WhatsApp banned for spam: what Meta actually counts as spam
By José Pedro · Co-founder of CRPRO
Most WhatsApp bans aren't caused by sending too much — they're caused by sending to someone who never authorized it. See what a valid opt-in requires, the content categories the policy bans outright, what actually triggers a report, and why the same violation ends differently on the regular app versus the official API.
Spam on WhatsApp, under Meta's policy, is a commercial message sent to someone who never gave explicit permission to receive it — and it's that definition, not the volume you send, that decides whether a number gets banned. Whoever gets WhatsApp banned for spam was almost never punished for the reason they imagine: it wasn't "sending too many messages," it was sending messages to someone who never authorized it. Consent, under the commercial messaging policy, isn't a recommended best practice — it's a written requirement, with an attached list of violation categories.
This guide reads the rule by its text: what the document requires, what makes a user hit "report," and why the same infraction ends one way on the regular app and another on the official API. If the number has already dropped, the review path is in WhatsApp banned: what to do. If the question is how the algorithm detects behavior, see what is spam on WhatsApp. Here the question is different: what's formally prohibited.
Do I need opt-in to message someone on WhatsApp?
Yes, and Meta's rule has two cumulative conditions. To contact someone through commercial WhatsApp, you need the person to have:
- given you the number, and
- given explicit permission to receive your messages through that channel.
Both together. This is where almost every Brazilian operation trips up, because the first one seems like enough. It isn't: someone who bought from your store gave you their phone number to enable delivery, and that isn't permission to receive a weekly promotion. Your order system's database is, at the same time, a list of legitimate contacts and a list with no opt-in for marketing — and that confusion is where most bans come from.
What form does a valid opt-in need to take?
Opt-in isn't just a generic "yes." To count, it needs to make clear who is going to message (the company's name, not a generic brand), through which channel (WhatsApp, explicitly), and what type of message the person will receive. Consent collected for "receive updates by email" doesn't carry over to WhatsApp. And it needs to be logged: in case of a dispute, proving consent — with a date and a source — is on you.
The corollary is uncomfortable but direct: a purchased list, a number scraped from a group, or an event contact with no checked box are violations from the very first message — even if you send just one, and even if nobody reports it.
What does the policy ban besides sending without opt-in?
The commercial messaging policy isn't a vague text about "using it responsibly." It points to a list of banned content and conduct categories, applying both to what you sell and to what you write. The families most relevant to anyone selling in Brazil:
| Family | What falls here | Where regular businesses trip up |
|---|---|---|
| Illegal or regulated products | Drugs, tobacco and vapes, weapons and ammunition, controlled medication | Pharmacies and tobacco shops advertising a catalog through messages |
| Health and the body | Supplements, medical products, weight-loss promises | Aesthetic clinics promising a specific result |
| Money and gambling | Real-money gambling, deceptive financial services, crypto assets | Promises of returns and "guaranteed extra income" |
| Adult content and exploitation | Sexual material, human exploitation, body-part sales | Rare in retail, fatal when it happens |
| Deception and third parties | False claims, brand impersonation, IP violations | Copying a bank's or courier's identity in a template |
| Sending conduct | Unsolicited messages, abusive automation, block evasion | The bulk of cases: sending with no opt-in |
The official definitions live in Meta's document and change from time to time — worth reading the current version before building a campaign in a regulated sector. For most businesses, though, what matters is the last row of the table: the top violation isn't banned content, it's sending conduct.
What actually triggers the penalty in practice?
Reports from recipients. Messages are end-to-end encrypted, so Meta doesn't read your text to decide if it's spam. It reads behavioral signals — and the "Report" button on conversations from strangers is the main input, with blocks right behind it.
Three triggers account for most reports:
- A first line with no context. "Hi, how are you?" from an unknown number is the scam script Brazilians have learned to report. Stating up front who you are and why you're messaging changes the report rate more than any other variable.
- No way out. Whoever can't find a way to leave reports, because reporting is the exit available to them.
- Frequency above what was agreed on. Consent came with an implicit contract about frequency. Exceeding it turns a satisfied customer into someone filing a report.
A report isn't a vote that needs a majority: it's weighted by the number's age, the volume sent, and the ratio between messages sent and replied to. A new number at high volume drops with very few reports.
Regular app vs. official API: what changes after the violation
Here's the distinction almost all market content gets wrong, in both directions. Some say the regular app is safe; others say the official API eliminates ban risk. Both claims are false. The substantive rule is the same on both channels: no opt-in, it's a violation. What changes is everything that happens after it.
| What happens after the violation | Regular app / WhatsApp Business | Official API |
|---|---|---|
| Warning before the penalty | None — can ban with no warning | An email notification, with a deadline to fix things before deactivation |
| Quality measurement | Invisible to you | Green/yellow/red quality rating, per number, calculated on a weighted basis over the last 7 days |
| Where you track it | Nowhere | WhatsApp Manager and via the API |
| Penalty progression | Can go from normal straight to permanent | Gradual, with visible signals before deactivation |
| Appeal | A generic form, with no trackable status | A formal appeal through Business Manager, with a trackable status |
| Machine-readable signal | Just the phone screen | The account_update webhook with the waba_ban_state field |
The quality rating's 7-day window is the detail that most changes your routine: the indicator doesn't reflect yesterday's campaign in isolation, it reflects accumulated recent behavior. Fixing the list's source today takes days to show up as green again.
