Bulk sending to WhatsApp groups: why there's no safe way to do it

Bulk sending to WhatsApp groups has no authorized path: Meta's official API, the WhatsApp Business Platform, doesn't accept a group ID as a recipient — only an individual phone number. Every tool that promises otherwise is automating a regular session behind a QR code, and that session can be shut down by WhatsApp with no warning at all.

We're a biased source on this: CRPRO sells connections through both the official API and QR code. We could sell the second one as a "group bulk sender" and bill for it. We don't, and the whole reason is below.

Does Meta's official API send messages to groups?

It doesn't. On the WhatsApp Business Platform the recipient is always a number: you send to: 5511999999999 and that's it. There's no group field, no group endpoint, no group webhook. This isn't a temporary limitation waiting on a release — it's the product's design. Meta built the commercial platform on top of 1:1 conversations with traceable opt-in, because that's what it can audit and bill for.

What the official API does:

• Sends an approved template to an individual contact, starting a conversation.
• Sends a free-form message inside the 24-hour window opened by the customer.
• Refuses a send outside the window with error 131047, and refuses excess marketing volume with 131049.

What it doesn't do: join a group, read a group, post in a group, extract a group's members.

What do "group bulk sending" tools actually do?

None of them have privileged access to anything. All of them fall into one of these three categories.

Automation on top of the QR code session. The tool connects as if it were WhatsApp Web and starts operating your device remotely, using unofficial reverse-engineered libraries. To Meta, this is an unauthorized client — the same family of violation as GB WhatsApp and modified apps. It works because the session is yours, not because it was authorized.

Extracting contacts from groups. The most heavily marketed feature, and the most dangerous one: the tool scans the groups you're in, collects the members' phone numbers, and turns that into a list. At that point the "group bulk send" isn't even to the group — it's individual, to every stranger who happened to be in there. You're not running a campaign, you're cold-calling people who've never heard of your business.

Auto-joining public groups. Bots that mine chat.whatsapp.com links from directories, join the group, post the offer, and leave before getting removed. Real reach, zero engagement, a report guaranteed.

QR code and the official API: what changes when the penalty arrives

Here's the difference almost nobody explains properly. Not even the official API grants immunity from a ban — Meta keeps the field waba_ban_state in the account_update webhook, with values SCHEDULE_FOR_DISABLE, DISABLE, and REINSTATE, and error 368 exists precisely for a number blocked for a policy violation. A number on the official API can be banned.

The difference isn't immunity, it's visibility:

Does the quality rating warn you before the account drops?

It does, and that's the biggest practical advantage of the official API. The quality rating is calculated over the last 7 days, on a weighted basis — a criterion straight from Meta's own documentation, verified as of August 2026 — and it's visible in WhatsApp Manager and via the API, number by number. It's the dashboard that shows a campaign has soured before the account gets deactivated: green, yellow, red.

On a QR code connection, that dashboard doesn't exist. You only find out you crossed the line when the app opens asking for your number again, with no history, no appeal, and no warning. If it's already happened to you, the roadmap is in WhatsApp banned: what to do.

Why does the report come from people who don't know you?

Every one of WhatsApp's detection mechanisms runs on the recipient's reaction: block, report, silence. A customer base that asked for contact reacts well. A list extracted from a group reacts the opposite way — the person didn't give you the number, they gave it to the group.

Blocks and reports in the first few minutes are the worst possible signal, and on an extracted list they arrive concentrated: dozens of negative reactions in the same window, exactly the pattern Meta looks for. It's the textbook definition of spam to WhatsApp.

The opt-in rule is literal: you can only contact someone who gave you the number and gave permission. Being in the same group as you is neither of those things.

Does extracting group members' numbers violate data protection law?

A phone number is personal data. Collecting group members' numbers to use in a commercial campaign is data processing with no legal basis under Brazil's LGPD — the person joined a group, they didn't consent to your marketing.

Law 13,709/2018 (LGPD) provides for sanctions ranging from a warning to a fine of up to 2% of the company's revenue in Brazil, capped at R$50 million per violation (text in effect as of August 2026). In practice, what arrives before Brazil's data protection authority (ANPD) does is more mundane and just as costly: an irritated customer asking where you got their number.

CRPRO sells QR code — and still doesn't do group bulk sending

CRPRO connects through QR code for anyone who needs to organize support on a number that already exists, with history and real customers. That's legitimate use of the connection: multi-agent support, a pipeline, tags, quick replies.

What a QR code connection shouldn't turn into is a cold-sending machine, with or without a group in the mix. It's technically possible — and that's exactly why most of the market sells it. The cost nobody puts in the budget is the day the main number drops, taking every customer's history down with it.

If you're figuring out when each connection makes sense, when not to migrate to the official API covers the other side of that choice.

What to do instead of group bulk sending?

Four paths deliver reach without betting the company's number.

The admin-only group is the most underrated format on the list, and the 1:1 campaign is the only one that scales predictably. Worth remembering what the app's broadcast list doesn't solve: it only delivers to people who have your number saved in their contacts, which eliminates exactly the cold audience group tools promise to reach.

How much does sending a template through the official API cost today?

Meta has charged per delivered template message since July 1, 2025. The old per-conversation model is deprecated — be wary of any table still showing a price "per initiated conversation."

Compare that against the cost on the other side: a banned number has no price list, it has the value of the company's entire conversation history. The anti-ban playbook puts both on the same spreadsheet.

What changed in billing on October 1, 2026

Since October 1, 2026, service messages and utility templates sent inside the 24-hour window are charged per message. Service messages get no volume discount; utility and authentication keep theirs. The Click-to-WhatsApp 72-hour window didn't change.

The service-message rate is in Meta's current price table, and any figure circulating without citing it is a guess. The operational impact is detailed in October 2026's charge.

If your problem is organizing your base for campaigns that don't rely on a workaround, that's what CRPRO does — with the official API or QR code, you pick the connection knowing what each one costs.

Frequently Asked Questions

Can you send a message to a WhatsApp group through the official API?

No. The WhatsApp Business Platform only accepts an individual phone number as a recipient. There's no group endpoint, field, or webhook in the official API.

Can a tool that promises group bulk sending get my number banned?

It can. It operates on top of the QR code session using an unofficial library, and on the regular app Meta can deactivate the number with no advance warning.

Does the official API prevent my number from getting banned?

It doesn't. What it gives you is visibility and due process: per-number quality rating calculated over the last 7 days, the waba_ban_state state in the webhook, and a formal contest through Business Manager.

Is extracting group members' phone numbers illegal?

Using those numbers in a commercial campaign is personal data processing with no legal basis under Brazil's LGPD, with sanctions reaching 2% of revenue in Brazil, capped at R$50 million per violation. Being in the same group isn't the same as consent.

What's the cheapest alternative to reach a lot of people at once?

A group with sending restricted to admins, or a WhatsApp Channel: both are free, don't use the API, and don't expose members' numbers. For a segmented, measurable base, the path is a template through the official API.

How much does it cost to send a template today in Brazil?

Marketing runs around US$0.0625 per delivered message (~R$0.32), and utility and authentication sit around US$0.0068 (~R$0.035), rates in effect as of August 2026. Billing has been per message since July 1, 2025.