WhatsApp bulk messaging is legal in the UAE when conducted through Meta's official WhatsApp Business Platform, to recipients who have explicitly opted in, using Meta-approved message templates, and in compliance with Cabinet Resolution No. 56 of 2024. That regulation, enacted in August 2024 and explicitly covering social media messaging, makes commercial WhatsApp outreach a regulated marketing channel in the UAE with the same consent obligations, time restrictions, and penalty exposure as any other direct marketing channel.
Most UAE businesses asking this question have run into one of two situations. Either an account got flagged or suspended after using a third-party tool that bypasses the official API, or they heard this regulation exists and want to know exactly what it requires. This guide covers both layers, Meta's policy and UAE law, working from the current primary sources rather than outdated summaries.
What "Authorized" Bulk Messaging Actually Means
The enforcement clause in WhatsApp's Business Messaging Policy, Section 7, does not say what most people assume. The exact text:
The key word is unauthorized. Meta does not ban bulk messaging. It bans unauthorized bulk messaging. Those are materially different constraints.
Authorized scale messaging through the official WhatsApp Cloud API, to recipients who have given explicit opt-in, using Meta-approved templates, is what the platform is designed for. Meta's Business Solution Providers (BSPs) exist specifically to deliver this at scale. When your business connects through a BSP, creates approved Marketing templates, and sends them to a consent-verified list, you are operating in exactly the space Meta intends.
The unauthorized path looks different: third-party tools that connect to WhatsApp using unofficial clients, automation that harvests numbers from websites or directories, broadcast lists built from purchased databases, or any approach that bypasses Meta's Business Services infrastructure. These violate Meta's terms and, when commercial messages are involved, UAE law.
Zena's WhatsApp bulk broadcasting UAE tool runs on the official Cloud API. Every broadcast goes through Meta's messaging infrastructure, every contact has been imported with consent tracking, and every outbound message uses a Meta-approved template.
The UAE Law That Covers WhatsApp Directly
Most articles about WhatsApp marketing compliance in the UAE cite Federal Law No. 3 of 2003 on Telecommunications or the older TDRA anti-spam policy. These are not the current primary instrument for bulk WhatsApp messaging.
The governing regulation as of 2026 is Cabinet Resolution No. 56 of 2024 Concerning the Telemarketing Regulations, enacted by the UAE Cabinet and in force from 27 August 2024. It is the first UAE regulation to explicitly name social media messaging as telemarketing, and it leaves no ambiguity about WhatsApp.
The definition of Telemarketing in Article 1 reads (from the UAE Legislation Portal, uaelegislation.gov.ae):
WhatsApp is a social media application. That definition directly and explicitly captures commercial WhatsApp outreach. The key obligations under Cabinet Resolution No. 56 of 2024:
- Prior approval: Obtain approval from the competent authority before conducting any telemarketing activity.
- Consent-only contact: Create a channel for consumers who wish to receive marketing; contact only opted-in consumers.
- DNCR compliance: Do not contact numbers registered on the Do Not Call Registry. UAE residents register by texting "DNCR" to 1012. Businesses must scrub contact lists against this registry before every campaign.
- UAE-registered numbers: Use local UAE-registered numbers only. International or VoIP-forwarded numbers do not satisfy this requirement.
- Identity disclosure: Disclose company identity and purpose in every communication.
- Permitted hours: Send only between 9:00 am and 6:00 pm (per Cabinet Resolution No. 56 of 2024).
The Do Not Call Registry is operated by the Telecommunications and Digital Government Regulatory Authority (TDRA). Contacting a registered number is a separate violation with its own penalty, regardless of whether the contact had previously opted in through another channel.
