The WhatsApp Business Solution Terms are the contract every business accepts with Meta to use the WhatsApp Business Platform (the Cloud API), and they set the rules for accounts, fees, data use, AI providers and termination. In 2026 the old "Business Solution Terms" link redirects to the Meta Terms for WhatsApp Business Platform, which pull in the Business Messaging Policy and several data documents by reference, so in practice you are bound by a small stack of documents, not one.
This guide maps that stack in plain English for Indian businesses, including how it sits next to India's Digital Personal Data Protection Act, 2023. We read the current versions on Meta's and WhatsApp's own sites on 22 October 2026. Where a document did not say something, we say so instead of guessing.
This is not legal advice. It is an operator's summary written by a WhatsApp Business API provider. For decisions that carry legal risk, consult your own counsel and read the original documents.
What the WhatsApp Business Solution Terms are in 2026
For years, businesses and providers called the core API contract the "WhatsApp Business Solution Terms". That name still dominates search, which is why you probably typed it. When we opened whatsapp.com/legal/business-solution-terms in October 2026, it returned a permanent redirect to a page titled Meta Terms for WhatsApp Business Platform. That page lists a last-modified date of 23 September 2026 and links to archived versions.
The page itself does not mention its former name, so we will not claim a formal rename date. The practical point is simple: if a vendor, auditor or customer asks whether you have accepted the Business Solution Terms, the document they mean today is the Meta Terms for WhatsApp Business Platform.
There is also a sister agreement, the WhatsApp Terms for WhatsApp Business Platform, effective 23 September 2026, between your company and WhatsApp LLC (or WhatsApp Ireland Limited for companies in the European Region). Both are listed under "WhatsApp Business Platform" on the WhatsApp legal index. If any of the vocabulary here is new, keep our WhatsApp Business API glossary open in another tab.
The six documents a WABA owner is bound by
Here is the stack as we found it. Dates are the ones shown on each page when we read it.
| Document | What it covers | Date shown | What it means for you |
|---|---|---|---|
| Meta Terms for WhatsApp Business Platform (formerly reached as Business Solution Terms) | Accounts, fees, platform-use restrictions, AI providers, termination, confidentiality | Last modified 23 Sep 2026 | Core contract with Meta. Keep credentials secure, do not misuse platform data, pay per the Rate Card |
| WhatsApp Terms for WhatsApp Business Platform | Your responsibilities, enforcement, WhatsApp's data practices, liability, amendment | Effective 23 Sep 2026 | Honour every stop or opt-out request, give users proper notices, label marketing messages |
| WhatsApp Business Messaging Policy | Opt-in, opt-out, human escalation, prohibited and regulated uses, enforcement | Last updated 23 Sep 2026 | The day-to-day rulebook for who you may message and what you may send |
| Meta Commerce Policy (via the Messaging Policy) | Catalogs, payments and other selling features | Not checked separately | Applies if you sell through catalogs or commerce features |
| WhatsApp Business Data Processing Terms | WhatsApp acting as your processor for personal data in your customer data | Last updated 22 Aug 2025 | You are the controller. WhatsApp processes on your instructions |
| WhatsApp Business Data Security Terms | Minimum security standards WhatsApp maintains | 29 Oct 2020 | WhatsApp's own security baseline, not a list of duties for you |
| WhatsApp Business Data Transfer Addendum | Transfers of personal data that EEA or Swiss law covers | Last updated 16 Feb 2024 | Rarely relevant to a purely Indian business, but useful if you serve EU customers |
A note on the data documents: the Data Processing Terms apply only "to the extent that the Business Terms state that WhatsApp Processes Personal Information in your Customer Data as your Processor." The Meta Terms separately point to the Meta Global Processor Terms (MGPT) where Meta is your processor. Which data document governs a given flow depends on the product and contracting entity, so treat this table as a map, not a ruling.
Document by document: what each one obliges you to do
1. Meta Terms for WhatsApp Business Platform
This is the agreement most people mean by "Business Solution Terms". The contracting entity is Meta Platforms Ireland Limited, or Meta Platforms, Inc. for businesses in the United States or Canada. Its seven sections cover introduction, accounts, fees, platform use, term and termination, confidentiality, and general terms. The obligations that matter most in practice are:
- Accurate accounts. Account information must be accurate, current and complete, and your business name cannot mislead, infringe or impersonate.
- Security. Keep credentials secure, follow generally recognised industry security practices, and report suspected breaches promptly. The terms also state that the company is responsible for all activities occurring under its accounts.
- Platform-use limits. No profiling individual WhatsApp users from platform data, no selling or sharing that data (except with your Solution Provider), no reselling the platform, no scraping or reverse engineering.
