WhatsApp Marketing in B2B: KVKK and Consent Rules

WhatsApp marketing in B2B is legal, but you have to comply with two separate sets of regulations at the same time. The first is Law No. 6698 on the Protection of Personal Data (KVKK). The second is Law No. 6563 on the Regulation of Electronic Commerce and its accompanying Regulation on Commercial Communications and Commercial Electronic Messages. You can send commercial messages to tradespeople and merchants without prior consent. However, you must stop sending as soon as the recipient exercises their right to opt out, process personal data in line with KVKK, and meet the opt-in requirement in Meta's WhatsApp Business policies.

WhatsApp is one of the fastest ways to reach decision-makers in Turkey. Its open rates far exceed anything email can offer, and replies arrive within minutes. That speed also creates serious risk for companies that misuse the channel. A single complaint can trigger proceedings with both the Personal Data Protection Board and the Ministry of Trade, and Meta can restrict your number. In this article, we walk step by step through the conditions, permissions and processes under which B2B SaaS companies can use WhatsApp.

Note: This article is for general information only and does not constitute legal advice. We recommend consulting a lawyer specializing in KVKK and e-commerce legislation before launching your campaign setup.

Which rules apply to B2B WhatsApp marketing?

A sales or marketing message sent via WhatsApp is subject to three different sets of rules at once. Telling them apart is the foundation of any compliance process.

1. KVKK (Law No. 6698): Phone numbers, names, job titles and message content are personal data. To collect, store, enter into your CRM and send messages using this data, you need a legal basis, you must inform the data subject, and you must ensure data security.
2. Law No. 6563 and the Commercial Communications Regulation: A WhatsApp message counts as a "commercial electronic message" if it promotes goods or services. As a rule, the recipient's prior consent is required. There is an exception for tradespeople and merchants. Consents and opt-outs are tied to the Message Management System (İYS).
3. Meta's WhatsApp Business policies: These are not legislation, but in practice they are where the fastest enforcement comes from. Meta requires businesses to obtain explicit opt-in from users before contacting them via WhatsApp. Numbers that receive many blocks and complaints see their quality rating drop and their sending limits reduced, and the account may be shut down if necessary.

Complying with one of these layers does not exempt you from the others. Being able to send messages without consent under Law No. 6563 thanks to the merchant exception does not mean you are processing data lawfully under KVKK or meeting Meta's opt-in rule.

What exactly does the merchant exception mean on WhatsApp?

Under the Regulation, commercial electronic messages may be sent to tradespeople and merchants without prior consent. This is the provision B2B companies rely on most often. In practice, it has three important limits.

First, the exception depends on the recipient being a merchant or tradesperson. A message sent to a joint-stock company's corporate line or to a number registered in the company's name may fall within this scope. The personal mobile phone of a procurement manager working at that same company is a different matter. The employee is a natural person and is not a merchant. Because interpretations differ on this point, the safest approach is not to send bulk commercial messages to numbers that are evidently personal on the basis of the merchant exception.

Second, the right to opt out always applies. When a merchant recipient says "don't contact us again," the consent exception no longer applies and no further messages may be sent from that moment on. You should offer an easy way to opt out in every message. A one-word method such as "Reply DUR if you no longer wish to receive messages" is ideal for WhatsApp. The legislation requires opt-out requests to be processed within three business days.

Third, the exception does not remove KVKK obligations. The merchant exception relates only to the consent requirement under Law No. 6563. The question of which legal basis you rely on to process the other person's data must be answered separately under KVKK.

Company number or personal number? Why the distinction is critical

The most common mistake outbound teams make is treating every phone number bought or pulled from data platforms the same way. A lead list typically contains three types of numbers:

• Company switchboard or main line: This is the number type with the weakest personal data character and where the merchant exception applies most comfortably. However, it is rarely used on WhatsApp.
• Corporate line assigned to an individual: A number provided by the company to an employee and used for business purposes. Because it is associated with a person, it is personal data, but its use in a business context provides more defensible ground.
• Personal mobile phone: A number registered in the person's own name and also used in their private life. This is where the risk is highest under both KVKK and Law No. 6563.

Data enrichment tools do not always make this distinction clearly. On a prospecting platform like Apollo.io, you can find a decision-maker's mobile number. Being able to access that number does not mean you have permission to send them marketing messages via WhatsApp. It is far healthier to use such data for first contact through channels like phone calls or email, and to position WhatsApp as a channel that comes into play once the person has given permission.

What is the difference between explicit consent, commercial message consent and legitimate interest?

These three concepts are often confused. In fact, each answers a different question.