The Penalty Schedule (Cabinet Resolution No. 57 of 2024)
Administrative penalties for violations of Cabinet Resolution No. 56 of 2024 are set in the companion Cabinet Resolution No. 57 of 2024. The following applies to companies. All figures are per Cabinet Resolution No. 57 of 2024.
| Violation | 1st Offence | 2nd Offence | 3rd Offence |
|---|---|---|---|
| Telemarketing without prior approval | AED 75,000 | AED 100,000 | AED 150,000 |
| Contacting a DNCR-listed number | AED 50,000 | AED 75,000 | AED 150,000 |
| Unauthorized disclosure or trading of personal data | AED 50,000 | AED 150,000 | AED 150,000 |
| Telemarketing from unregistered numbers | AED 25,000 | AED 50,000 | AED 75,000 |
| Unethical marketing or excessive follow-ups | AED 10,000 | Up to AED 50,000 | Up to AED 75,000 |
For individuals (natural persons): a first offence carries AED 5,000 and number suspension, a second AED 20,000 and a 3-month suspension, and a third AED 50,000 with a 12-month telecommunications ban. A company can also face suspension of activity (7 to 90 days) or licence cancellation for severe or repeated violations.
Cabinet Resolution No. 57 of 2024 operates alongside additional legal exposure from Federal Decree-Law No. 45 of 2021 (the UAE Personal Data Protection Law, which gives data subjects the right to stop direct marketing processing), Federal Decree-Law No. 34 of 2021 (the Cybercrime Law, covering unauthorized data access and misuse), and Federal Law No. 15 of 2020 (Consumer Protection, prohibiting the use of consumer data for promotion without consent). Multiple laws can apply simultaneously to the same campaign.
Meta's Enforcement Cascade
Meta's enforcement runs in parallel with UAE regulatory risk and can act much faster. The enforcement cascade documented in WhatsApp's Business Messaging Policy Section 7 and Meta's account quality documentation:
- Quality rating downgrade: When block or report rates from recipients exceed Meta's thresholds, the account's quality rating drops to Medium or Low.
- Rate limiting: With a Low quality rating, Meta throttles messaging speed. Broadcast campaigns hit this limit first because they generate the most delivery events in a short window.
- Account restriction: Messaging capability is temporarily suspended.
- Account disabled: Permanent ban from WhatsApp Business Services.
- Legal action: Meta added a civil litigation clause in December 2019. If a business publicly advertises bulk WhatsApp sending capabilities operating outside the official API, Meta can sue based on that off-platform evidence alone.
What triggers quality rating drops: recipients blocking the number, marking messages as spam, or not reading after delivery. High block rates following a broadcast are almost always a list quality problem, meaning non-consenting or irrelevant recipients, rather than a content problem. A broadcast to a clean, opted-in list with relevant content rarely generates significant blocks. A broadcast to a scraped or purchased list generates blocks almost immediately.
This is why compliant bulk messaging is also the strategically smarter path. An opted-in list responds. A non-consenting list blocks. Blocks destroy quality ratings. Low quality ratings kill future broadcast capacity and can disable the account entirely. The compliance overhead protects the channel.
Opt-In: Phone Number Is Not Enough
Meta's "Get opt-in for WhatsApp" documentation (updated May 21, 2026) defines two conditions that are both required before you can lawfully contact a customer:
- They have given you their mobile phone number.
- You have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you on WhatsApp.
Condition one is necessary. It is not sufficient. A customer giving you a business card has met condition one. They have not met condition two. A customer filling in a contact form on your website without a WhatsApp-specific opt-in checkbox has met condition one. Not condition two. A number from a purchased or rented database has met neither condition.
Valid opt-in collection methods per Meta: SMS message confirmation, website form with an explicit WhatsApp communication checkbox, interactive voice response (IVR), and in-person or paper consent forms. Meta also recommends categorized opt-in: separate explicit consent for Marketing messages versus Utility messages such as order updates and appointment reminders. A general "stay in touch" opt-in does not automatically cover all message categories.
UAE Cabinet Resolution No. 56 of 2024 independently requires the same principle: contact only opted-in consumers. The two compliance layers reinforce each other. Collecting consent through WhatsApp lead capture gives you a timestamped, source-tracked consent record for each contact in your list.
