WhatsApp Marketing UAE and Saudi Arabia: Is It Legal?

WhatsApp marketing in the UAE, meaning promotional messages a business sends to customers on WhatsApp, is not banned. What the UAE telecom regulator restricts is voice and video calling over the internet, not text messaging. For marketing messages, the official sources we read point toward the same rule of thumb: ask the customer clearly, record the answer, and honour the stop.

This guide separates the two issues, shows what Meta, UAE and Saudi sources say, and marks plainly where the sources are silent.

General information, not legal advice. This article summarises public sources we read in October 2026. Laws and regulator guidance change, some texts are translations, and some questions below are unresolved. Check with a lawyer licensed in the UAE or Saudi Arabia before you launch.

Quick Answer

WhatsApp messaging is not banned in the UAE. TDRA regulates internet voice and video calls as a licensed activity and WhatsApp is not on its approved list, which is why calls fail and why searches say it is "banned" or "illegal". Marketing messages are a separate question. Meta requires opt-in. UAE telecom, telemarketing and data rules point to explicit prior consent. Saudi Arabia's data protection law requires consent for marketing and an easy way to stop. Where a rule's reach to WhatsApp is not spelled out, this article says so.

Table of Contents

• Is WhatsApp banned in Dubai? Calls versus messages
• What WhatsApp itself requires
• UAE rules on marketing messages
• Saudi Arabia rules on marketing messages
• What we could not confirm
• Checklist for DTC brands
• Where Tranthor fits
• FAQ

Is WhatsApp Banned in Dubai? Calls Versus Messages

Searches such as "why is WhatsApp banned in Dubai" and "why is WhatsApp illegal in UAE" most likely trace back to the calling restriction, which is a separate matter from messaging. Here is what the primary sources say.

TDRA's guidelines page calls internet voice and video calls VoIP, a regulated activity, and says licensed providers must block non-compliant VoIP apps. The list of apps it allows names Microsoft Teams, Zoom and BOTIM, among others, but not WhatsApp. The 2009 VoIP policy defines VoIP as voice telecommunications over IP, and we found no reference to text messaging in it or on the guidelines page. TDRA's FAQ adds that using VoIP that is not provided by or with a licensee, and is not approved by TDRA, may be a criminal offence, and that licensees will probably block the traffic.

The practical reading: WhatsApp messages and Business API template messages reach UAE customers, and WhatsApp calls do not. Do not plan on business voice or video calls over WhatsApp with UAE numbers. Meta lists call permission requests among its marketing template types, and our reading is that they are not worth using for UAE audiences. The TDRA pages are undated, so check the live list before relying on any of this.

What WhatsApp Itself Requires

Whatever local law says, Meta's rules apply to every business account. They are the easiest part to verify.

Meta's policy also says you choose the opt-in method and carry responsibility for it. Meta's opt-in page says permission can now be general rather than WhatsApp-specific, provided you comply with local law. Local law, not Meta's minimum, sets the bar, so do not treat a general marketing tick-box as settled for UAE or Saudi customers without advice.

UAE Rules on Marketing Messages

No single UAE instrument says what WhatsApp marketing requires. Four official instruments bear on it, and none of them names WhatsApp.

TDRA policy on unsolicited electronic communications

Version 1.1, issued 13 June 2022, applies to text messages with a UAE link, which includes a recipient physically in the UAE.

• Marketing sent without the recipient's consent is spam.
• Consent must be clear and storable, with records of date, time, wording and identity.
• Every marketing text needs a free opt-out, and none may be sent between 9 pm and 7 am.
• Reach: it is written for licensed operators. Its definition of mobile text messages names SMS and MMS without being limited to them, so a wider reading is arguable, but WhatsApp is not named.

Cabinet Resolution 56 of 2024 on telemarketing

The English text on the Ministry of Economy site defines telemarketing as marketing calls, including marketing text messages and marketing messages through social media applications, by companies licensed in the UAE, free zones included.

• Companies need prior approval from their licensing authority.
• They must not call numbers on the Do Not Call register for marketing, and must offer a channel for consumers who want marketing information and market only to those consumers.
• Calls are limited to 9 am to 6 pm. Penalties sit in a companion resolution, per u.ae.
• Reach: the definition covers social media app messages, but most operative rules are written for "Marketing Phone Calls". How they apply to opted-in WhatsApp messages is not spelled out.

Personal data law, Federal Decree-Law 45 of 2021

u.ae says it has been in force since 2 January 2022, covers processing through electronic systems inside or outside the country, and prohibits processing without the owner's consent, with exceptions. DLA Piper adds that data subjects can object to processing for direct marketing. It is channel-neutral, so it governs your customer data whatever channel you use. DLA Piper said the executive regulations were unpublished as of 6 January 2025, and we found no official confirmation either way.

Consumer protection law, Federal Law 15 of 2020

u.ae summarises it as protecting consumers' data and prohibiting suppliers from using it for marketing. The summary names no consent exception, and we could not read the article itself, so how it fits with the consent-based rules above is unsettled.