KVKK explicit consent

This is consent relating to a specific matter, based on information, and given freely. Explicit consent cannot be made a precondition for a service. A setup like "Accept marketing messages to download the demo" is problematic. The person can withdraw explicit consent at any time.

Commercial message consent under Law No. 6563

This is the recipient's consent to being sent commercial electronic messages. Consent can be obtained in writing or through electronic communication tools. You must be able to prove that consent was obtained. For recipients who are natural persons, consents must be registered in İYS. As a rule, no messages should be sent where the consent is not registered in İYS.

Legitimate interest

Set out in Article 5 of KVKK, this is the legal basis that permits data processing for the data controller's legitimate interest, provided it does not harm the data subject's fundamental rights and freedoms. In a B2B context, processing a company representative's business contact details to present a business offer to that company may fall within this scope. However, the Board's view of marketing activities is generally cautious. If you are going to rely on legitimate interest, it is important to carry out a balancing test and document it in writing.

As a practical rule, you can adopt the following: For everyone you send marketing messages to on WhatsApp, make sure you have both provided the KVKK privacy notice and obtained separate consent for communication via WhatsApp. This two-layer approach puts you in the strongest position under both the legislation and Meta's policies.

If you are curious about how the same logic applies to email, take a look at our guide on KVKK limits in B2B cold email. The biggest difference between the two channels is that platform rules are much stricter on WhatsApp.

Does using WhatsApp mean transferring your data abroad?

This is the topic most companies overlook. WhatsApp Business Platform uses Meta's infrastructure. Messaging data may be transferred to servers outside Turkey. Article 9 of KVKK governs this transfer.

The cross-border transfer regime was overhauled by an amendment that came into force in 2024. Transfers are now assessed in the following order:

1. Adequacy decision: If the Board has issued an adequacy decision for the relevant country or sector, the transfer can be based on that decision.
2. Appropriate safeguards: If there is no adequacy decision, one of the safeguards announced by the Board, such as standard contracts, can be used. A standard contract must be notified to the Authority within five business days of being signed.
3. Incidental transfers: If none of the above is available, limited exceptions, including explicit consent, can be relied on for transfers that are irregular and incidental in nature.

For a SaaS company, WhatsApp use is ongoing, so it is hard for it to qualify as "incidental." You should therefore review the contractual structure of your WhatsApp solution partner (BSP) and Meta with your legal team, and clearly state the cross-border transfer in your privacy notice.

How do Meta's rules restrict B2B messaging?

When sending messages via WhatsApp Business Platform (API), the following rules apply regardless of the legislation:

• Opt-in requirement: You must have an explicit statement from the person agreeing to receive messages from your business via WhatsApp. Your business name must appear clearly in the opt-in text.
• Template messages: If the person has not messaged you within the last 24 hours, you can only initiate a conversation using templates approved by Meta. Templates are divided into categories such as marketing, utility and authentication. Pricing also varies by category and by the recipient's country.
• 24-hour customer service window: When a user messages you, a 24-hour window opens. During this time, you can reply in free-form format.
• Quality rating: As your block and "report as spam" rates rise, your number's quality rating drops. Your daily sending limit gets restricted.

That last point is especially important for B2B. Even a message you are legally allowed to send puts your number at risk if the recipient perceives it as unwanted. In other words, on WhatsApp the real limit is often not the law but the recipient's patience.

Which messages count as commercial messages, and which don't?

Not every WhatsApp message is a commercial electronic message. The legislation treats notifications relating to an existing contract differently. For B2B SaaS specifically, the distinction can roughly be drawn as follows:

Generally not considered commercial messages (informational in nature):

• A reminder for a scheduled demo meeting
• An invoice, payment or subscription renewal notification
• A reply to a support request
• A service outage or maintenance announcement

Considered commercial messages:

• Promotion of a new feature or plan
• Discounts, campaigns, offers to switch to an annual plan
• Webinar or event invitations (if promotional)
• Product promotion to someone who is not yet your customer

Caution: The moment a sentence like "by the way, our new plan is 20 percent off" is added to an informational message, the message becomes commercial. Categories must be kept clearly separate for both the legislation and Meta.

How do you collect WhatsApp consent? A compliant setup, step by step

Collecting consent correctly prevents most of the problems that would otherwise arise later. The following steps can be adapted by most B2B SaaS companies.

