WhatsApp Business API in the UAE: what Meta's rules and UAE law actually require

Many pages on this question come from message resellers and open with a rate table. Such tables age quickly: Meta changes its rates and rules several times a year, and a reseller's figure may include its own fee. Compliance sections often name the PDPL and stop there.

This guide explains how the platform works, what you have to decide before the first message goes out, and which rule comes from where: Meta's documentation and policy, Cabinet Resolution No. 56 of 2024 and Federal Decree-Law No. 45 of 2021. Each statement can be checked in the sources at the end.

Checked on 3 October 2026. Meta changes its platform several times a year, so the date matters. This is a summary of published text, not legal advice.

The short answer

• The free WhatsApp Business app is a phone app. For a CRM connection, a shared inbox, automation or an AI assistant you need the WhatsApp Business Platform, in practice the Cloud API hosted by Meta.
• You can connect directly or through a partner. Either way, the WhatsApp Business Account should sit in your own company's Meta business portfolio.
• More than 24 hours after the customer's last message, you can only send templates that Meta has approved and put into one of three categories: marketing, utility or authentication.
• Meta charges per delivered template message. Non-template replies inside the 24-hour window are free.
• Opt-in is required by Meta. In the UAE, Cabinet Resolution 56/2024 also covers marketing messages to consumers through social media applications, and the PDPL makes consent the default basis for processing personal data.

WhatsApp Business app or WhatsApp Business API

The WhatsApp Business app offers a business profile, catalogue, quick replies, labels and greeting and away messages, on a phone plus a few linked devices. It has no API, so no other software can read or send through it.

The WhatsApp Business Platform is the programmable version: messages reach your systems through webhooks, and your systems reply through an API. That makes routing, CRM logging, booking flows and AI replies possible. Three facts many older guides miss:

• There is no self-hosted option any more. The last version of Meta's On-Premises API expired on 23 October 2025; numbers still registered on it no longer get messages delivered.
• Data location can be chosen. The Cloud API offers local storage for data at rest, and the United Arab Emirates is on Meta's list of supported regions. It must be enabled before the number is registered, and message content can still be processed in Meta data centres elsewhere while it is handled, for up to 60 minutes on the Cloud API according to Meta.
• You do not always have to give up the app. With "coexistence", a number used in the Business app can be connected to the Cloud API and stay in the app. It is onboarded only through a partner's Embedded Signup flow, and broadcast lists, disappearing messages, view-once messages and live location are switched off in the app.

For clinics, Federal Law No. 2 of 2019 on ICT in health fields applies across the UAE, free zones included (Article 2). Its Article 13 provides that health data and information relating to health services provided in the UAE may not be stored, processed, generated or transferred outside the country, except in cases set by a decision of the health authority in coordination with the Ministry. If patients will write about symptoms or treatment, clear the setup with your regulator (DHA, DoH Abu Dhabi or MOHAP) first. Local storage covers data at rest but not that short processing abroad, so it is one part of the answer, not all of it.

Direct with Meta or through a partner

Going direct means setting up a business portfolio, a Meta app with the WhatsApp use case, a WhatsApp Business Account and a number in Meta's developer tools. That suits companies with their own developers. Most businesses use a partner (Meta says Solution Partner or Tech Provider, the market says BSP), which adds an inbox and onboarding help and may charge fees on top of Meta's. Before you sign, check:

• Ownership. Portfolio and WhatsApp Business Account belong to your company, with your staff as admins. Otherwise your number and templates are tied to the partner's account.
• Exit. How would you move the number to another partner or your own integration?
• Two bills. Are Meta's charges passed through at Meta's rate or marked up, and in which currency?
• Data. Where are conversations stored, and is local storage used?

Number, verification and display name

Meta requires that the number is owned by you, has a country and area code (no short codes) and can receive the verification code by voice call or SMS. A number active in WhatsApp Messenger must be deleted there first. Landlines and toll-free numbers can work if the registration call reaches a person or a mailbox; a number behind an IVR menu cannot receive it.

UAE law adds a point resellers rarely mention. Article 4(3) of Cabinet Resolution 56/2024 requires companies making marketing calls to use local numbers from UAE-licensed operators, registered under the company's commercial licence. Whether that reaches every WhatsApp marketing message is not settled in the text, but if you plan promotions to consumers in the UAE, a UAE number on your own licence avoids the question.

Business verification, Meta's check of your company's legal details, changes your limits. A new portfolio can deliver messages outside the service window to 250 unique users in a moving 24-hour period; verification is one of three routes to 2,000, after which limits rise automatically with good quality and use. The number of phone numbers per portfolio also rises from two to 20.