What this adds up to

Nothing we read supports marketing to someone who only gave you a number for a delivery. TDRA's SMS policy is the most specific local statement of what good consent looks like, and nothing suggests WhatsApp deserves a lower standard. That is an argument for prudence, not a legal conclusion that the SMS policy governs WhatsApp.

Saudi Arabia Rules on Marketing Messages

Personal Data Protection Law and its Implementing Regulation

Clyde & Co reports that consent is required to process personal data for advertising and direct marketing, that individuals need an easy way to stop at any time, and that consent must be documented per purpose. The law took effect on 14 September 2023 and enforcement began on 14 September 2024.

SDAIA's official guide adds three points:

• Consent can be withdrawn at any time (Article 5).
• Sensitive data, which includes health data, may not be processed for marketing even with consent (Article 26).
• The law reaches parties outside the Kingdom that process data of people residing there, so a UAE brand marketing to Saudi residents is likely in scope.

The guide also gives a scenario that matters to every DTC brand: an online store collects name, email and phone before a sale with no explanation or consent, then sends marketing. SDAIA calls this bad practice. The Implementing Regulation has been under consultation: Clyde & Co's May 2025 note says the draft kept the consent requirement and the duty to stop marketing after withdrawal, while proposing to drop the obligation to identify the sender. Check the current text before you finalise wording. The law is channel-neutral.

CST spam regulations

CST's decision page lists the Regulations for Curbing SPAM Messages and Calls, Decision 493/1444, which replaced earlier controls and takes effect 90 days after the decision date. It describes the aim as regulating the use of messages and calls. We could not open the full text, and the page does not say which channels are covered or what consent or hours rules apply.

E-Commerce Law

The official translation of Royal Decree M/126 requires an electronic advertisement to state the product, the provider's name and contact details (Article 10), bars false claims (Article 11), and lets the Ministry order a fix or withdrawal within one day (Article 12). Those articles cover online sellers' advertisements generally and do not address consent.

What We Could Not Confirm

• Whether TDRA's text-message policy, or the permit, Do Not Call and hours rules in Resolution 56, apply to opted-in WhatsApp marketing. No official page we read says.
• Whether the UAE personal data law's executive regulations have since been published.
• The full text of the CST spam regulations, including consent, hours and sender rules.
• The current wording of the Saudi Implementing Regulation after its consultation.
• Whether WhatsApp calling status has changed since the TDRA list we read. The UAE legislation portal blocked automated access, so we read the Ministry of Economy's English text of Resolution 56 instead.

Checklist for DTC Brands

Each step is the stricter reading of what the sources above support.

1. Use a separate opt-in. Add an unticked WhatsApp checkbox at checkout, apart from terms and from order updates. Name your brand and what you will send. (Meta opt-in guidance; SDAIA's bad-practice scenario.)
2. Keep service and marketing apart. Ask for order-update consent and offer consent separately. (Meta suggests per-category opt-in.)
3. Record consent. Store date, time, exact wording, number and channel. (TDRA's SMS policy; Saudi consent documentation.)
4. Honour stops straight away. Treat a WhatsApp stop as a stop on marketing everywhere. (Meta policy; Saudi PDPL; UAE data law.)
5. Use approved templates. Send business-initiated messages as approved templates in the right category. (Meta template rules.)
6. Send in daytime. TDRA bars marketing texts from 9 pm to 7 am, and we could not confirm whether that reaches WhatsApp, so default to daytime local hours.
7. Use your own list. Message only numbers customers gave you for this purpose. (Resolution 56, Article 6(4), on trading consumer data.)
8. Watch sensitive categories. In Saudi Arabia, take advice before using health-revealing purchase history for marketing. (SDAIA, Article 26.)
9. Keep ads honest. Identify your brand and avoid false claims. (Saudi E-Commerce Law, Articles 10 and 11.)
10. Watch quality signals. Review blocks, reports and per-user limits weekly, because Meta can limit sending.

An example opt-in line, to adapt with your lawyer:

[ ] Send me offers and product news from [Brand] on WhatsApp. I can reply STOP at any time. Order updates are covered separately.

For flows that depend on this consent, see WhatsApp abandoned cart recovery and replenishment email and reorder reminders. For market context, see ecommerce retention marketing in the UAE and in Saudi Arabia.

Where Tranthor Fits

Tranthor respects subscriptions and unsubscribes, and WhatsApp is live in its journeys. No tool replaces your own consent collection or legal advice, so settle the opt-in wording first. The AI CRM for ecommerce page explains how Tranthor runs retention for Shopify brands.

Sources: TDRA internet guidelines, TDRA FAQs, TDRA VoIP policy v2.0, TDRA unsolicited electronic communications policy v1.1, Cabinet Resolution 56 of 2024, English text, u.ae consumer protection, u.ae data protection laws, DLA Piper UAE data protection, WhatsApp business messaging policy, Meta: obtaining opt-in, Meta: send messages, Meta: template categorization, Meta: pricing, Clyde & Co on the Saudi Implementing Regulations, Clyde & Co on the 2025 consultation, SDAIA guide to the PDPL, CST decision 493/1444, Saudi E-Commerce Law (MISA translation).