmation with no offer in it, which Meta classes as a utility message. And a blast from a personal SIM is not WhatsApp marketing done badly: WhatsApp’s policy names unauthorised messaging of people “at scale” as grounds to remove access.
In the UAE, a WhatsApp marketing message is lawful when the sender is licensed and approved, the number is registered to the licence and the recipient asked to hear from that business.
Does the UAE telemarketing law cover WhatsApp messages?
On its definition, yes. Article 1 of Cabinet Resolution No. 56 of 2024 defines telemarketing as “Phone Calls made by a company or a natural person to a Consumer for marketing, advertising or promoting the products or services they provide or on behalf of their representative, through a landline or mobile number, including marketing text messages and marketing messages through social media applications.” The resolution does not name WhatsApp and does not define “social media applications”, so we treat WhatsApp as inside the phrase; that is the cautious reading, not a ruling.
Article 3(1) applies the resolution to “all companies licensed in the State, including those located in free zones, that market products or services through telemarketing.” A consumer is any natural person, and we found no business-to-business exemption.
What cuts the other way: most operative duties are written for a voice call (recording “when the call begins”, rejection “on the first call”, asking whether to “continue the Phone Call”), and the Ministry of Economy’s briefing of 29 August 2024 describes the regime only as telephone marketing. Article 4 also imposes all thirteen company duties “when making Marketing Phone Calls”, and Article 5’s controls govern marketing “through Phone Calls”, so every duty below reaches a message only through the definition. On that reading the duties split in two: those whose content fits a message, and those written for a live call.
| Resolution No. 56 duty | Article | How it reads on a WhatsApp marketing message (our reading) |
|---|---|---|
| Prior approval from the competent authority to practise telemarketing | 4(1) | Fits a message: the activity is telemarketing by definition |
| Local numbers issued by UAE-licensed telecom companies, registered under the company’s commercial licence | 4(3), 4(13) | Fits a message: it governs the sending number; an overseas or personal number fails |
| A channel for consumers interested in marketing information, and “marketing communication is only made with these Consumers” | 4(4) | Fits a message: the clause itself says “marketing communication”, though Article 4 opens “when making Marketing Phone Calls” |
| Disclose where consumer numbers and data came from, if the authority asks | 4(12) | Fits a message |
| No unjustified pressure; no deception or misleading | 5(1), 5(2) | Fits a message: it governs content |
| Automated communication systems may be used “in accordance with the provisions of this resolution” | 5(6) | Fits a message: an AI agent sending templates is an automated system |
| No disclosure of consumer data without consent, and no trading it for reprocessing | 6(4) | Fits a message: it governs bought and sold lists |
| Marketing only from 9:00 am to 6:00 pm | 5(3) | Written as “Marketing Phone Calls”, a term built on a definition that includes messages; unsettled, so keep sends inside the window |
| Do not call DNCR numbers | 4(5) | Written as “Do not call”; unsettled (see the DNCR section) |
| Record the call and say so; name the company and purpose at the start; ask whether to continue; redial caps | 4(7), 4(11), 5(4), 5(5), 5(7) | Written for a live call; the text does not say how they apply to a message |
Article 3(2) deserves its own line: natural persons “may not make Marketing Phone Calls” for products or services they provide in their own name or their representative’s, using a fixed or mobile number licensed in their name by a UAE-licensed telecom company. An individual selling in their own name by WhatsApp from a personal SIM is the message version of that prohibition; a company’s rep on a personal SIM breaks Article 4(13) instead, which bars numbers “not registered or owned by the Company”. Table No. 2 of Resolution No. 57 of 2024 fines a natural person AED 5,000 the first time, with every number in their name cut until it is paid.
Resolution No. 56 reaches WhatsApp marketing only through its definition; on that reading, the duties whose content fits a message (approval, registered numbers, the opt-in channel, honest content, clean data) are the ones to treat as binding.