Does the official API prevent my number from getting banned?
No. A number on the official API can be banned — the waba_ban_state field exists precisely because the penalty exists. The API's advantage isn't immunity: it's visibility and due process. The degradation arrives in stages, and each one has somewhere it can be seen:
| Signal, in the order it usually appears | What changes in sending | Where it shows up |
|---|---|---|
| Quality rating turns yellow | Nothing yet — this is the warning | WhatsApp Manager |
| Quality rating turns red | Sending limit reduced | WhatsApp Manager |
| A template paused or rejected | That template stops going out | WhatsApp Manager |
| The number restricted from initiating conversations | Only replies to inbound contacts work | An error on the send call |
| The account deactivated | Sending blocked, with error 368 | The account_update webhook |
That last state arrives in the webhook as SCHEDULE_FOR_DISABLE (scheduled, still appealable), DISABLE (applied), or REINSTATE (reverted after an appeal). On the regular app, the first news is usually the blocked-account screen — with no prior indicator, no warning, and no trackable appeal. Worth a warning in the opposite direction too: modified apps like GB WhatsApp and WhatsApp Plus violate the Terms just by existing on the device, regardless of what you send — detailed in is GB WhatsApp safe?.
Does sending a message outside the 24-hour window cause a ban?
On the official API, no — for a simple reason: it's impossible. A free-form message sent outside the 24-hour window comes back with error 131047, and only an approved template reopens the conversation. The platform prevents the infraction before it becomes a complaint.
On QR code, there's no such guardrail. Nothing stops you from sending to someone who talked to the business eight months ago. That freedom is real — and its cost is that the only barrier against the mistake is your team's discipline.
That doesn't make QR code indefensible: it handles legitimate cases, like a number that already has a history, a small operation, or reactive support. On CRPRO both paths exist, and the right choice depends on what you do with the channel. Whoever just replies to inbound contacts does fine on QR code. Whoever initiates conversations at volume is resting the whole operation on a channel that doesn't warn before it punishes.
Is there a daily limit on marketing messages?
There's a widespread claim that there's a cap of "2 marketing messages a day per user." There's no published figure. The limit is adaptive: calculated per end user and per business, and adjusted based on the engagement and reports that recipient and that sender accumulate. Exceeding it doesn't cause an instant ban — it triggers error 131049 on delivery.
In practice, it's a reputation score disguised as a quota. An engaged base receives more; a base that ignores and reports receives less, even if you change nothing in the campaign.
How much does it cost to send to a base with no opt-in?
Since July 1, 2025, Meta charges per delivered template message, no longer per conversation. In Brazil, marketing runs about US$0.0625 per delivered message (rate in effect as of August 2026) — close to R$0.32 per message at that same month's exchange rate.
Sending 10,000 marketing messages to a base with no opt-in, at that rate, costs about R$3,200. It isn't just regulatory risk: it's money paid to generate the reports that will take your number down. Details in official API pricing.
Checklist before your next campaign
- Can you prove the opt-in for every contact, with a date and a source? If not, that list doesn't go out.
- Did the consent name WhatsApp and your company specifically, or was it generic?
- Does the first line say who's speaking and why, before any offer?
- Is there an opt-out instruction, and does someone process people who ask to leave?
- Is your sector in one of the regulated categories from the table above?
- Do you have somewhere to check the number's quality before it becomes a problem?
If that last answer is "I have nowhere to check," that's the concrete gain of the official API: the indicator exists and the warning arrives before the penalty. And if the problem is filling the list with people who actually asked for contact, start by publicizing a WhatsApp link — whoever starts the conversation practically never reports.
Frequently Asked Questions
Does the official API prevent my number from getting banned?
No. Meta keeps the waba_ban_state field in the account webhook — with the states SCHEDULE_FOR_DISABLE, DISABLE, and REINSTATE — precisely because accounts on the official API can be deactivated. What the API gives you is visibility and due process: per-number quality rating, calculated on a weighted basis over the last 7 days, an email warning with a deadline to fix things, gradual penalties, and a formal appeal channel. On the regular app, the ban can arrive with no warning at all.
My customer has already bought from me. Do I still need opt-in?
Yes, for marketing messages. Having the number because of a purchase only satisfies the policy's first condition. The second — explicit permission to receive your messages on WhatsApp — needs to be collected and logged separately.
How many marketing messages can I send per day to the same person?
There's no published figure. The limit is adaptive, calculated per user and per business based on engagement and reports, and exceeding it makes delivery fail with error 131049. Any content claiming a fixed cap, like "2 per day," is making it up.
Can replying to a customer after 24 hours cause a ban?
Not on the official API, because it's impossible: the attempt returns error 131047, and only an approved template reopens the conversation. On QR code nothing stops the send — and that's exactly where the risk of a complaint over unexpected contact really exists.
Does a single report take down my number?
Rarely on its own, but reports don't work by majority. Their weight depends on the number's age, the volume sent, and the ratio between messages sent and replied to. A new number sending a lot drops with very few reports. It isn't a quota to manage: it's a signal to fix the list's source.