PDPO and WhatsApp Marketing: What Hong Kong Businesses Must Do
Oct 9, 2026
By Sam Harper
This guide is general information, not legal advice.
Before using a customer’s personal data for WhatsApp marketing in Hong Kong, the Personal Data (Privacy) Ordinance requires you to tell them you intend to, specify what data you will use, inform them of their right to opt out, and obtain their consent. Consent under the Ordinance means an indication of no objection. Opt-out requests must be honoured free of charge.
When WhatsApp messaging counts as direct marketing
The PDPO defines direct marketing as offering or advertising goods, facilities or services, or soliciting donations, through communications addressed to a specific person. A WhatsApp marketing template sent to a named customer clearly qualifies. A transactional order confirmation generally does not.
The distinction matters because Part VIA obligations attach to marketing, not to service messages. A promotional broadcast is regulated. A shipping update is not.
Note that the Ordinance applies regardless of company size — a sole proprietorship carries the same obligations as a multinational.
What you must do before the first marketing message
Notify. Tell the customer, in a form they can understand, that you intend to use their personal data for direct marketing, which classes of data you will use, and the categories of goods or services you will market.
Inform them of the opt-out right. On first use of their data for direct marketing, you must tell them they can opt out, and provide a channel for doing so.
Obtain consent. Under the Ordinance, consent includes an indication of no objection. If consent is given orally, you must send written confirmation within 14 days.
Get separate, explicit consent to share. Providing personal data to a third party for that party’s own direct marketing requires its own written consent, and carries substantially heavier penalties.
What you must do on an ongoing basis
Maintain an opt-out list, keep it updated, and check it before every campaign. When a customer opts out, stop marketing to them and do not charge them for the request. Action opt-outs within a reasonable time.
Retain your consent records. If the Privacy Commissioner asks how you obtained consent for a specific number, the answer needs to be retrievable.
Penalties
Non-compliance with the direct marketing provisions is a criminal offence. Penalties escalate sharply for the more serious tier — providing personal data to a third party for direct marketing without consent carries a maximum of HKD 1,000,000 and up to five years’ imprisonment.
There is also a second statute to be aware of. The Unsolicited Electronic Messages Ordinance (Cap. 593) governs commercial electronic messages and imposes its own requirements. Whether and how it applies to WhatsApp specifically should be confirmed with counsel.
Where WhatsApp’s own rules sit on top
Meta requires opt-in before a business messages a user, and template messages must be approved before they can be sent. These are platform rules, not law — meeting them does not discharge your PDPO obligations, and meeting your PDPO obligations does not guarantee template approval.
You need both. In practice this means your opt-in flow should capture PDPO-compliant consent at the same moment it captures WhatsApp opt-in, and your records should show both.
A practical checklist
- Opt-in wording states the intended marketing use, the data classes, and the marketing categories
- Opt-out right disclosed at first marketing use, with a working channel
- Oral consent confirmed in writing within 14 days
- Separate written consent held before sharing data with any third party for their marketing
- Opt-out list maintained and checked before every send
- Opt-outs actioned promptly and free of charge
- Consent records retrievable per contact
- Reviewed by Hong Kong qualified counsel
Frequently asked questions
Do I need consent to send WhatsApp marketing in Hong Kong? Yes. The PDPO requires notification and consent before using personal data for direct marketing. Consent means an indication of no objection.
Does PDPO apply to transactional WhatsApp messages? The direct marketing provisions target marketing communications. Order confirmations and shipping updates are generally not direct marketing, though the general data protection principles still apply.
Is verbal consent enough? It can be, but you must send written confirmation within 14 days.
What happens if a customer opts out? Stop marketing to them, free of charge, within a reasonable time, and record the opt-out so it is checked before future campaigns.
Can I share my WhatsApp contact list with a partner? Not without separate explicit consent for that specific purpose. This is the most heavily penalised provision.
Does meeting Meta’s opt-in requirement mean I am PDPO compliant? No. They are separate obligations and you need to satisfy both.