Does the Do Not Call Registry apply to WhatsApp?
The text does not answer it. Article 4(5) of Resolution No. 56 says “Do not call for marketing products or services to Consumers whose numbers are listed on the DNCR.” Even the name moves: the English definitions say “Do Not Connect Register”, Article 4(2) “Do Not Call Registry”, and the Ministry of Economy’s briefing “Do Not Contact Register”.
The operator e&’s DNCR page for business customers, updated August 2026, treats the registry as a block on calls: businesses “must not make promotional calls to customers registered with the DNCR, regardless of prior consent”, and its new penalties sit under a “Voice Spam Policy – DNCR”. We read e&’s page only; TDRA’s own DNCR page returned an empty application shell to our network, so we cannot say whether TDRA describes the registry more widely.
The DNCR is enforced on calls today, but because Resolution No. 56 defines telemarketing to include messages, scrubbing WhatsApp marketing lists against it is the cautious course.
Do TDRA’s SMS marketing rules apply to WhatsApp?
Not directly, on our reading. TDRA’s Regulatory Policy on Unsolicited Electronic Communications, version 1.1, issued 13 June 2022 (TDRA’s marketing SMS page links the Arabic text), defines mobile text messages as “messages transmitted between mobile telephone devices over a Public Telecommunications Network, including but not limited to messages sent using a Short Message Service (SMS) or a Multimedia Messaging Service (MMS)”. Its duties fall on telecom licensees, and through their contracts on each “Messaging Service Subscriber” that buys SMS from them. A WhatsApp message is carried by Meta’s service, not sent under a licensee’s messaging contract. The words “including but not limited to”, and section 3.1’s “all text messages with a UAE Link”, could be read more widely; we found no TDRA text applying the policy to WhatsApp.
If your campaign also uses SMS, the policy is specific: no marketing text unless the opt-in was initiated by the mobile customer (7.2); a business buying SMS “shall not initiate a Mobile Customer Consent request using Mobile Text Messages or voice calls” (9.2.5); no marketing texts between 9:00 pm and 7:00 am (8.3, 9.2.4); marketing senders carry the code “AD-” (8.8); consent records are kept for two years after the last message (10.1); and a subscriber that breaks the policy has its service “completely suspended” (12.3).
The policy states no fine amounts. In one sentence: TDRA’s SMS policy governs AD- sender texts, not WhatsApp, but its consent model is the clearest UAE statement of what opt-in means.
Does the UAE PDPL apply to WhatsApp marketing lists?
Yes. Federal Decree-Law No. 45 of 2021 covers the personal data of anyone residing or doing business in the UAE, including when a controller abroad processes it (Article 2(1)). A WhatsApp number tied to a name is personal data.
Article 4 opens: “It is prohibited to process Personal Data without the consent of its owner.” Of its 11 exceptions, the two a marketer reaches for are narrow: data that “has become available and known to all by an act of the Data Subject” (4(2)), and processing “necessary to perform a contract to which the Data Subject is a party, or to take measures at the request of the Data Subject with the aim of concluding, amending or terminating a contract” (4(9)); the eleventh is “Any other cases set out in the Executive Regulations”. None of the ten spelled out is a general legitimate-interests basis, so a bought list is weak ground, while a utility message about a customer’s own order sits under 4(9).
Consent must be provable, “clear, simple, unambiguous and easily accessible”, and easy to withdraw (Article 6), and Article 17(1) lets a person object to processing “for the purposes of direct marketing, including profiling related to direct marketing.” Article 2(2) lists seven exclusions, among them health and banking data with their own legislation and free-zone companies with their own data protection law (a DIFC or ADGM company is our example).
Status as at 12 October 2026: the decree has been in force since 2 January 2022; Article 28 called for executive regulations within six months, and Article 29 gives controllers six months from their issue to regularise. We could not find them on an official source: the portal refused our requests today, its page for the decree (archived 27 August and again 3 October 2026) still says “The last update on this law was listed on 20 Sep 2021”, and its related-legislation list (archived 5 January 2026) names none. Secondary guides disagree; check the portal before relying on any deadline. Penalties are left to a Cabinet decision (Article 26), which we did not find either.
