Contents
On January 15, 2026, a change to the WhatsApp Business Platform terms took effect that pushed ChatGPT — used by more than 50 million people inside WhatsApp — and Microsoft’s Copilot out of the app. The European Commission opened an antitrust investigation over it (The Register, Dec 4, 2025). The headlines read “Meta bans AI on WhatsApp.” That’s not quite what happened: what got banned was something very specific, and what’s still fully allowed — your own business running its own AI agent to talk to customers — is exactly what thousands of companies already have live, without ever checking four points that matter the moment an inspection or a customer complaint shows up.
What actually changed on January 15
Meta added a new category to its terms: the “AI Provider” — a company that builds or operates AI technology (large language models, generative AI, general-purpose assistants) and offers it through the WhatsApp Business Platform as its core product. From that date, AI Providers are restricted to offering general-purpose assistants only “where Meta is legally required to permit this use case” (Meta’s own developer documentation). That’s why OpenAI redirected ChatGPT users elsewhere and Microsoft pulled Copilot.
Meta’s documentation is explicit on the other half of the story: this change “does not change how Meta charges all other businesses using the WhatsApp Business Platform.” A restaurant taking reservations through an AI agent, a clinic confirming appointments, or a logistics company answering “where’s my order” are not “AI Providers” under this definition — they’re ordinary businesses using a tool, unaffected by the restriction. What did take effect, on February 16, 2026, was per-message charging for AI Providers in regulated markets — further confirmation that the line Meta drew is “who sells AI as the product,” not “who uses AI in their business.”
The line that matters
Your WhatsApp agent isn’t banned. The real problem is that most businesses that turned one on — by copying a template or hiring whichever vendor they found first — never checked the four conditions that do apply to them, even though the restriction Meta aimed at third parties doesn’t.
The four points almost nobody checks
1. Does the customer know they’re talking to AI?
Since August 2, 2026, Article 50.1 of the EU AI Act has been enforceable: any system that interacts directly with a person must make clear, from the first message, that the person is talking to AI — unless that’s already obvious from context. A line buried in a privacy policy doesn’t count; it has to be said inside the conversation itself, no later than the first exchange. We cover the rest of what became enforceable that same date — including the actual fines, which aren’t what most summaries claim — in our guide to the EU AI Act.
2. Where does the conversation data actually live?
If your company operates out of the UAE — or serves customers there — Federal Decree-Law 45 of 2021 (the PDPL) requires under Article 22 that any cross-border transfer of personal data either have the Data Office’s approval (because the destination country offers adequate protection) or rest on another legal basis, such as contract or explicit consent. As of November 2026, the Data Office still hasn’t published that list of adequate countries, so almost no WhatsApp AI vendor can actually rely on it — the real basis is usually contract or consent, and most businesses have never confirmed which one their vendor uses. We go deeper on this, including the finding that 47% of surveyed companies admit they don’t have staff qualified to manage that cross-border risk, in our article on AI data sovereignty.
3. What you’re not allowed to ask the customer for in chat
WhatsApp’s Business Policy, under “Protect data and comply with law,” is blunt: “Don’t share or ask people to share full length individual payment card numbers, financial account numbers, personal ID card numbers, or other sensitive identifiers” (official WhatsApp Business Policy). An AI agent that asks a customer for their full ID number or 16-digit card number “to verify identity” is breaking the platform’s own policy, not just some external regulation — and that can get the business’s WhatsApp account suspended, with or without a customer complaint.
4. What your vendor is allowed to do with those conversations
WhatsApp Business terms restrict what vendors can do with the data that flows through the platform (“Business Solution Data”): it cannot be used to create, train or improve third-party AI models, even in anonymized or aggregated form — with one exception, fine-tuning a model for the business’s own exclusive use. If you’re running a “WhatsApp AI agent” and don’t know whether your customer conversations feed the vendor’s general-purpose model, that’s the first question to put to them in writing.
How we help
We don’t come at this as another chatbot vendor: Optima Quantum is a cybersecurity and AI consultancy, and we audit the agent before it goes live, not after an incident. Inside our AI & automation services we review whichever agent you’re running — in-house or third-party — against Article 50.1, check where it actually processes data, and read the fine print you signed with the vendor; if what you need is a broader review of what that agent can reach inside your systems, we cover that as part of our free security audit. If your business wants to deploy or audit an AI agent on WhatsApp before a real customer exposes a gap, contact us and we’ll review it with you first.
Frequently asked questions
Did Meta ban AI chatbots on WhatsApp? No. It restricted “AI Providers” — companies selling a general-purpose AI assistant like ChatGPT or Copilot as their core product — from offering that product through the WhatsApp Business Platform, starting January 15, 2026. A business running its own AI agent to serve its own customers doesn’t fall under that definition and keeps operating exactly as before.
Why were ChatGPT and Copilot removed from WhatsApp? Because they fit the new “AI Provider” definition: a general-purpose assistant offered as the core product, not as support for one specific business. ChatGPT had more than 50 million users on WhatsApp before it was pulled.
Does my WhatsApp agent have to disclose it’s AI? Yes, if it interacts with people in the EU: Article 50.1 of the AI Act requires it, enforceable since August 2, 2026, and it has to be said inside the conversation, not just in a privacy policy.
Can I ask for a bank account number on WhatsApp to verify a payment? No. WhatsApp’s Business Policy explicitly bans that, along with asking for a full card number or ID document number, whether a human or an AI agent is the one asking.
Do my WhatsApp conversations train the vendor’s AI model? It depends on the contract, but WhatsApp’s Business terms prohibit it unless it’s fine-tuning for your own company’s exclusive use. Ask your vendor in writing if you don’t already know the answer.
Get our new articles by email
One email per article. Unsubscribe anytime.