1. Update your privacy notice. Clearly state in your KVKK privacy notice that WhatsApp is a communication channel, along with the processing purposes, legal bases and cross-border transfer.
2. Add a separate consent checkbox. On your demo request form, trial sign-up or webinar registration page, use a separate checkbox that is unchecked by default. Sample text: "I agree to receive messages via WhatsApp from [Company Name] about product updates, events and campaigns." Do not combine email consent and WhatsApp consent in a single checkbox.
3. Keep proof of consent. The date, time, IP address, form version and the consent text itself should be recorded. The burden of proof lies with the sender.
4. Register natural person consents in İYS. Register consents obtained from non-corporate recipients in İYS. Most CRMs and WhatsApp solution partners offer İYS integration.
5. Design the first message as a welcome message. In the first message after consent, state who you are, what kinds of messages you will send, how often, and how to opt out.
6. Automate the opt-out mechanism. Set up a rule that catches words such as "DUR" and "İPTAL," automatically removes the person from the sending list, and reflects this in your CRM.

Webinars are a particularly productive source for this setup. You can request WhatsApp consent on the registration form and send event reminders through this channel. We covered this topic in more detail in our guide to collecting qualified leads with webinars.

Can you send cold WhatsApp messages?

Short answer: Technically and legally, it is possible in some cases, but strategically it is usually a bad idea.

Setting aside the debate around the merchant exception and legitimate interest, a cold WhatsApp message creates a much stronger "my private space has been invaded" feeling in the recipient than email does. A recipient blocking and reporting you with a single tap directly affects your quality rating on Meta's side. Cold messages sent from a personal phone carry additional risk in terms of both brand reputation and KVKK.

A healthier outbound flow can be set up as follows:

• 1st touch: A personalized cold email or LinkedIn message
• 2nd touch: A phone call
• Step 3: Once the person shows interest, asking for verbal or written permission with the question "May I also reach you on WhatsApp?" and noting this permission in the CRM
• Step 4: After permission, using WhatsApp to schedule meetings, share documents and handle quick Q&A

With this approach, WhatsApp becomes not a prospecting tool but a channel that accelerates the relationship. For teams looking to build data-driven outbound processes with this discipline, Sales Corner's B2B sales and lead generation services focus on designing multichannel outreach flows with regulatory compliance in mind.

What does a compliant B2B WhatsApp flow look like? A sample scenario

Consider a SaaS company selling HR software. The company receives around 300 demo requests per month and wants to increase its demo attendance rate.

Form stage: The demo form has two separate checkboxes. One confirms that the person has read the KVKK privacy notice. The other is the optional WhatsApp consent, unchecked by default. Let's say some of the requesters tick the WhatsApp box.

Notification stage: Those who ticked the box receive a reminder via an approved "utility" template one day and one hour before the demo. These messages contain only meeting information and no sales offer.

Post-demo: During the demo, the sales rep asks the customer, "May I message you on WhatsApp if you have questions?" and notes the consent in the opportunity record in the CRM. Subsequent correspondence takes place within conversations initiated by the person themselves, inside the 24-hour window.

Marketing stage: Only people who have explicitly given marketing consent receive new feature or event announcements, at most once or twice a month. Every message ends with the line "Reply DUR if you don't want to receive messages like this."

In this setup, WhatsApp accelerates the lead's progress through the funnel without bothering anyone. When deciding which lead to move to WhatsApp at which stage, it helps to use the MQL vs. SQL distinction. For example, you can limit WhatsApp contact to people who have reached SQL level and given permission.

How should consent records be kept in the CRM?

WhatsApp compliance is largely a data management issue. We recommend keeping the following fields for every contact in your CRM:

• WhatsApp consent status: Yes / No / Withdrawn
• Consent date and source: Which form, which campaign, which rep
• Consent text version: The version of the text at the moment consent was given
• Consent type: Informational messages, marketing messages, or both
• Number type: Corporate line / Personal line / Unknown
• Merchant status: The legal entity the recipient belongs to and its tax information
• İYS sync status: For natural person consents
• Opt-out date: When the person replied DUR, if they did

With these fields, the marketing team can apply a "WhatsApp consent: yes, no opt-out, marketing consent: yes" filter in a single click when building a campaign list. When consent is withdrawn, all automations stop automatically. And in the event of a complaint or audit, the proof you need is ready in a single record.

Can sales reps send messages from their personal phones?

At many B2B companies, sales reps message customers from their own personal WhatsApp accounts. This creates three separate problems:

1. Loss of data control: Customer data is stored on a device and in an account outside the company's control. When the rep leaves, that data leaves with them.
2. Lack of proof: There is no record of who sent messages, when, and with what permission.
3. Opt-out management: When a customer tells one rep "don't message me," that information doesn't reach the other reps or the marketing team.

