Is Bulk WhatsApp Messaging Legal? KVKK and Meta Rules

The short answer

It would be wrong to say that sending bulk messages on WhatsApp is banned, but it's just as wrong to think it's allowed without conditions. Two separate sets of rules apply at the same time: Meta's platform rules (which decide which message can be sent and how) and Turkey's KVKK (personal data protection law) and commercial electronic message legislation (which decide who you can send to and with what consent).

Meta's own rules

Meta runs three core rules to protect users from unwanted messages:

• The 24-hour rule: if the user hasn't written to you in the last 24 hours, you can only reach them with a pre-approved template message. You can't make first contact with free text.
• The opt-in (consent) requirement: before you add a number to your list, that person must have agreed to receive messages from you. Meta can audit how this consent was collected.
• Quality rating: if recipients often block or report your messages, your number's sending capacity is restricted, and in extreme cases the number is suspended.

Together, these three rules make the "cold messaging a large list of people who haven't consented" model practically impossible. Even if you tried, your number would be restricted quickly.

KVKK and commercial message legislation

In Turkey, commercial electronic messages (campaign, announcement and promotional messages) are regulated under Law No. 6563 on the Regulation of Electronic Commerce and its related regulation. Under it, you need the recipient's prior consent, and consents must be recorded in the İYS (Turkey's commercial message registry). WhatsApp isn't exempt from this rule. Every message that counts as a commercial electronic message falls under the same framework, whatever the channel.

The scope of consent: marketing or notification

Not every WhatsApp message counts as a "commercial message." The distinction is this:

• Marketing / campaign message — a discount announcement, a new product launch, a cart reminder. It requires explicit consent and an İYS record.
• Transactional / service notification — messages that serve an existing relationship, such as an order confirmation, shipment tracking or an appointment reminder. As a general principle, these notifications don't need separate marketing consent, because the customer has already entered a transactional relationship with you for that order or appointment.

In practice, the most common mistake is squeezing a campaign call to action ("check out this product too, 20% off") into an order notification template. That turns the notification into a marketing message and means it needs separate consent.

How it works in practice

In a business WhatsApp API setup, consent management stops being something you track by hand. Who gave consent and when, and who asked to leave your list, is recorded in the system, and anyone who opts out is automatically left out of later sends. These records can be used to show that consent existed in the event of an audit.

Checklist

• Has the person you're sending to given consent, and is it on record?
• Is the message marketing or a transactional notification, and did you pick the right category?
• If a person wants to leave the list, is that request processed automatically?
• For a send that needs an İYS record, have you confirmed the current obligations?