Almost every Singapore business with a WhatsApp list has, at some point, sent the blast — a promotion, a new opening, a “we miss you” to everyone who ever left a number at the counter. It usually goes out on the assumption that WhatsApp is friendlier and more forgiving than SMS or email, closer to a conversation than a campaign, and therefore lighter on rules.
That assumption is wrong in a specific and expensive way. WhatsApp marketing to Singapore numbers sits under two separate statutes, each with a different trigger, a different set of duties and a completely different enforcement mechanism. One is enforced by a regulator with the power to impose financial penalties. The other is not enforced by a regulator at all — it is enforced by the people you messaged, in court, at a fixed rate per message. And the two disagree about what a WhatsApp message even is, which is the single most useful thing to understand about this channel.
This guide works through both from the primary sources, then covers the platform layer — Meta’s own message categories, pricing and messaging limits — because the commercial constraint and the legal constraint push in the same direction. It sits alongside our Singapore social media management guide; for the measurement side rather than the compliance side, our post on tracking calls and WhatsApp leads covers attribution and is not repeated here.
The point almost everyone gets wrong: WhatsApp is not SMS, and the law says so twice — in opposite directions
Start with the two statutes.
The Personal Data Protection Act 2012 (PDPA) contains the Do Not Call (DNC) Provisions in Part 9. Section 38 sets the scope: the Part “applies to a specified message addressed to a Singapore telephone number” where the sender or the recipient is present in Singapore. The PDPC’s own Advisory Guidelines on the Do Not Call Provisions then close the question for messaging apps. The guidelines state that the DNC Provisions “apply equally to all means by which a sender may send a specified message to a Singapore telephone number”, and define the exclusion negatively: they “do not apply to specified messages which are not sent to a Singapore telephone number, e.g. location-based broadcasts that are pushed to mobile phones through data-enabled smart phone applications or data applications that do not use a Singapore telephone number to send messages.”
Read that exclusion carefully. It carves out data applications that do not use a Singapore telephone number. WhatsApp does — the number is the account. So a marketing message sent through WhatsApp to a Singapore mobile number is a specified message addressed to a Singapore telephone number, and the DNC Provisions apply to it exactly as they apply to an SMS.
Now the Spam Control Act 2007 (SCA), which takes the opposite view of the same fact. Section 2 defines an “electronic address” as “an email address, an instant messaging account or a mobile telephone number to which an electronic message can be sent” — instant messaging accounts were added by the 2020 amendment, so WhatsApp is squarely in scope. But section 4A then says:
“For the purposes of this Act — (a) where an electronic message is sent to an instant messaging account; and (b) the name used to identify, or which is associated with, that instant messaging account is an email address or a mobile telephone number, the electronic message is not a message sent to the email address or mobile telephone number … mentioned in paragraph (b).”
So under the Spam Control Act, a WhatsApp message to +65 9XXX XXXX is a message to an instant messaging account, not to that mobile number. Under the PDPA, the same message is a message to a Singapore telephone number. Both are correct within their own statute, and the practical consequence is that you do not get to pick one. You have to satisfy both.
| PDPA Part 9 (DNC Provisions) | Spam Control Act 2007 | |
|---|---|---|
| Does it cover WhatsApp? | Yes — the message is addressed to a Singapore telephone number | Yes — an instant messaging account is an “electronic address” (s2) |
| What triggers the duty | Sending one specified message to a Singapore number | Sending unsolicited commercial messages in bulk (s11) |
| “Bulk” threshold | None — volume is irrelevant | >100 similar messages in 24 hours, >1,000 in 30 days, or >10,000 in a year (s6) |
| B2B carve-out | Yes — Eighth Schedule para 1(1)(g) | No equivalent carve-out |
| Who enforces | The PDPC, by direction or financial penalty (s48J) | Nobody. A private civil action by anyone who suffered loss (s13) |
| Exposure | Up to $200,000 (individual) or $1m (otherwise) for a Part 9 breach | Statutory damages up to $25 per message, capped at $1m (s14) |
What the DNC Provisions require before you press send
Section 43(1) is the operative duty: a person “must not send a specified message addressed to a Singapore telephone number unless the person has, at the time the person sends the specified message, valid confirmation that the Singapore telephone number is not listed in the relevant register.”
Three practical points follow.
A check has a shelf life. The PDPC’s guidance for organisations frames it as a “21-day DNC check validity”; older material citing 30 days is out of date. A segment checked five weeks ago is not covered.
Consent removes the need to check — but only real consent. Section 43(4) says you do not contravene the duty if the subscriber or user “gave clear and unambiguous consent to the sending of the specified message to that Singapore telephone number” and “the consent is evidenced in written or other form so as to be accessible for subsequent reference”. Both limbs matter. A verbal yes at the counter fails the second. A tick box labelled “I agree to the terms” fails the first. What passes is a specific, logged opt-in that names the channel.