The display name is reviewed against Meta's guidelines and can be declined. The blue checkmark of an Official Business Account is a separate application: among other things, 30 days on the platform, business verification, two-step verification and an approved display name. Approval is not guaranteed.

Templates and their three categories

A template is a message with optional header, buttons and variables that Meta reviews before use. Each has one category:

• Marketing: awareness, offers, re-engagement, abandoned carts, anything persuasive.
• Utility: follow-up on something the user did or asked for, such as an order update or appointment confirmation. It must be non-promotional and specific or essential to the user.
• Authentication: one-time codes.

Two rules decide most disputes. Mixed content counts as marketing: an order update with a discount code is a marketing template. And Meta can recategorise a utility template as marketing, normally with one day's notice; since 16 April 2025, a business warned for category misuse gets no notice. The template stays approved, at the marketing rate, with 60 days to appeal. So keep transactional templates strictly transactional, and send offers separately to people who agreed to receive them.

The 24-hour window

When a customer messages or calls you, a 24-hour customer service window opens, and each new message from them resets it. While it is open you can send anything: free text, media, buttons, lists. Once it closes, only approved templates.

This shapes operations more than any feature list. A lead who wrote at 10:00 and gets an answer at 11:00 the next day can only be reached with a template, which needs approval, may cost money and reads as formal. Fast first replies keep the conversation in the free, flexible window.

How Meta charges, without the rate table

The model as Meta's pricing documentation describes it, without figures, because Meta publishes current ones itself:

• Per delivered template message, not per sent message.
• The rate depends on category, the recipient's country or region, and, for utility and authentication, a volume tier counted across your whole business portfolio.
• Free: non-template messages inside an open service window, and utility templates delivered inside it.
• Free entry point: when a conversation starts from a Click-to-WhatsApp ad or a Facebook Page call-to-action, all messages are free for 72 hours, under conditions Meta states.
• Billing in AED has been possible since 1 April 2026.
• Partner fees are separate and set by each partner.

For real numbers, use the rate card on Meta's WhatsApp Business pricing page and select the market where your recipients are.

Opt-in: Meta's policy and UAE law

Meta's WhatsApp Business Messaging Policy lets you contact people only if they gave you their number or username and opted in to messages from you. Every request to stop, on WhatsApp or elsewhere, must be respected. Users can block or report businesses, and Meta may limit sending based on that feedback, so unexpected messages also cost you capacity.

Cabinet Resolution No. 56 of 2024, issued on 10 June 2024 and in force 60 days after its publication in the Official Gazette (Article 11), applies to all companies licensed in the UAE that market through telemarketing, free zones included (Article 3). Article 1 defines telemarketing as calls to a consumer "including marketing text messages and marketing messages through social media applications", and a consumer as a natural person. Marketing to companies as such is outside that definition; a message to an individual's mobile is harder to classify. Article 4 requires, among other things:

• prior approval from the competent authority, defined as the agency licensing or regulating your activity (4(1));
• a channel where consumers can show interest, and marketing only to them (4(4));
• no marketing to consumers whose numbers are on the Do Not Call Registry (DNCR), which the TDRA supervises (4(5) and Article 1);
• naming the company and the purpose at the start (4(11)).

Article 5 adds no pressure, no deception, a 9:00 to 18:00 window for marketing calls and no further contact after a first refusal. These articles speak of "Marketing Phone Calls", and the text does not say how each call rule applies to a written message; Article 10 lets the Minister issue implementing resolutions, including against practices that circumvent the resolution. The cautious reading: treat WhatsApp marketing to consumers as covered, and ask your competent authority before running campaigns.

Federal Decree-Law No. 45 of 2021 (PDPL) applies inside the UAE and to controllers abroad processing data of people in the UAE (Article 2(1)). Article 4 begins: "It is prohibited to process Personal Data without the consent of its owner", followed by listed exceptions such as performing a contract or steps the person requested. Article 6 requires consent you can prove, that is clear and unambiguous and easy to withdraw. Article 17 gives a right to object to direct marketing. Article 2(2) excludes, among others, free-zone companies with their own data protection legislation, such as DIFC and ADGM, and health data governed by its own law. Articles 22 and 23 set conditions for transfers abroad, relevant when a partner or AI provider processes messages outside the UAE.