Templates and the 24-Hour Window
Every WhatsApp Business message falls into one of two categories based on timing relative to the last inbound message from the customer.
Within 24 hours of the customer's last inbound message (the customer service window), your team or AI can send free-form messages without using templates. Meta calls these service messages. This is where real-time customer support, AI chatbot replies, and agent follow-ups happen. The 24-hour clock resets every time the customer sends any message.
Outside that window, or when your business initiates a conversation (the customer has not messaged first), every message must be a pre-approved Message Template. Meta defines three official template categories:
- MARKETING: Promotional messages including offers, product announcements, campaign broadcasts, and re-engagement. This is the category for bulk outreach to a contact list.
- UTILITY: Transaction-triggered messages including order confirmations, payment receipts, delivery updates, and appointment reminders.
- AUTHENTICATION: One-time passcodes and verification messages.
"Service" is not a template category. It describes what happens inside the 24-hour customer service window when the customer messaged first. There are three template types: Marketing, Utility, and Authentication.
For bulk broadcasting to a contact list, Marketing templates are what you need. These require Meta's pre-approval before sending. Simple, clearly promotional templates typically pass automated review in minutes to a few hours. Build your template library before a campaign, not the day you plan to send. Complex or ambiguous submissions can take up to 24 to 48 hours for human review. WhatsApp message templates in Zena tracks approval status in real time across your full template library.
How WhatsApp Messaging Tiers Work in 2026
If you have read any guide about WhatsApp messaging limits published before late 2025, there is a good chance it describes a model that no longer exists. The old Tier 1 = 1,000 conversations per day, Tier 2 = 10,000, Tier 3 = 100,000, Tier 4 = Unlimited model was per individual phone number. That model changed.
Effective 7 October 2025 per Meta's Messaging Limits documentation, limits now apply at the Business Portfolio level across all phone numbers in a Meta Business Manager portfolio. The current tiers:
| Level | Daily Business-Initiated Conversations (unique users) |
|---|---|
| New business portfolio | Up to 250 |
| After completing scaling path | Up to 2,000 |
| Automatic scaling tier 1 | Up to 10,000 |
| Automatic scaling tier 2 | Up to 100,000 |
| Automatic scaling tier 3 | Unlimited |
Business-initiated conversations are conversations your business opens with a unique user outside an existing customer service window. This is the limit that affects bulk broadcast campaigns directly.
To move from 250 to 2,000: either complete Meta Business Verification for your portfolio, have your BSP verify it, or send 2,000 delivered messages outside service windows to unique users within 30 days using high-quality-rated templates. From 2,000 upward, scaling is automatic. Meta evaluates quality and usage approximately every 6 hours. To advance, your templates need a high quality rating and you must have used at least 50% of your current messaging limit in the last 7 days.
For campaign planning, this matters: a UAE business at the 250/day starting level sending to 1,000 contacts needs a 4-day send window. After verifying and scaling to 2,000/day, that same campaign completes in a single day. Understanding the current portfolio tier before scheduling a broadcast avoids the situation where 5,000 contacts are queued but only 250 go out before the daily limit pauses the campaign.
What the Compliant Setup Looks Like in Practice
Putting the Meta policy layer and the UAE regulatory layer together, a compliant WhatsApp bulk messaging setup for a UAE business in 2026 has these pieces in place before a campaign runs:
- Official API connection: The WhatsApp number is connected to the Cloud API through a Meta-authorized BSP. Not a third-party tool bypassing the API infrastructure.
- Verified consent on every contact: Each recipient has given explicit opt-in through a tracked channel (web form, SMS, IVR, or in-person) with a record of what message types they consented to receive.
- DNCR scrubbing before each campaign: The contact list is checked against the UAE Do Not Call Registry before sending. Not once at import; before each campaign, since registry status can change.