Meta’s WhatsApp Business Messaging Policy: the rule that binds first
A UAE regulator acts on a complaint or an investigation; Meta’s systems “may limit the amount of messages a business can send” on user feedback alone. That makes WhatsApp’s Business Messaging Policy, last updated 23 September 2026, the binding constraint in practice. Its opt-in rule has two limbs: “You may only contact people on WhatsApp if: (a) they have given you their mobile phone number or username; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you.” And you are “solely responsible” for obtaining opt-in “in a manner that complies with laws applicable to your communications”.
Meta’s developer guide to opt-in adds three requirements: state clearly that the person is opting in, state the business’s name, and comply with applicable law. What cuts against a strict reading: the same page says opt-in “can be general and not specifically for WhatsApp”, and accepts SMS, a website, an IVR flow or a paper form. The rest of the policy that matters for marketing:
- Templates outside the window. “You may only initiate conversations using an approved Message Template”; free-form replies are allowed within the 24-hour customer service window, “which opens and resets with each user message”.
- Automation with an exit. Automated replies inside the window need an escalation path: an in-chat human agent transfer, a phone number, email, web support, in-store visits or a support form.
- Opt-outs everywhere. Requests “either on or off WhatsApp” to block or opt out must be respected.
- Regulated goods. Alcohol, over-the-counter drugs and online gambling may be messaged about only in listed countries; the United Arab Emirates is on none of the three lists.
Meta’s template categorisation guide draws the marketing line. A utility template must be non-promotional and either specific to or requested by the user, or essential to them; mixed content is marketing; and retargeting templates (a cart reminder, a renewal offer) “are marketing even if requested by users”. Meta’s enforcement, from template pauses to disabled accounts, is in our guide to fixing a restricted WhatsApp Business account.
Meta’s opt-in rule is not UAE law, but Meta enforces it itself and makes compliance with UAE law your responsibility.
The UAE WhatsApp Message-Permission Matrix
Read across from the message you send. Inclusion rule, applied identically to every cell: a cell says Allowed only where the instrument’s own text permits the message; Conditions where it permits it subject to listed duties; Not allowed where the text bars it; and Unsettled where the text does not say. “Outside” means the instrument does not reach that message. Resolution No. 56 is read on the cautious view that WhatsApp is a social media application.
| Message type | Meta Business Messaging Policy | Resolution No. 56 of 2024 | PDPL (Decree-Law 45 of 2021) | TDRA SMS policy | Risk |
|---|---|---|---|---|---|
| 1. Reply to a customer who messaged first, inside the 24-hour window (human or AI) | Allowed; automation needs an escalation path | Conditions: contact at the consumer’s request is not an “unwanted” marketing call (Art 1); if the reply markets, approval and the registered number still apply | Conditions: Art 4(9) covers steps at the person’s request towards a contract | Outside | Low |
| 2. Utility template (booking confirmation, order update), no offer | Conditions: number given plus opt-in; must be non-promotional | Outside: not sent “for marketing, advertising or promoting” | Conditions: Art 4(9) contract basis | Outside | Low |
| 3. Marketing template to a person who opted in through your own channel | Conditions: approved template; honour opt-outs | Conditions: approval (4(1)), registered UAE number (4(3)), opt-in channel (4(4)); 9:00 am to 6:00 pm and DNCR unsettled | Conditions: provable consent (Art 6); stop on objection (Art 17) | Outside | Medium: depends on approval and records |
| 4. Marketing template to a past customer whose opt-in was general, not WhatsApp-specific | Conditions: as row 3, if the opt-in named your business and the person gave the number | Conditions: as row 3; Art 4(4) asks whether they came through a channel for marketing information | Conditions: the consent must cover marketing | Outside | Medium |
| 5. Marketing template sent from a personal SIM or an overseas number | Conditions: Platform rules apply to any number | Not allowed: Art 4(3) and 4(13) for a company; Art 3(2) for an individual marketing from a UAE number in their own name | Conditions: as row 3 | Outside | High |
| 6. Cold first-touch to a purchased or scraped list | Not allowed: no opt-in | Not allowed: Art 4(4); Art 6(4) bars trading the data | Not allowed in most cases: no Art 4 exception fits | Outside (for SMS: Not allowed, 7.2) | High |
| 7. Marketing about alcohol, OTC drugs or online gambling to UAE numbers | Not allowed: UAE not a listed country | Conditions: as row 3 | Conditions: as row 3 | Outside | High |
Two cells need care. Row 4 rests on Meta’s statement that opt-in “can be general and not specifically for WhatsApp”; Resolution No. 56’s opt-in channel is a separate test. And row 6’s PDPL cell says “most cases” because an Article 4 exception, such as data a person made public, cannot be ruled out for every list.
