They WhatsApp’d us once. Can we broadcast later?

One enquiry is not consent to all direct marketing. Promotion needs consent and an opt-out. Check the PCPD’s direct-marketing guidance for the wording.

Can the AI agent send by itself?

Price, promises, and promotions should wait for a person. Auto-send only fits a short reply you have already written, with no new promotion inside it.

08 / 15·PDPO, cross-border data, and private AI

WhatsApp AI support and CRM: personal data and direct marketing

16 October 2026

Direct answerUsing AI to help answer a WhatsApp enquiry the customer started is not the same as promoting a new product to them. The reply must still respect purpose and security. Direct marketing needs consent and a way to opt out. Pouring the whole chat into a CRM and broadcasting is a new purpose. A price question is not consent to every future promotion.

Separate the enquiry from the promotion

If a customer asks about shipping, AI may draft the reply and a person sends it. A later push for a new course or discount is direct marketing. Keep the list, the consent record, and the opt-out apart from the support thread.

What belongs in the CRM

Keep stage, owner, next step, and the tags you will act on. Do not sync ID numbers and full addresses to every sales login by default. Have a retention rule for chat logs. This article does not state a number of days as law.

AI drafts

A draft can speed the reply. A person still presses send. The model should not add “here is a new product” unless that customer has already consented to promotion.

Questions

They WhatsApp’d us once. Can we broadcast later?: One enquiry is not consent to all direct marketing. Promotion needs consent and an opt-out. Check the PCPD’s direct-marketing guidance for the wording.
Can the AI agent send by itself?: Price, promises, and promotions should wait for a person. Auto-send only fits a short reply you have already written, with no new promotion inside it.

This article is general information, not legal advice. PCPD guidance changes — check the latest version before you rely on it.

Want a first look at whether one real workflow touches personal data? Book a 1-hour business diagnosis.

Book a 1-hour diagnosis