Follow-Up · 2026-08-18

Can You Follow Up with Leads on WhatsApp? UK Compliance Rules for Automated Messages

The question every business asks too late

A parent enquires about swimming classes via WhatsApp. They do not book. Three days later, you send a follow-up message nudging them to book a trial. Is that legal under UK rules?

The answer is: it depends on how you collected their contact details, what the message is about, and whether you gave them a way to opt out. Getting this wrong is not a theoretical risk. The ICO has issued fines for electronic marketing breaches under PECR (RPC Legal 2026 analysis of recent ICO enforcement actions).

The two layers: PECR and UK GDPR

UK businesses sending automated follow-up messages must comply with two overlapping frameworks:

PECR (Privacy and Electronic Communications Regulations): governs the act of sending electronic direct marketing, including email, SMS, and messaging channels like WhatsApp (Measured Collective 2026 PECR guide, Geldards LLP 2025 legal analysis).

UK GDPR: governs the processing of personal data — storing their phone number, segmenting them into a follow-up list, tracking their responses.

Both must be satisfied. PECR compliance does not excuse a UK GDPR violation, and vice versa.

The soft opt-in: when you can follow up without explicit consent

PECR includes a critical exemption called the soft opt-in that allows businesses to send marketing messages to individuals without explicit prior consent — but only when five conditions are all met (ICO 2023 official guidance on PECR electronic mail marketing rules, Geldards 2025, ConsentTrail 2026 compliance guide):

1. Direct collection. You collected the contact details yourself, directly from the individual. A parent who messaged you on WhatsApp satisfies this direct-collection condition. A list purchased from a third party does not.

2. Negotiations for a sale. The details were collected in the course of a sale or "negotiations for a sale." The ICO says an enquiry about buying the service, a quote request, or signing up for a free trial may meet this threshold — the person has actively expressed interest in buying your service. Simply browsing your website does not qualify.

3. Similar products only. Your follow-up must relate to your own similar products or services. A swim school can follow up about swimming classes. It cannot use the same contact to promote a third party's product.

4. Opt-out offered at collection. The person must have been given a clear, simple opportunity to opt out at the point you collected their details. If you use a consent box, it must be unticked; a pre-ticked box is not valid consent.

5. Opt-out in every message. Every follow-up message must include a clear, simple, free-of-charge opt-out option. "Reply STOP to unsubscribe" meets the standard.

For most inbound WhatsApp enquiries at a small business, conditions 1 through 3 are naturally satisfied. Conditions 4 and 5 are where businesses typically fail: they never offered an opt-out at the point of enquiry, or their follow-up messages do not include one.

The corporate subscriber exception

PECR draws a distinction between individual subscribers (sole traders, partnerships, consumers) and corporate subscribers (companies, LLPs).

Corporate subscribers — such as companies and LLPs — can receive unsolicited electronic marketing without the soft opt-in or prior consent under PECR, but the sender must still identify itself and provide a valid opt-out route (ICO 2023 official guidance). This matters for B2B outreach but is largely irrelevant for the consumer-facing follow-up that class-based businesses do with parents.

Quiet hours

UK best practice recommends avoiding promotional messages during unsociable hours. The cited operational guides recommend no automated marketing messages after 8pm or before 9am (Klaviyo 2025 UK SMS compliance guide, TextMagic 2025 UK SMS guide).

If a parent enquires at 9pm, answer the question as a service response; queue any scheduled promotional follow-up for 9am the next morning. This is a practical compliance and sender-reputation consideration: messages sent at unsociable hours are more likely to be flagged as spam (Uptail 2026 analysis).

WhatsApp's own rules on top of PECR

Meta's WhatsApp Business Platform imposes additional constraints that run alongside UK law (Meta WhatsApp Business Policy, Uptail 2026 analysis of 100,000 messaging threads):

Template approvals: any message initiated by the business outside the 24-hour customer service window must use a pre-approved template. You cannot freestyle a follow-up three days after a conversation closed.

Quality ratings: if recipients flag messages as spam or block the sender, the phone number's Quality Rating falls. A yellow or red rating reduces sending capacity. Persistent poor quality leads to account suspension.

Real-time opt-out processing: when someone replies STOP, they must be removed from messaging lists immediately — not in the next batch update, not at the end of the day (Meta WhatsApp Business Policy, Blueticks 2026 compliance analysis).

The practical checklist

For a UK small business following up with enquiry leads on WhatsApp:

1. The contact details came directly from the person enquiring with you. Never from a purchased list.
2. They enquired about buying your service — an enquiry of that kind may constitute "negotiations for a sale" under ICO guidance.
3. Your follow-up is about the same service they asked about.
4. You provided an opt-out opportunity at the point of enquiry (add a line to your enquiry forms and auto-responses).
5. Every follow-up message includes "Reply STOP to unsubscribe" or equivalent.
6. Schedule automated follow-ups between 9am and 8pm as a conservative UK best-practice window.
7. Follow-up templates outside the 24-hour window are pre-approved by Meta.
8. STOP replies are processed immediately.

Missing any of these steps does not just risk a fine. On WhatsApp specifically, it risks degrading your Quality Rating, which can reduce messaging capacity and ultimately lead to account suspension.