- Approved Marketing template ready: The campaign message has been submitted to and approved by Meta before the campaign launches. Approval is confirmed, not just submitted.
- UAE-registered sending number: The sending number is registered in the UAE, not an international number forwarded through a VoIP service.
- Sending window: Campaign messages go out between 9:00 am and 6:00 pm UAE time, per Cabinet Resolution No. 56 of 2024.
- Company identity disclosed: Every message identifies the business by name and makes the commercial purpose clear.
- Inbound capacity ready: A WhatsApp team inbox is active and staffed to handle replies from recipients who respond to the broadcast. Sending at scale without reply capacity is a compliance risk and a conversion miss.
Compliant bulk messaging also produces better commercial results. An opted-in UAE audience receiving relevant content over WhatsApp consistently achieves 80 to 90% read rates. The compliance overhead, consent collection and list maintenance, is real. The commercial return makes it worth doing correctly rather than skipping.
For the full setup on how campaigns are built, scheduled, and managed within the official API constraints, see WhatsApp bulk broadcasting UAE.
Frequently Asked Questions
Is WhatsApp bulk messaging legal in the UAE?
Yes. WhatsApp bulk messaging is legal in the UAE when conducted through Meta's official WhatsApp Business Platform, to recipients who have explicitly opted in, using Meta-approved message templates, and in compliance with Cabinet Resolution No. 56 of 2024. Sending unsolicited bulk messages via unofficial third-party tools violates both Meta's Business Messaging Policy and UAE telemarketing law.
What does Cabinet Resolution No. 56 of 2024 require from businesses doing WhatsApp marketing?
The regulation requires: prior approval from the competent authority before telemarketing activity begins; contacting only opted-in consumers; scrubbing contact lists against the UAE Do Not Call Registry before each campaign (residents register by texting "DNCR" to 1012); using UAE-registered numbers only; disclosing company identity and purpose in every message; and sending only between 9:00 am and 6:00 pm. These obligations apply because the regulation explicitly defines WhatsApp commercial messaging as telemarketing.
What are the UAE penalties for sending unsolicited WhatsApp marketing messages?
Under Cabinet Resolution No. 57 of 2024, the fines for companies range from AED 10,000 to AED 150,000 per offence depending on the specific violation and whether it is a first, second, or third occurrence. Telemarketing without prior approval carries AED 75,000 for a first offence. Contacting a DNCR-listed number carries AED 50,000 for a first offence. Companies can also face activity suspension or licence cancellation for severe or repeated violations. Federal Decree-Law No. 45 of 2021 (PDPL) and Federal Law No. 15 of 2020 (Consumer Protection) add further legal exposure on top of these penalties.
How many WhatsApp messages can a UAE business send per day in 2026?
As of 7 October 2025, messaging limits are set at the Business Portfolio level, not per phone number. A new portfolio starts at up to 250 business-initiated conversations per day. After completing Meta Business Verification or the organic scaling path, the limit increases to 2,000. From there, scaling to 10,000, 100,000, and Unlimited is automatic based on quality and usage signals evaluated approximately every 6 hours. The old Tier 1 = 1,000 per-number model no longer applies.
Does a phone number alone count as WhatsApp opt-in consent?
No. Under Meta's Business Messaging Policy, two conditions are both required: the contact has given you their phone number, and you have received explicit opt-in permission confirming they wish to receive WhatsApp messages from you. A number from a business card, a contact form without a WhatsApp consent checkbox, or a purchased database does not satisfy condition two. UAE Cabinet Resolution No. 56 of 2024 independently requires that businesses contact only opted-in consumers. Both compliance layers demand the same thing: documented, explicit consent before you send.
Set up compliant WhatsApp bulk messaging for your UAE business.
Official Cloud API connection, consent-tracked contact lists, approved template management, and a team inbox for inbound replies. 14-day free trial, no credit card required.
See Zena's pricing →