Is it legal to check if a number is on WhatsApp? Consent and data-protection rules for businesses (2026)

Checking whether a phone number is on WhatsApp is not unlawful in itself, but whether your check is lawful depends on whose numbers you check, why, and which law applies. Checking your own customers to pick a channel for messages they expect usually fits data-protection law with a lawful basis, a clear notice and minimal storage. A registered number is never permission to message.

This is general information, not legal advice.

This guide is for businesses that hold a customer list and want to know which customers can be reached on WhatsApp, in Europe, South Asia, Southeast Asia, Latin America or the US. It covers the rules that apply to the check, which are mostly data-protection rules, and keeps them apart from the rules that apply to the message, which are WhatsApp's policies and messaging laws. For the workflow itself, see the bulk WhatsApp check guide.

#Is checking registration the same as permission to message?

No. They are two separate questions under two separate sets of rules, and mixing them up causes most compliance mistakes.

WhatsApp's Business Messaging Policy says you may only contact people on WhatsApp if they "have given you their mobile phone number or username" and you "have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you". You must also respect requests "to block, discontinue, or otherwise opt out". Meta's opt-in guide adds that businesses "must clearly state the business's name that a person is opting in to receive messages from" and "must comply with applicable law".

Nothing in a check result changes any of that. A registered: true answer means only that an account exists for the number. Our acceptable use policy states it directly: you must not "treat a result as consent to contact someone, or contact a person only because a result shows an account."

#What does the GDPR require for a WhatsApp check?

A lawful basis, a stated purpose, minimal data, a notice and a way to object. A phone number linked to a customer is personal data, and running a check on it is processing (our post on whether a phone number is personal data covers the definitions). The UK GDPR follows the same structure.

Lawful basis (Article 6). For checking existing customers, businesses usually consider legitimate interests (Article 6(1)(f)): getting service messages through, cutting failed sends, spotting mistyped numbers. The European Data Protection Board says the basis needs "three cumulative conditions": a legitimate interest, the need to process the data for it, and that the person's interests and rights "do not take precedence" (EDPB Guidelines 1/2024). The EDPB adds that controllers should "assess and document" this before processing. The UK regulator frames it as a purpose test, a necessity test and a balancing test (ICO). The balance is easier when the check serves the customer (their order update arrives) and harder when it serves outreach the customer never expected.

Data minimisation (Article 5(1)(c)). Check only the numbers you have a reason to check, request only the apps you will route on, and store only the answer and its date.

Transparency (Articles 13 and 14). People must be told the purposes of processing. If you collected the number from the customer, put the check in the notice you give at collection (Article 13). Where personal data was not obtained from the person, Article 14 sets out what to tell them and when. Either way, a line such as "we check which messaging apps your number can receive so we can send service messages by the right channel" is clearer than a generic "we may use third-party services".

Right to object (Article 21). Under legitimate interests, people can object. Build a suppression step so that an objecting customer is not checked again. Our privacy checklist for phone and e-mail checks walks through retention, DPAs and DPIAs in detail, so we don't repeat it here.

#What do India, Brazil and Malaysia require?

Each has a comprehensive law, but the bases for processing differ from the GDPR in ways that matter for a WhatsApp check.

India: Digital Personal Data Protection Act, 2023. Personal data may be processed only for a lawful purpose "for which the Data Principal has given her consent" or "for certain legitimate uses" (section 4). Consent must be "free, specific, informed, unconditional and unambiguous" and limited to what is necessary for the specified purpose (section 6). Unlike the GDPR, there is no general legitimate-interests basis. The closest legitimate use, in section 7(a), covers the "specified purpose for which the Data Principal has voluntarily provided her personal data", as long as she has not objected (DPDP Act). In practice, your sign-up and consent notices should name channel checks as part of the purpose. The government notified the DPDP Rules on 14 November 2025, and says they "introduce an eighteen-month period for phased compliance" (PIB, 2025). Plan now rather than at the deadline.

Brazil: LGPD (Law 13.709/2018). Article 7 lists the legal bases, including consent (item I) and processing "necessário para atender aos interesses legítimos do controlador" unless the person's fundamental rights prevail (item IX). Where you rely on legitimate interest, Article 10 §2 requires the controller to "adotar medidas para garantir a transparência". The necessity principle in Article 6 limits processing to "o mínimo necessário" for its purposes (LGPD). The structure is close to the GDPR's: a balancing test, a notice and minimal data.