Four exclusions do a lot of work. The Eighth Schedule takes several categories out of “specified message” entirely:
- Transactional (para 1(1)(d)): messages whose sole purpose is to facilitate, complete or confirm a transaction the recipient already agreed to, or to provide warranty, recall, safety or security information, or to deliver what they are entitled to. Your order-ready and delivery messages sit here.
- Ongoing relationship (para 1(1)(e)): a message sent during an ongoing relationship whose sole purpose relates to the subject matter of that relationship. “Ongoing relationship” is defined in para 1(2) as a relationship on an ongoing basis arising from the sender carrying on a business or activity.
- Market research (para 1(1)(f)): a message whose sole purpose is to conduct market research or a survey.
- B2B (para 1(1)(g)): a message sent to an organisation, other than an individual acting in a personal or domestic capacity, for a purpose of the receiving organisation.
Notice how hard the word sole works in (d) and (e). The moment your “your table is ready” message carries a line promoting next month’s set menu, it stops being a message whose sole purpose is transactional and the DNC duty comes back. That is the most common way a compliant messaging programme quietly becomes a non-compliant one: someone adds a promotional footer to a utility template because it looked like free reach. Get it wrong and section 48J applies — where a person intentionally or negligently contravenes a provision of Part 9, the PDPC may require payment of a financial penalty capped at $200,000 for an individual and $1 million otherwise.
A worked example: the reactivation blast
A Singapore retailer has 4,200 WhatsApp contacts collected over three years: some from an online form with a channel-specific tick box, some from a paper form at the counter, some typed into a staff phone off a delivery slip. It wants to send one promotional broadcast. The honest segmentation is not “everyone”. It is:
- Documented opt-in naming WhatsApp: send under s43(4), keep the evidence linked to each record.
- No documented opt-in, but an ongoing relationship and a message strictly about it: the Eighth Schedule may take it out of scope — but a discount on unrelated products does not relate to the subject matter of the relationship, and a promotional broadcast usually does not qualify.
- Everyone else: run a DNC check inside the 21-day window, suppress the listed numbers, and send only to the rest.
The check is the cheap part. The expensive part is discovering that the CRM never stored which consent each contact gave — a data-model problem, not a legal one, and one we cover in our comparison of CRM options for Singapore SMEs.
What the Spam Control Act requires — including the labelling rule that does not apply
The SCA is structured differently. Section 10 confines the operative Part to “unsolicited commercial electronic messages”, section 3 defines what makes a message commercial, and section 5 defines “unsolicited”: the recipient did not request or consent to it. Section 5(2) adds a rule worth pinning up — a recipient is not treated as having consented “merely because the electronic address of the recipient was given or published by or on behalf of the recipient”. Scraping numbers from a public directory, an industry listing or a shopfront sign gets you nothing.
Then section 11: a person who sends unsolicited commercial electronic messages in bulk must comply with the Second Schedule. Section 6 defines bulk as more than 100 messages with the same or similar subject matter in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year. Almost any real broadcast clears the first threshold.
The Second Schedule is where the surprise lives.
Paragraph 2 — the unsubscribe facility — applies to WhatsApp. Every unsolicited commercial message must contain an email address, an internet location address, a telephone number, a fax number or a postal address the recipient may use to submit an unsubscribe request, plus a clear and conspicuous statement in English saying so. That address must stay valid and able to receive requests for at least 30 days after the message is sent, must be legitimately obtained, and must not cost the recipient more than normal to use. Paragraph 2(7) then sets the clock: once someone unsubscribes, no further unsolicited commercial messages may be sent after 10 business days.
Note what paragraph 2(3) does not say. It prescribes a reply-by-text route only where the message was received by text or multimedia messaging to a mobile number. For an instant messaging account there is no prescribed in-channel route, so any of the listed address types will do — which in practice means a link, and a link is easier to instrument than a keyword reply anyway.
Paragraph 3 — the <ADV> label — does not apply to WhatsApp. Paragraph 3(1) requires the letters “<ADV>” before the title in the subject field, non-misleading header information, and a working contact address. Paragraph 3(3), added by the 2020 amendment, then states plainly: “Sub-paragraph (1) does not apply to any unsolicited commercial electronic message that is sent to an instant messaging account.”
So the widely repeated advice to put <ADV> on WhatsApp blasts is wrong. It is required for SMS and email; it is expressly disapplied for instant messaging. You still need the unsubscribe facility.