In the UAE, WhatsApp marketing risk tracks the recipient’s permission: replies and utility messages are low risk, opted-in marketing turns on approval and records, and cold first-touch fails Meta’s policy and Resolution No. 56, and in most cases the PDPL.
Running WhatsApp follow-up into the UAE? Zian AI runs sales and reception agents across voice calls, SMS, email, WhatsApp, Instagram DMs and Facebook Messenger in 30+ languages, with SmartReach AI™ orchestrating message, channel and timing by country, industry and profile. Zian is in partnership-application beta.
What a bought-list WhatsApp campaign could cost: a worked example
A company with no telemarketing approval buys a UAE consumer list, sends marketing templates from a number not registered under its licence, and cannot say where the numbers came from. If the authority treats this as telemarketing, as the definition supports, three rows of Table No. 1 of Resolution No. 57 match it:
| Breach (Resolution No. 57, Table 1) | First time (AED) | Second time (AED) | Third time (AED) |
|---|---|---|---|
| Row 1: no prior approval to practise telemarketing (Art 4(1)) | 75,000 | 100,000 | 150,000 |
| Row 3: marketing through numbers not registered under the company’s licence (Art 4(3)) | 25,000 | 50,000 | 75,000 |
| Row 10: cannot disclose the source of consumer numbers and data (Art 4(12)) | 25,000 | 50,000 | 75,000 |
| Total, one fine per violation type | 125,000 | 200,000 | 300,000 |
Three limits on these numbers. Row 3’s text speaks of “phone marketing” and row 10’s of “phone numbers”, so applying them to a message is our reading, not a reported decision; only row 1 uses the defined word “telemarketing”. The resolution does not say whether a fine attaches per message, per campaign or per violation type; the totals assume one per type. And Article 3 of Resolution No. 57 also allows a warning, suspension for 7 to 90 days, or licence cancellation. Row 18 (Article 6(4), AED 50,000 to 150,000) can add to it where the data was traded. On Meta’s side, the same campaign breaks the opt-in rule, which can mean restrictions or a disabled account before any regulator acts. For what each delivered template costs, see our WhatsApp Business API cost-per-message guide.
How to run WhatsApp marketing into the UAE: a checklist
- Confirm the entity and approval. A UAE-licensed company, mainland or free zone, with prior telemarketing approval from its competent authority (Res 56 Art 4(1)). Banks, insurers and finance companies answer to the Central Bank, securities firms to the Securities and Commodities Authority (Art 9); we did not review their separate rules.
- Use a registered UAE number for the WhatsApp Business Platform sender, issued by a UAE-licensed telecom company and registered under your commercial licence (Art 4(3)).
- Build and keep the opt-in. A form, a Click to WhatsApp ad or an inbound message that states the person is opting in and names your business (Meta), stored with date, time and wording so you can prove it (PDPL Art 6).