Malaysia: Personal Data Protection Act 2010. The General Principle in section 6 says a data user shall not process personal data "unless the data subject has given his consent", with exceptions such as processing necessary "for the performance of a contract to which the data subject is a party". Section 6(3) adds that the data must be "adequate but not excessive" for a purpose "directly related to an activity of the data user", and section 7 requires a written notice of purposes (PDPA, Act 709). The Act was amended in 2024, and the regulator publishes the amendment and its commencement dates on the same page. Read the current text with your adviser.

Pakistan and Bangladesh. Bangladesh's Personal Data Protection Act, 2026 (Act No. 63 of 2026) was published in the Bangladesh Gazette on 10 April 2026 and is republished by the telecoms regulator (BTRC); we don't summarise its consent rules or commencement here. Pakistan has worked on comprehensive data-protection legislation, but at the time of writing we could not confirm from official sources a final law that would govern a check like this. For both, ask local counsel. Until you have advice, the baseline in this guide (own customers, stated purpose, minimal data, honoured objections) is a reasonable place to start. Our Bangladesh and Pakistan guides cover the local messaging rules.

#What applies in the United States?

There is no general federal privacy law like the GDPR. A Congressional Research Service overview describes federal data-protection statutes as "not comprehensive in nature", regulating "certain industries and subcategories of data" (CRS, 2022). State laws fill part of the gap. California's CCPA, for example, gives consumers rights including "the right to know about the personal information a business collects about them and how it is used and shared" and the right to delete it (California DOJ). Disclose checks in your privacy notice and make sure your provider acts as a service provider under its contract.

The TCPA (47 U.S.C. 227) restricts calls and texts, not data checks. A registration check sends nothing, so in our reading the TCPA governs what you send afterwards, not the check. Our TCPA checklist for SMS covers consent, opt-outs and quiet hours.

#How do the main laws compare?

The table compares the points that matter most for a check, not the laws in full.

#What should a business do, and not do?

Use the check to serve people who already deal with you, and leave everyone else alone.

WhatsApp's Terms of Service also forbid "bulk messaging, auto-messaging, auto-dialing, and the like" through the app. Business messages go through WhatsApp's business platform, to people who opted in.

#What should a responsible provider refuse?

Anything that looks like discovering people rather than checking customers. A provider that will check any range you send is a red flag for your own compliance.

• Enumeration. At MobileValidate, a request with 20 or more consecutive numbers is refused with 403 suspected_enumeration, every account has a daily cap on identifiers checked, and rate limits apply per key. The rules are in rate limits and abuse.
• Scraped or generated lists. Our acceptable use policy forbids checking ranges or generated lists "to discover who uses a platform", finding recipients for unsolicited messages, and building profiles of private individuals.
• Reverse lookups. Checks never return names, photos, profiles or online status, and we don't offer number-to-person lookups.
• Platform-specific authority. The policy also requires that your lawful basis covers checking a person's account on a named app. "A general marketing opt-in is not enough."
• Objections. People can exclude their number through our opt-out form. Suppressed numbers are skipped and never charged. Our notice to people whose number is checked explains what we hold and why.

#How long should you keep check results?

Only as long as you use them. For channel choice, that usually means the latest answer and its checked_at on the customer record, refreshed on a schedule. Delete the uploaded file and the full results once your systems are updated.

At MobileValidate the defaults are short. Real-time lookups are kept for 7 days. Bulk job inputs, results and downloads are kept for 30 days by default, adjustable from 1 day to 24 months, and you can delete a job at any time with DELETE /v1/jobs/{id}. A per-account check history (sealed number, answer and time) is kept for up to 400 days for your cache, billing evidence and disputes, as the DPA and privacy policy describe. Set your own retention to match your purpose, not ours.

Before a large run, the free estimate (POST /v1/jobs/estimate) shows the maximum cost, and unknown or inconclusive results are never charged. See current prices.

WhatsApp is named here descriptively. MobileValidate is not affiliated with WhatsApp or Meta. This article is general information, not legal advice, and laws change. Confirm what applies to your business with qualified counsel.

#What are the key takeaways?

• A check is not consent. registered: true means an account exists. WhatsApp's policy separately requires the person's number and opt-in for your business.
• The check is data processing. Under the GDPR you need a documented lawful basis (often legitimate interests), a notice and minimal storage.
• India and Malaysia lean on consent. The DPDP Act has no general legitimate-interests basis, and Malaysia's PDPA starts from consent, so name channel checks in your notices.
• Brazil's LGPD is closer to the GDPR, with a legitimate-interest basis, a transparency duty and a necessity principle.
• In the US, there is no general federal privacy law. State laws apply to the data, and the TCPA governs messages, not checks.
• Pick a provider that refuses enumeration, scraped lists and reverse lookups, and keeps data briefly. Start with the WhatsApp number check.