- Sensitive data. Do not submit information that law requires special safeguarding for. The terms say the platform is not HIPAA compliant and make no promise that it suits regulated sectors such as healthcare, finance or legal services.
- Fees. Charges follow Meta's Rate Card, and you remain responsible for your own taxes.
- Requests from third parties. You are generally responsible for answering requests from regulators, users or law enforcement about your use, and you must give usage reports within 30 days if Meta asks.
The AI provider clause, section 4.7, sits here too. We cover it below because it confuses many chatbot buyers.
2. WhatsApp Terms for WhatsApp Business Platform
This second contract is with WhatsApp itself. It incorporates the Business Messaging Policy, and its company responsibilities section says you must comply with applicable laws, label marketing messages, provide the data disclosures and notices users need (such as a privacy policy), and "honor and comply with all WhatsApp user requests to stop or opt-out". On termination, it requires you to delete any user information obtained in breach of the terms. WhatsApp states it may keep account data for up to 90 days after termination.
3. WhatsApp Business Messaging Policy
The WhatsApp Business Messaging Policy, last updated 23 September 2026, is where the operational rules live. Its opt-in language is the line every Indian marketer should know: you may contact people only if they have given you their phone number and "you have received opt-in permission from the recipient confirming that they wish to receive" messages from you. The policy also makes the business solely responsible for its opt-in method and its compliance with law.
- Opt-out: respect all requests, on or off WhatsApp, to block, discontinue or otherwise opt out.
- Human escalation: automation is allowed, but you must offer prompt, clear and direct escalation paths, such as an in-chat agent, phone, email or a support form.
- Prohibited and regulated uses: illegal goods and services are banned, and categories such as alcohol, medical products and gambling are restricted or allowed only in listed countries.
- Enforcement: negative user feedback, harm or violations can lead to limits or removal of access, and the policy states it may be updated without notice.
For proof that your opt-ins will survive a review, see our guide to WhatsApp opt-in evidence for a Meta audit.
4. Meta Commerce Policy
The Messaging Policy has a Commerce Policy section. If you use catalogs or other selling features, you must comply with the Meta Commerce Policy. The business also stays solely responsible for its transactions, terms of sale and taxes, and WhatsApp does not process, pay for or fulfil the sale. If you sell supplements, cosmetics or anything near a restricted category, read our breakdown of WhatsApp Commerce Policy prohibited products in India before you build a catalog.
Get the DPDP WhatsApp checklist
A founder-led WhatsApp reply with the DPDP consent + audit-log checklist for WhatsApp Business messaging. India-hosted. No spam.
5. Data Processing Terms
The WhatsApp Business Data Processing Terms (last updated 22 August 2025) make you the controller and WhatsApp the processor for personal information in your customer data, within their stated scope. WhatsApp commits to process only on your instructions, bind its staff to confidentiality, apply technical and organisational security measures, and notify you "without undue delay" of a personal information breach. You authorise WhatsApp to use other Meta companies and third parties as sub-processors. You may object to a sub-processor change in writing, and if you do, your remedy is to stop using the services.
6. Data Security Terms and Data Transfer Addendum
The WhatsApp Business Data Security Terms (dated 29 October 2020) describe the minimum security WhatsApp maintains, such as access controls, staff training, security testing and an incident plan. They place duties on WhatsApp, not on you. The WhatsApp Business Data Transfer Addendum (last updated 16 February 2024) covers personal data that EEA or Swiss data protection law applies to, using mechanisms such as the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. The Data Processing Terms add that a separate Global Data Transfer Addendum applies elsewhere where WhatsApp LLC is the contracting entity. A purely domestic Indian business will rarely need to act on these.
Who agrees to what: business, BSP and Meta
A common misunderstanding is that signing up through a Business Solution Provider moves your compliance duties to the provider. The documents do not say that. Meta's terms define a Solution Provider as a third party authorised to use the APIs on a business's behalf, and call that business the Client. The provider has its own agreement with Meta; you still accept the platform terms for your own account.
| Party | What it agrees to | What it is responsible for in practice |
|---|---|---|
| Your business (the Company / Client) | Meta Terms and WhatsApp Terms for the Business Platform, Business Messaging Policy, Commerce Policy if selling, data terms where they apply | Opt-in and opt-out, message content, privacy notices, lawful use of data, activity under your accounts, taxes |
| BSP / Tech Provider (the Solution Provider) | Its own agreement with Meta, plus your contract with it | Running the API connection, protecting credentials and data it handles, following Meta's rules for providers |
| Meta / WhatsApp | Provides the platform under the published terms | Platform operation, processing as described in the data terms, enforcement, Rate Card charges |
Because the Messaging Policy makes the business solely responsible for its opt-in method, a good BSP can help with consent capture and audit trails, but it cannot carry that duty for you. Read your provider contract to see how it allocates liability between the two of you.
