The WhatsApp Business API, which Meta now calls the WhatsApp Business Platform, is the interface that connects WhatsApp to your own software. It lets you message many customers with approved templates, automate order notifications and answer messages from your own systems. Compared with the WhatsApp Business app, it adds scale and integration, along with Meta’s rules on templates, pricing and consent; in Turkey, Law No. 6563, the İYS consent registry and the KVKK data protection law also apply.
The WhatsApp Business app or the Platform?
WhatsApp’s Help Center positions the two products as follows; the Platform can be used directly or through a Business Solution Provider.
| Aspect | WhatsApp Business app | WhatsApp Business Platform |
|---|---|---|
| Built for | Small businesses | Medium and large businesses |
| How you use it | On a phone, single device | Through the API, from your own software or a console |
| Scale | Hundreds of customers | High volume, subject to messaging limits |
| Cost | Free | Per delivered template message |
Messages go through the Cloud API, and Meta’s documentation says you need a Meta business portfolio with a WhatsApp Business Account. In practice: if you chat with customers by hand, the app is enough; for automatic order notifications, campaigns to thousands or a shared inbox for several agents, you need the Platform.
Templates, the 24-hour window and pricing
The customer service window
A user’s message opens a 24-hour customer service window, which closes 24 hours after their last message. Inside it you can reply with free-form text, media or interactive messages. Under the WhatsApp Business Messaging Policy, only approved message templates may be sent outside the window. If you message a customer first, as in any bulk send, you must use a template.
Template categories
Meta’s categorization guidelines put every template into one of three categories:
- Marketing: awareness, sales and retargeting. Templates with mixed or unclear content default here.
- Utility: non-promotional messages triggered by a user action, such as order confirmations and shipping updates.
- Authentication: the only way to send one-time passcodes.
Templates are reviewed automatically; Meta says review can take up to 24 hours. An order update with a discount code counts as marketing, and since April 9, 2025 a template submitted as utility but judged to be marketing is approved as marketing. Templates with negative feedback or low read rates can be paused.
The pricing model (as of October 2026)
According to Meta’s pricing documentation:
- Since July 1, 2025, pricing is per message rather than per conversation, and you pay only when a template message is delivered.
- Non-template messages, meaning your replies inside the window, are free.
- Utility templates sent inside an open window are free; marketing templates are always charged.
- Rates depend on the template category, the country calling code of the recipient’s number and, for utility and authentication, monthly volume tiers. Turkey (+90) is listed as its own market.
- Meta changes prices only on the first day of a quarter, with advance notice.
Marketing templates drive the cost of bulk messaging; check Meta’s current rate cards before budgeting.
Opt-in, quality rating and messaging limits
Meta requires businesses to get opt-in before messaging someone. It must name the business the person agrees to hear from and can be collected on a website, by SMS, via a phone IVR flow or on a signed form. Meta recommends separate opt-ins per message type and stresses that complying with local law is up to you.
According to Meta’s Business Help Center, your number’s quality rating reflects how users responded to your messages over the past 7 days, especially block reasons and reports, and is shown as green (high), yellow (medium) or red (low). Block reasons include “Didn’t sign up” and “Spam”, the typical reaction of people who never opted in.
The messaging limit is the number of unique users you can message outside the customer service window in a moving 24-hour period, shared by all phone numbers in your business portfolio. New portfolios start at 250. After a step such as business verification, Meta reviews your message quality and, if approved, raises the limit to 2,000. It then moves automatically to 10,000, 100,000 and unlimited while you send high-quality messages and use at least half your limit over 7 days. Meta also caps how many marketing templates a single user receives, so not every marketing message will be delivered.
Consent in Turkey: Law No. 6563, İYS and KVKK
Meta’s rules do not replace local law. Below is a summary as of October 2026 for businesses messaging customers in Turkey. It is not legal advice; confirm your setup with a legal advisor.
Prior consent. Under Article 6 of Law No. 6563 on the Regulation of Electronic Commerce, commercial electronic messages may be sent only with the recipient’s prior consent. The law lists means such as phone, email and SMS and leaves the list open. WhatsApp is not named; the cautious approach is to treat WhatsApp campaigns like SMS and collect consent first.