In practice:

• Ask for WhatsApp marketing consent separately where you collect the number, and store date, source and exact wording.
• Answering someone who wrote to you is service; sending offers later needs the marketing opt-in.
• Offer a stop option in every marketing template and suppress the number at once.
• No bought or scraped lists. They fail Meta's policy and Article 4(4).

Handing over to people

Meta allows automated replies inside the service window but requires "prompt, clear, and direct escalation paths", such as transfer to a human agent, a phone number, email or a support form. A working hand-over has a trigger the customer can use at any time, rules for when the bot hands over itself (complaints, prices, anything outside approved content), a named person or queue that receives the full history, and a reply saying when a person will answer.

If you use AI, note Meta's platform terms: AI providers may not use the platform to offer AI technologies when these are the primary, rather than incidental or ancillary, functionality being made available. An assistant that answers questions about your own services and bookings is, on a plain reading, ancillary to your business. A general-purpose chatbot does not belong on your business number.

Arabic

Each language version of a template is reviewed separately, so plan Arabic and English versions from the start. Check variables in right-to-left text: a name, date or order number inside an Arabic sentence can land in the wrong place if nobody looked at the rendered message. Templates, auto-replies and an AI assistant's knowledge base need review by a native speaker on your side before launch. An offer that reads like a machine translation invites blocks and reports, and Meta may limit your sending based on that feedback.

Typical mistakes

• Automating a personal number with WhatsApp Web tools. WhatsApp's terms of service list bulk messaging and auto-messaging as impermissible and exclude non-personal use unless WhatsApp authorises it, so the number is at risk.
• A partner owning your account, so number and templates leave with the partner.
• Promotions inside utility templates, recategorised and billed as marketing.
• Slow first replies, so follow-ups need paid templates.
• Broadcasting to every past customer. A purchase is not a marketing opt-in.
• Stop requests that reach one employee's phone and nowhere else.
• A bot with no exit to a person.
• Ignoring the UAE layer: no approval, no Do Not Call check, no consent record.
• Measuring delivered and read instead of enquiries, bookings and sales per source.

Where we come in

Schroer Digital is founder-led, built and operated with our German sister company Schröer Digital UG, which runs this kind of setup in production for its own business on the Cloud API: signed webhooks, each message routed to one owner, the 24-hour window checked in code, AI replies labelled as such. We do not have clients in the UAE yet. If you want WhatsApp to answer, qualify and hand over in English or Arabic, with every enquiry and its source in your CRM, see our WhatsApp AI Enquiry Desk. Approval from your competent authority, consent texts and Arabic proofreading stay with you and your advisers.

Sources

All retrieved 3 October 2026.

• Meta, Pricing on the WhatsApp Business Platform: developers.facebook.com/docs/whatsapp/pricing. Per-message model, free messages, free entry point, volume tiers, AED billing from 1 April 2026.
• Meta, WhatsApp Business Platform pricing and rate card: whatsappbusiness.com/products/platform-pricing.
• Meta, WhatsApp Business Messaging Policy (last updated 23 September 2026): whatsappbusiness.com/policy.
• Meta, Terms for WhatsApp Business Platform, AI Providers clause: facebook.com/legal/Meta-Terms-for-WhatsApp-Business-Platform.
• WhatsApp Terms of Service, acceptable use: whatsapp.com/legal/terms-of-service.
• Meta, Template categorization: developers.facebook.com, template categorization.
• Meta, Send messages, customer service window: developers.facebook.com, send messages.
• Meta, Messaging limits: developers.facebook.com, messaging limits.
• Meta, Business phone numbers: developers.facebook.com, phone numbers.
• Meta, Official Business Accounts: developers.facebook.com, official business accounts.
• Meta, Local storage: developers.facebook.com, local storage.
• Meta, Coexistence: developers.facebook.com, onboarding business app users.
• Meta, On-Premises API sunset: developers.facebook.com/docs/whatsapp/on-premises/sunset.
• Cabinet Resolution No. (56) of 2024 on the Telemarketing Regulations, English text published by the Ministry of Economy and Tourism: moet.gov.ae (PDF). Articles 1, 3, 4, 5, 10 and 11.
• Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data: uaelegislation.gov.ae/en/legislations/1972. Articles 2, 4, 6, 17, 22 and 23.
• Federal Law No. 2 of 2019 on the Use of ICT in Health Fields: uaelegislation.gov.ae/en/legislations/1209. Articles 2 and 13.

Reviewed 3 October 2026. Most likely to age: Meta's limits, categories and pricing rules, and any resolution issued under Article 10 of Cabinet Resolution 56/2024.