Who can sue you, and for how much
The Spam Control Act has no regulator and no fines. Section 13 gives “any person who has suffered loss or damage as a direct or an indirect result” of a contravention a right to sue the sender — or anyone who aided, abetted, induced, was knowingly concerned in, or conspired to bring about the contravention under section 12(1).
Section 14 then sets the remedy. A claimant elects between actual damages and statutory damages of up to $25 per message, capped at $1 million in aggregate unless actual loss exceeds that. In assessing statutory damages the court considers whether the contravention was wilful, the loss suffered, the benefit that accrued to the defendant, and the need to deter. Section 15 lets the court add costs and legal costs on top.
The arithmetic is what makes this real: a 4,000-recipient broadcast with no unsubscribe facility is, on its face, up to $100,000 of statutory damages exposure without anyone having to prove a dollar of loss.
One more provision catches agencies and affiliates. Section 3(4) deems a person who knowingly allows their product or service to be advertised by a sender to have authorised that sending — unless, under section 3(5), they took reasonable steps to stop it. Section 7 sets the reach: the Act applies wherever the message has a Singapore link, including a sender formed in Singapore or with an office here.
Everything above concerns messages. If your team also picks up the phone — or places calls over WhatsApp, which the Regulations expressly treat as a specified voice message — a different register and a different set of duties apply, including a 21-day validity clock on every check and a charge per number checked. We cover that half of the regime in our guide to telemarketing rules and the DNC Registry in Singapore.
The platform layer: what Meta charges you, and what it limits
The legal constraints have a commercial twin, and they point the same way.
Meta’s WhatsApp Business Platform sorts template messages into four categories — marketing, utility, authentication and service — and, in Meta’s own words, “you are only charged when a template message is delivered”. Charges are “based on the country calling code of the recipient WhatsApp phone number”, so your Singapore list is priced on the Singapore rate card regardless of where your business sits.
Three windows change what you pay:
- The 24-hour customer service window. When a user messages you first, a 24-hour window opens in which you can send any message type at no cost. Once it closes, only template messages can be sent.
- The 72-hour free entry point. A user who reaches you through a Click-to-WhatsApp ad or a Facebook Page button opens a 72-hour window, from your first response, in which all messages are free regardless of category.
- Service conversations have been free since 1 November 2024.
Then the volume ceiling. Meta’s messaging limits cap how many unique customer phone numbers you can message in a rolling 24 hours outside customer service windows, in tiers: 250, 2,000, 10,000, 100,000, unlimited. You reach the 2,000 tier by verifying your business, through partner-led verification, or by sending 2,000 delivered messages outside customer service windows to unique numbers within a 30-day moving period “using templates with a high quality rating”. Beyond that, you advance when you use at least half your current limit with high-quality messages — and the limit then increases by one level within six hours.
| Constraint | What it actually limits | What fixes it |
|---|---|---|
| Message category | Whether a send is billable at all, and at what rate | Designing genuinely utility-shaped messages instead of dressing marketing as utility |
| 24-hour service window | Whether you may reply freely or must use a template | Inbound-first journeys: ads and buttons that make the customer message you |
| Messaging tier | Unique recipients per 24 hours outside a window | Business verification, then sustained high-quality volume |
| Quality rating | Whether you advance tiers at all | Blocks and reports — i.e. list hygiene and relevance |
Read the last two rows next to the legal section and the picture resolves. The behaviour the Spam Control Act penalises — messaging people who never asked, with no easy way out — is the same behaviour that raises your block rate, which is the same behaviour that stops you advancing a messaging tier. On WhatsApp, compliance and deliverability are not two projects. They are one.
How to build the list so both statutes are satisfied at once
The opt-in has to do two jobs: satisfy section 43(4) of the PDPA (clear, unambiguous, channel-specific, evidenced in accessible form) and defeat “unsolicited” under section 5 of the SCA (the recipient requested or consented to the message).
A line that does both reads something like: “Send me offers and updates from [business] on WhatsApp at this number. I can stop them any time by replying STOP or using the link in any message.” Unticked by default, next to the number field, not buried in linked terms. What you store alongside the number is the part most systems get wrong: the exact wording shown, the timestamp, the source page or form, and the channel consented to.
Four operational habits follow from the statutes:
- Keep a suppression list that never gets rebuilt. A list wiped during a tool migration is how a business unsubscribes someone twice.
- Separate utility templates from marketing templates in the tool, not just in your head. The Eighth Schedule exclusions turn on “sole purpose”, so a promotion inside an order confirmation collapses the exclusion.
- Re-check DNC inside the 21-day window for every send that relies on checking rather than consent.
- Audit your affiliates and resellers. Written channel rules and a periodic spot-check are the “reasonable steps” section 3(5) asks for.