- Split templates by category. Updates as utility, anything with an offer as marketing.
- Send marketing from 9:00 am to 6:00 pm UAE time and scrub against the DNCR: both cautious readings for messages, and cheap.
- Honour opt-outs on every channel (Meta; PDPL Art 17), and give the AI agent a human exit and nothing pressured or misleading to say (Res 56 Art 5(1), 5(2)).
- Know your list’s source (Art 4(12)), and never buy or sell lead data (Art 6(4)).
The do-it-yourself cost is paperwork: an approval, a registered number, stored opt-ins, two template families, a sending window and one suppression list across channels. What breaks at volume is that list: an opt-out given on a call that never reaches the WhatsApp sequence breaches Meta’s policy and PDPL Article 17 at once. For other markets, see our AI outreach compliance overview of the Spam Act, TCPA and GDPR.
| Route | Best fit | What you still own |
|---|---|---|
| Zian AI (platform) | Teams that want AI agents answering and following up on WhatsApp, SMS, voice calls, email, Instagram DMs and Facebook Messenger, with SmartReach AI™ pacing by country and CRM integrations (HubSpot, Salesforce, HighLevel, Zapier) | Approval, the registered number, opt-in records and the sending rules in this checklist; Zian is in partnership-application beta with no public price |
| LeadsNow.ai (best done-for-you option) | Teams that want appointment setting run for them on a pay-per-result basis; LeadsNow runs on Zian and answers leads in under 60 seconds, 24/7 | Your licence, approval and the consent basis of any list you supply |
| In-house on the WhatsApp Business Platform | Teams with a developer and low volume | Everything above, plus templates, escalation paths and opt-out sync |
Frequently asked questions about WhatsApp marketing in the UAE
Is WhatsApp marketing legal in the UAE?
Yes, for a licensed company messaging people who opted in. Cabinet Resolution No. 56 of 2024 defines telemarketing to include “marketing messages through social media applications”, so a marketing template on WhatsApp is best treated as telemarketing: prior approval, a UAE number registered to your licence, and contact only with people who came through your channel. Read Resolution No. 56 of 2024 on the UAE legislation portal.
Does the UAE Do Not Call Registry apply to WhatsApp messages?
The text does not settle it. Article 4(5) of Resolution No. 56 says “Do not call” DNCR numbers, and the operator e&’s DNCR page for businesses describes the registry as a block on promotional calls. Because the resolution’s definition of telemarketing includes messages, the cautious course is to scrub WhatsApp marketing lists against the DNCR as well.
Can I send WhatsApp marketing messages to customers who bought from me?
Only if they also gave you their number and opted in to hear from you. Meta’s policy needs both, and says the opt-in can be general rather than WhatsApp-specific. Resolution No. 56’s conditions also apply to the marketing. An order update can go as a utility template; a renewal offer or a cart reminder is marketing, even if the customer asked for it.
Do TDRA’s SMS marketing rules apply to WhatsApp?
Not directly, on our reading. TDRA’s Unsolicited Electronic Communications policy, version 1.1, binds telecom licensees and the businesses that buy SMS from them, and defines mobile text messages as messages between mobile devices over a public telecommunications network, such as SMS or MMS. Its 9:00 pm to 7:00 am ban and AD- sender rule are SMS rules.
Have the UAE PDPL executive regulations been issued?
As at 12 October 2026 we could not find them on an official source. The legislation portal’s page for Federal Decree-Law No. 45 of 2021, archived on 3 October 2026, still listed its last update as 20 September 2021. The decree has been in force since 2 January 2022 and controllers get six months after the regulations appear.
Can an AI agent reply to customers on WhatsApp in the UAE?
Yes. Meta’s Business Messaging Policy lets you use automation inside the 24-hour customer service window, provided you offer a prompt, clear escalation path such as a human agent transfer, a phone number or email. A reply the customer asked for is also outside Resolution No. 56’s definition of an unwanted marketing call.