The solution is to move to a setup that integrates WhatsApp Business Platform with your CRM, where all reps work through a shared, corporate number. It is also important to put a ban on the use of personal accounts in writing as an internal policy and share it with the team. Especially with younger sales teams, presenting such rules not as a list of prohibitions but as a standard that protects customer trust delivers better results. Our article on building trust in sales through ethical and transparent strategies can be a good starting point for passing this perspective on to your teams.

What happens if the rules aren't followed?

Sanctions can come from three different sources:

• Under KVKK: Administrative fines apply for breaches of the duty to inform, data security violations or failure to comply with Board decisions. Fine amounts are updated every year according to the revaluation rate. Failure to notify the Authority of a standard contract for cross-border transfers is also subject to a separate penalty.
• Under Law No. 6563: The Ministry of Trade can impose administrative fines for sending commercial messages without consent or failing to honor opt-out requests. For messages sent to multiple recipients at once, the fine can be increased. With bulk sends, the risk grows exponentially.
• On Meta's side: A falling quality rating, reduced sending limits, rejected templates and, in the worst case, closure of the number or business account. Losing the number your customers know you by can be a heavier operational loss than a fine.

On top of these, there is also a reputational cost. B2B markets are small. A decision-maker who has been bothered may share the experience with peers in the industry.

Checklist for B2B WhatsApp compliance

Before launching your campaign, check each of the following items:

• Does your privacy notice cover WhatsApp, the processing purposes and cross-border transfer?
• Is WhatsApp consent obtained separately from other consents and on an optional basis?
• Is the consent checkbox unchecked by default?
• Is proof of every consent stored with the date, source and text version?
• Are consents from natural person recipients registered in İYS?
• Are corporate and personal numbers distinguished in the CRM?
• Does every marketing message include an easy way to opt out?
• Are opt-out requests processed automatically and within three business days?
• Are appropriate safeguards in place for cross-border transfer, and has the Authority been notified where required?
• Is there a written policy on the sales team's use of personal accounts?
• Is message frequency limited to a reasonable level?
• Are informational and marketing templates clearly separated from each other?

Frequently asked questions

Is consent always required to send WhatsApp messages in B2B?

Under Law No. 6563, commercial messages can be sent to tradespeople and merchants without prior consent, but sending must stop when the recipient exercises their right to opt out. Meta's WhatsApp Business policies, however, require opt-in from users regardless of the legislation. In practice, marketing on WhatsApp without consent carries serious risk from both a platform and a KVKK perspective.

Does a company employee's mobile phone fall under the merchant exception?

An employee is a natural person and is not a merchant. Relying on the merchant exception for commercial messages sent to a personal mobile phone is therefore debatable. The safest route is to obtain explicit consent before sending marketing messages via WhatsApp to numbers that are evidently personal.

Do demo reminders also count as commercial messages?

Reminders about a demo meeting the person requested themselves, containing only the date, time and link, are generally informational in nature. However, once a campaign, discount or product promotion is added to the message, it becomes commercial. Sending informational and marketing messages through separate templates is the cleanest approach.

Do I need to take additional steps because WhatsApp data is transferred abroad?

Yes. Because WhatsApp Business Platform uses Meta's infrastructure, data may be transferred to servers abroad, and this transfer is subject to Article 9 of KVKK. If there is no adequacy decision, you need to rely on appropriate safeguards such as standard contracts, notify the Authority within five business days of signing the standard contract, and state the transfer in your privacy notice.

Conclusion

For B2B SaaS companies, WhatsApp is a valuable channel that boosts meeting attendance, shortens the sales cycle and strengthens customer relationships. That value only materializes when it is set up correctly. The merchant exception gives you room under Law No. 6563. KVKK asks why and how you process data. And Meta looks at whether the recipient genuinely wants to hear from you. Once you build a consent structure that satisfies all three, WhatsApp stops being a risky shortcut and becomes a sustainable growth channel.

The practical summary: Use email, LinkedIn and phone for prospecting. Position WhatsApp as an accelerator for relationships where permission has been granted. Keep detailed consent records in your CRM, automate opt-out requests and keep message frequency low.

If you want to integrate WhatsApp into your sales and marketing processes in compliance with the regulations and build your consent infrastructure together with your CRM, get in touch with the SAAS Corner team. Let's map out a roadmap that fits your company's structure together.

Related Posts

• B2B Email Newsletters: How SaaS Companies Get Started
• B2B SaaS Content Marketing: Where Do You Start in Turkey?
• B2B SaaS Marketing Budget: What Percentage of Revenue Should It Be?
• What Is an MQL? MQL vs. SQL in B2B SaaS