The Law Your WhatsApp Bot Keeps Breaking

A business owner showed me his new WhatsApp automation last month, proud of it. It pulled every phone number his shop had ever collected — walk-ins, a raffle from two summers ago, people who’d once asked about a product — and it was ready to blast all of them a “limited-time offer.” He’d built something genuinely clever. He’d also built something that, under Israeli law, could cost him ₪1,000 per message if the wrong person decided to make a point of it.

He had no idea. Most owners don’t. And that gap — between how easy it now is to send a thousand WhatsApp messages and how little most people know about the law governing them — is quietly becoming one of the more expensive blind spots in Israeli small business.

The law nobody reads until it’s too late

Israel’s anti-spam rules live in Amendment 40 to Section 30A of the Communications Law (Telecommunications and Broadcasting). It came into force on December 1, 2008 — old enough that most of us were still deleting spam emails when it passed, young enough that it was written broadly on purpose. The drafters didn’t say “email.” They said advertising material sent by electronic means, and then listed the channels: SMS, fax, automated dialing systems, email — and, as the Ministry of Communications and every lawyer who’s written about it since has confirmed, any electronic messaging software. That includes WhatsApp. It was designed to.

The core rule is short enough to fit in a sentence: you may not send a person commercial advertising by these channels without their prior, explicit consent, given in writing. Israel runs an opt-in regime, modeled on the European privacy directive — not opt-out. The burden isn’t on your customer to escape your list. It’s on you to prove they asked to be on it in the first place.

And the penalty has teeth precisely because it skips the hardest part of most lawsuits. A court may award damages without proof of damage — up to ₪1,000 for each message sent in violation. Nobody has to demonstrate they lost money or suffered. The message itself, sent without consent, is the harm the statute recognizes. Multiply ₪1,000 by a contact list, and the clever broadcast that took ten minutes to set up becomes a number that gets a business owner’s attention very fast.

Where the actual risk lives

Here’s the part that matters, because it’s where most owners misjudge their own exposure in both directions.

The law targets דבר פרסומת — advertising material. A solicitation. An offer, a promotion, a “come back and buy.” That is the regulated thing. It does not reach the message a customer asked you to send. If someone messages your business first, and your bot replies — answers a question, confirms an appointment they booked, sends the tracking number for the order they placed — you are not spamming them. You are having the conversation they started. A bot that only responds to inbound messages is, in the eyes of this law, close to bulletproof.

The risk lives entirely on the other side: the outbound broadcast. The list you assembled from receipts and business cards and a form that never mentioned marketing. The “we miss you” campaign to people who bought once and never opted into anything. The offer pushed to a number you have only because someone once asked whether you were open on Friday. Technically impressive, legally naked.

This is why I’ve come to think the single most important design decision in any WhatsApp automation isn’t the AI model or the reply speed. It’s the direction of the first message. Build a bot that waits to be spoken to, and you’ve built something you can run for years without a lawyer’s number saved. Build one that speaks first, to people who never consented, and you’ve built a liability with a per-message price tag.

The inbound business is the safe business — and usually the better one

I’ll be honest about my own bias here, because it’s relevant. Most of the automation I build is inbound by design — bots that sit quietly until a customer reaches out, then handle the conversation well. Partly that’s the law. Mostly it’s that inbound simply works better.

My first client outside Israel makes the point better than any legal argument. She’s in Singapore. She found me not through a campaign or a broadcast — I’ve never sent one to Singapore in my life — but through an article, the same way you might be reading this one. She read it, decided she wanted to talk, and messaged on WhatsApp herself. That conversation became a paying engagement, and she has since pointed others my way. Zero unsolicited messages were involved. The entire relationship began because someone chose to start it.

That’s not a compliance strategy dressed up as a philosophy. It’s the actual shape of healthy demand. People who message you first are already interested, already qualified, already glad the channel is open. People you blast without permission are, at best, annoyed, and at worst, holding a ₪1,000-per-message statute. The businesses I watch struggle are almost always the ones trying to manufacture the second group instead of getting good at serving the first.

What to actually do about it

None of this means you can never market on WhatsApp. It means you have to earn the right to, on the record. Practically, for an Israeli business, that comes down to a few unglamorous habits: collect explicit consent to receive marketing — a checkbox, a written yes, something you can produce later — and keep the proof. Keep marketing separate from service; the reply to an inbound question is always fine, the unsolicited promotion is what needs consent. Honor “stop” the instant someone sends it, and make stopping easy. And when in doubt about whether a message is service or advertising, assume it’s advertising and ask yourself whether you have written permission for it.

The businesses that get this right aren’t the ones with the biggest lists. They’re the ones whose lists are small, clean, and consented — and who put their energy into being worth messaging in the first place. That’s slower. It’s also the only version that doesn’t come with a statutory price per mistake.

Your turn: If you run a business in Israel and use WhatsApp to reach customers — do you actually have documented, opt-in consent from the people on your list, or just their phone numbers? Be honest in the comments. I suspect the answer for most is “just the numbers,” and I’d rather you find out from a blog post than from a claim.

Achiya Cohen builds inbound-first WhatsApp bots and business automation for Israeli small businesses, on infrastructure the client owns. He writes about what actually pays off — and what quietly costs you — at achiya-automation.com.