The mirror image of all this is SMS, where the same two statutes land almost inversely: the <ADV> label that paragraph 3(3) disapplies here does apply to a text, and paragraph 2(3) demands a mobile number the recipient can text back to unsubscribe. There is also a gate before any of it, because you cannot send under a brand name at all until that Sender ID is registered and paid for. We work through both in our guide to SMS marketing in Singapore.
Where WhatsApp earns its place — and where it does not
WhatsApp is at its strongest where the message is genuinely wanted and time-bound: appointment and booking confirmations, order and delivery status, a reply to a question the customer asked first. Those sit inside the transactional and ongoing-relationship exclusions, inside the free 24-hour window, and they generate the inbound behaviour that keeps your quality rating up.
It is at its weakest as a broadcast substitute for email, which has no DNC equivalent for addresses, a much lower marginal cost per send, and a far better home for long-form content. Before moving a newsletter across, read our guide to email marketing in Singapore and our Mailchimp vs Klaviyo comparison — the latter works through the Spam Control Act duties as they apply to email, which is where the <ADV> label does bite.
If the reason you want WhatsApp is that it is where your community already talks, that is a different job: our post on community management in Singapore covers running the conversation, our social media content calendar guide covers planning around it, and our organic versus paid social comparison is the honest framing on where the effort belongs. And if your campaign runs a giveaway, a separate regime applies on top of everything above — see our guide to lucky draw and contest rules in Singapore.
Frequently asked questions
Do I need to put <ADV> on a WhatsApp marketing message in Singapore?
No. Paragraph 3(3) of the Second Schedule to the Spam Control Act 2007 expressly disapplies the labelling requirements to “any unsolicited commercial electronic message that is sent to an instant messaging account”. The <ADV> label is still required for SMS and email. The unsubscribe facility in paragraph 2 does apply to WhatsApp.
Do the Do Not Call Provisions apply to WhatsApp, or only to SMS and calls?
They apply. Section 38 of the PDPA covers a specified message “addressed to a Singapore telephone number”, and the PDPC’s Advisory Guidelines state the Provisions apply to all means of sending such a message, excluding only applications that do not use a Singapore telephone number. WhatsApp uses the number as the account identifier, so it is in scope.
How long is a DNC Registry check valid for?
The PDPC’s guidance for organisations refers to a 21-day DNC check validity. Material citing a 30-day period predates the current position. If your segment was checked more than 21 days before the send, check again.
Can I message business contacts on WhatsApp without a DNC check?
The Eighth Schedule to the PDPA excludes from “specified message” any message sent to an organisation, other than an individual acting in a personal or domestic capacity, for a purpose of the receiving organisation. That takes genuine B2B messaging outside the DNC Provisions. It does not take it outside the Spam Control Act, which has no equivalent B2B carve-out.
What happens if someone unsubscribes from my WhatsApp broadcasts?
Under paragraph 2(7) of the Second Schedule to the Spam Control Act, no further unsolicited commercial messages may be sent after 10 business days from the day the request was submitted. The address you provide for unsubscribe requests must remain able to receive them for at least 30 days after the message was sent.
My agency sends the WhatsApp campaigns. Is the liability theirs?
Not exclusively. Section 3(4) of the Spam Control Act deems a person who knowingly allows their product or service to be advertised by a sender to have authorised that sending, unless under section 3(5) they took reasonable steps to stop it. Section 12(1) separately reaches anyone knowingly concerned in a contravention. Under the PDPA, section 37(3) contains a comparable deeming provision. Both statutes are built to reach the brand behind the send.
The summary, if you take one thing
WhatsApp is not a lighter version of SMS. It is a channel where two statutes apply with different triggers, where one is enforced by the recipients rather than a regulator, and where the platform’s own quality mechanics punish exactly the behaviour the law punishes. The businesses that do well on it are not the ones with the biggest lists — they are the ones whose lists are small enough that every recipient remembers asking. Our Singapore client case studies show what a properly-consented channel does over time, and our guide to the PDPA, marketing and tracking in Singapore is where to start if consent records, tracking and channel rules have never been looked at as one system.
Want a second pair of eyes on your messaging programme before the next broadcast goes out? Talk to our social media marketing team about how your list, consent records and templates are set up — and what would have to change.
Sources, all read directly: Spam Control Act 2007 (ss 2, 3, 4A, 5, 6, 7, 9–15 and the First and Second Schedules) and Personal Data Protection Act 2012 (ss 36–38, 43, 43A, 48J and the Eighth Schedule), Singapore Statutes Online; PDPC, Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021); PDPC, Do Not Call Registry business rules for organisations; Meta, WhatsApp Business Platform pricing and messaging-limits documentation. Last updated 3 September 2026. Written by Adrian Tan and the SDM team. General information about how these rules are written, not legal advice.