İYS. The İleti Yönetim Sistemi (Message Management System) is the national database of commercial messaging consents, set up by TOBB, the Union of Chambers and Commodity Exchanges of Turkey, on the Ministry of Trade’s assignment. Under the Regulation on Commercial Communication and Commercial Electronic Messages, commercial messages may not be sent to recipients without consent recorded in İYS; consents collected elsewhere must be added within three business days or they are void. The İYS FAQ states that businesses sending commercial messages must register. İYS defines its channels as calls, messages and email, so ask your legal advisor where WhatsApp consents belong.
Collecting consent. Consent may be written, electronic or given through İYS; outside İYS it must include a positive statement, the recipient’s name and contact address. Electronic consent must be confirmed within 24 hours with a message offering an opt-out. You may not request consent through a commercial message, and the business carries the burden of proof, keeping records for three years after consent ends.
Exceptions. Article 6 of the regulation exempts informational messages about subscriptions, memberships, collections, debt reminders, information updates, purchases and deliveries from prior consent, as long as they promote no product or service.
KVKK. Law No. 6698 on the Protection of Personal Data, known as KVKK, governs processing of personal data such as phone numbers and conversations. It is separate from commercial messaging consent; İYS notes that KVKK consents need not be uploaded to it. Article 10 requires a notice at collection on who processes the data, why and on what legal basis; Article 5 lists grounds besides explicit consent, such as performance of a contract. If data goes to a service provider abroad, Article 9, amended in 2024, applies: without an adequacy decision you need a safeguard such as a standard contract, which must be notified to the Personal Data Protection Authority within five business days of signing.
Order notifications, webhooks and opt-outs
A typical e-commerce flow for order and shipping notifications:
- Your store sends a webhook to your system when an order is paid or shipped.
- Your system puts the order number and tracking code into a utility template and sends it via the Cloud API.
- Meta reports message statuses and customer replies to your webhook endpoint.
According to Meta’s webhook documentation, if your endpoint returns anything other than 200, Meta retries with decreasing frequency for up to 7 days, so duplicates can arrive; make sure each one is processed only once. The Graph API webhooks guide requires a valid TLS certificate and recommends validating requests with the X-Hub-Signature-256 header. Queuing notifications and processing them separately reduces timeouts at peak hours; see also our post on moving from a monolith to microservices.
Handling opt-outs
The WhatsApp Business Messaging Policy requires you to respect all requests to stop, made on or off WhatsApp. The Turkish regulation adds three duties: offer an easy, free opt-out through the same channel in every commercial message, stop sending within three business days, and report opt-outs received outside İYS to İYS within three business days. In practice, anyone who replies “STOP” (or “İPTAL” in Turkish) should drop out of your send lists automatically.
We built AntApp, a WhatsApp Business console on Next.js and Meta’s WhatsApp Cloud API, to bring these flows into one panel: bulk messaging, contact and list management, order and webhook automation, an inbox, opt-out protection for İPTAL/STOP replies and a WooCommerce plugin. See the AntApp case study. Whatever tool you use, keep legal steps such as İYS reporting in your process.
Frequently asked questions
Do order and shipping notifications need consent?
The Turkish regulation does not require prior consent for non-promotional purchase and delivery updates. Meta, however, requires opt-in for business-initiated WhatsApp messages. A checkout checkbox such as “Send my order updates on WhatsApp” covers both. Add a discount code and the message becomes marketing for Meta and may count as a commercial message under Turkish law.
Can I message a purchased phone list?
No. Meta requires opt-in to your business specifically, and İYS says each business must obtain its own consent, with narrow exceptions such as agency and dealership agreements.
Conclusion
The WhatsApp Business Platform is a practical way to automate customer communication, but it runs on rules: template categories, the 24-hour window, per-message pricing and quality ratings. In Turkey, prior consent, İYS registration, timely opt-out handling and KVKK notices come on top.
If you plan to connect WhatsApp to your order system or CRM, we would be glad to look at it with you: our web and mobile app development service covers the integration, and our software architecture and DevOps service the webhook and queue infrastructure.