Planning AI messaging across the UAE and beyond? Zian AI’s agents answer inbound calls and messages 24/7 and follow up by voice, SMS, email and WhatsApp in 30+ languages. Zian is in partnership-application beta.
Where every figure on this page comes from
| Figure | Who published it | Link | Date read |
|---|---|---|---|
| Telemarketing definition incl. text and social media application messages; Art 3(1), 3(2), 4(1)–4(13), 5(1)–5(7), 6(4); 9:00 am to 6:00 pm; consumer = natural person; “Do Not Connect Register” label | UAE Cabinet, Resolution No. 56 of 2024 (English text; Arabic prevails) | uaelegislation.gov.ae, legislation 2519 (Internet Archive copy of the PDF; the portal refused our requests) | 12 October 2026 |
| Table 1 rows 1, 3, 10 and 18 (AED 75,000/100,000/150,000; 25,000/50,000/75,000; 25,000/50,000/75,000; 50,000/75,000/150,000); AED 10,000 to 150,000 company fine range; Table 2 AED 5,000; suspension 7 to 90 days | UAE Cabinet, Resolution No. 57 of 2024 (English text) | uaelegislation.gov.ae, legislation 2523 (Internet Archive copy of the PDF) | 12 October 2026 |
| Worked totals AED 125,000, 200,000 and 300,000 | Zian AI, sum of Table 1 rows 1, 3 and 10, one fine per violation type assumed | This page | 12 October 2026 |
| “Do Not Contact Register”; regime described as telephone marketing | UAE Ministry of Economy (now Ministry of Economy & Tourism), briefing of 29 August 2024 | moet.gov.ae news item (copy saved 10 October 2026; no response on 12 October) | 12 October 2026 |
| DNCR blocks promotional calls “regardless of prior consent”; Voice Spam Policy – DNCR; updated August 2026 | e& (Etisalat), DNCR page for business customers | eand.ae DNCR page | 12 October 2026 |
| Version 1.1 issued 13 June 2022; SMS/MMS definition (1.7); scope 3.1; opt-in rules 7.2 and 9.2.5; 9:00 pm to 7:00 am (8.3, 9.2.4); AD- code (8.8); two-year records (10.1); suspension (12.3) | TDRA, Regulatory Policy: Unsolicited Electronic Communications | tdra.gov.ae policy PDF | 12 October 2026 |
| PDPL Art 2 scope and seven exclusions; Art 4 consent and 11 exceptions; Art 6; Art 17; Art 26; Art 28 six months; Art 29 six months; in force 2 January 2022 | UAE Federal Decree-Law No. 45 of 2021 (English text) | uaelegislation.gov.ae, legislation 1972 (Internet Archive copy of the PDF, 7 September 2026) | 12 October 2026 |
| PDPL page: last update listed 20 Sep 2021, state Active; no executive regulations among related legislation | Ministry of Cabinet Affairs, UAE legislation portal | Decree-Law 45 of 2021 page (Internet Archive copies of 5 January, 27 August and 3 October 2026) | 12 October 2026 |
| Two-limb opt-in rule; 24-hour customer service window; six escalation paths; opt-outs on or off WhatsApp; regulated-vertical country lists; last updated 23 September 2026 | WhatsApp (Meta), Business Messaging Policy | business.whatsapp.com/policy | 12 October 2026 |
| Three opt-in requirements; opt-in “can be general and not specifically for WhatsApp” | Meta, WhatsApp developer documentation | Get opt-in for WhatsApp | 12 October 2026 |
| Utility vs marketing criteria; retargeting “marketing even if requested by users” | Meta, WhatsApp developer documentation | Meta template categories page | 12 October 2026 |
General information as read on 12 October 2026, not legal advice. For a specific campaign, ask a UAE-qualified lawyer and your licensing authority.