How changes take effect: continued use means acceptance
Both platform agreements contain an amendment clause. Section 7.1 of the Meta Terms for WhatsApp Business Platform states: "By continuing to access or use the WhatsApp Business Platform after any update, you agree to be bound by it." Section 13 of the WhatsApp Terms uses almost identical wording for the updated terms, and covers the policies incorporated by reference too. The Business Messaging Policy separately says it may be updated without notice.
In practice, your obligations can change on the date a page is updated, and you accept them by sending your next message. Put the legal pages on a quarterly review calendar.
The AI provider clause and your chatbot
Section 4.7 of the Meta Terms says providers and developers of AI or machine learning technologies are "strictly prohibited from accessing or using the WhatsApp Business Platform, whether directly or indirectly" for their primary AI functionality. The same section lets a business retain an AI provider as its Solution Provider. It also says you may not allow WhatsApp Business Platform data to be used to create, develop, train or improve AI systems, "provided that you may use WhatsApp Business Platform Data to fine-tune an AI Model that is for your exclusive use."
For an Indian business running a support or sales bot about its own products, this usually means business as usual, provided your vendor does not reuse your chat data to train its general models. Ask that question in writing. Our explainer on the WhatsApp AI chatbot policy for 2026 goes into the use cases in more depth.
How Meta's terms sit alongside India's DPDP Act
Meta's documents are a private contract. The Digital Personal Data Protection Act, 2023 is Indian law, and its obligations apply to you whatever your WhatsApp contract says. The two overlap in useful ways: both expect clear consent for marketing, an easy way to withdraw it, and notices that tell people how their data is used. They also differ. Meta can enforce by limiting or removing your access, while the DPDP framework has its own enforcement through the Data Protection Board.
| Topic | Meta and WhatsApp documents | DPDP Act layer (confirm with counsel) |
|---|---|---|
| Consent to message | Opt-in permission confirming the person wants your messages | Consent for processing personal data, subject to the Act and its rules |
| Withdrawal | Honour every block, stop or opt-out request, on or off WhatsApp | Withdrawing consent should be as easy as giving it |
| Notices | Provide necessary data disclosures, such as a privacy policy | Notice to the person describing the data and purpose |
| Security and breaches | Secure credentials, report suspected breaches to Meta | Reasonable security safeguards and breach intimation duties |
| Data use limits | No profiling or selling platform data, no AI training except exclusive fine-tuning | Use data only for the purpose consented to |
Timelines for specific DPDP obligations depend on the rules notified by the government, so check the current position before you design processes around a date. Our practical guide to DPDP Act opt-in compliance for WhatsApp in India walks through consent capture in more detail.
Practical compliance checklist for an Indian business
Use this as a starting point, not a substitute for advice. Each item maps to one of the documents above.
- Save a copy (PDF or archive link) of the Meta Terms, WhatsApp Terms and Business Messaging Policy with the date you reviewed them.
- Capture opt-in with the source, date, time and wording the customer agreed to, and keep separate consent for marketing and calls where you can.
- Act on every "STOP", unsubscribe request or block, including requests made by email or phone, and suppress that number across campaigns.
- Publish a privacy policy that explains WhatsApp messaging, and link it wherever you collect numbers.
- Offer a human escalation path in every bot flow, such as an agent handover, phone number or support email.
- Keep restricted products out of catalogs and campaigns unless the Commerce Policy allows them for India.
- Avoid sending health, financial or other sensitive data you do not need. The platform is not marketed for regulated sectors.
- Get written confirmation from any AI or chatbot vendor that your WhatsApp data is not used to train its general models.
- Restrict API access tokens to named staff, rotate them when people leave, and report suspected compromise promptly.
- Review the legal pages every quarter, since continued use means acceptance of any update.
Where RichAutomate fits
RichAutomate is a WhatsApp Business API provider for Indian businesses. We handle the API connection and consent-friendly tooling such as opt-out handling and human handover, but you still own your opt-ins and content. If cost matters to the decision, our WhatsApp API pricing is ₹0 setup, ₹0 monthly platform fee on the base plan, and ₹0.10 per message on Client Pay, with Meta billing its own charges directly.
Nothing here guarantees template approval or account safety. Meta enforces its own policies.
Ready to run WhatsApp the compliant way? Create your free RichAutomate account and connect your number in minutes.