Can You Send WhatsApp Messages to a Purchased Contact List?
No, and the reason is narrower than most people think: consent is not transferable. Here is what Meta's policy actually says, what happens to your number when you try, and what to do with a list you already bought.
Short answer: No. Meta's WhatsApp Business Messaging Policy lets you contact someone only if they gave you their number and confirmed they want messages from your business. A purchased list fails both halves. The people on it gave their number to someone else, and whatever consent they granted named that other company, not you. Consent is not a transferable asset, which is why buying a list does not buy you permission.
This comes up constantly from businesses evaluating bulk messaging tools, usually in the form "I already have 40,000 numbers, can I just upload them?" The honest answer is that you can technically upload them, the first batch may even send, and the account will be in trouble within days. It is worth understanding exactly why, because the failure mode is faster and more permanent on WhatsApp than it is on email or SMS.
Why a purchased list fails the policy
The rule itself is one sentence. You may only contact people on WhatsApp if they have given you their mobile phone number, and you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you. Read that last word carefully. From you. Not from a data broker, not from the affiliate that ran the sweepstakes, not from the marketplace where the number was first typed in.
Meta loosened this rule in November 2024, and the change gets misread constantly. What Meta dropped was the requirement that consent be WhatsApp specific. You can now collect a general marketing opt-in on a checkout page or a paper form and use it for WhatsApp. What Meta did not drop is the requirement that the consent name your business. A broker's opt-in language names the broker or a generic "our partners," and courts and regulators have been skeptical of partner-list consent for two decades. So has Meta. The full breakdown of what the current policy does and does not require is in our guide to WhatsApp opt-in requirements and message examples.
What actually happens when you send to a bought list
The enforcement is not a compliance review. It is your own recipients, and it moves quickly.
WhatsApp is a personal messaging app where a stranger's message arrives in the same list as a text from a family member. The block button sits right there in the message header. Recipients who would silently delete a cold email will block a cold WhatsApp message, and a meaningful share will tap "report spam" on the way out. Those two signals feed your phone number's quality rating directly.
| Stage | What triggers it | Effect on your sending |
|---|---|---|
| Quality rating drops to medium | Blocks and spam reports from recent recipients | Warning in the manager, no hard limit yet |
| Quality rating drops to low | The pattern continues over a rolling window | Messaging tier is cut, often to the 250 recipient step |
| Template rejections | Reviewers see the pattern on new submissions | New campaigns cannot be approved |
| Number restricted | Sustained violations on the same number | Sending is paused for a set period |
| Number banned | Repeated or severe violations | The number is gone, along with its history |
The messaging tier is the part that hurts a growth plan. Tiers run 250, 2,000, 10,000, 100,000, then unlimited unique recipients per rolling 24 hours, and you climb by sending high quality volume over time. A bought list can knock you back to the bottom step in a week, and you climb back slowly. The mechanics of tiers and quality rating are covered in WhatsApp bulk messaging rules.
There is a second cost that catches people out. Registering a phone number to the WhatsApp Business Platform permanently removes it from the consumer and Business apps, and there is no history import. If the number you burn on a purchased list is the one printed on your storefront and your invoices, getting it banned is not a messaging problem, it is a business continuity problem.
But the seller says the list is opted in
They usually do. Ask two questions and the claim tends to collapse.
First, ask for the exact consent wording each record saw, plus the timestamp and the source URL. A legitimate data supplier can produce this per record. If the answer is a summary of the collection method rather than the wording and the date, there is no record to rely on. Second, read that wording and look for your business name. If it says the person agreed to hear from a category of partners, you were not named, and being one of four hundred unnamed partners is not the confirmation the policy asks for.
Co-registration and rented lists fail the same test for the same reason. So do lists scraped from directories, marketplaces, and group chats, which have no consent at all. Scraping also runs into a separate problem: the tools that puppet WhatsApp Web to send to scraped numbers violate WhatsApp's terms directly, which we covered in is bulk WhatsApp messaging allowed.
Does it change for B2B numbers?
Not under Meta's policy. It is written around the person receiving the message, and a business owner's mobile is still a personal handset. A publicly listed number is published so people can contact that business, which is not the same as that business asking to receive your campaigns. Plenty of B2B senders assume there is a professional-contact exemption here. There is not one.
Where US law sits on this
The TCPA was written for calls and texts to wireless numbers, and whether it reaches over the top apps like WhatsApp has not been settled the way it has for SMS. Some practitioners treat WhatsApp as outside the statute. Betting a marketing program on that reading is a poor trade, because the downside is per-message statutory exposure and the cost of doing it properly is a checkbox.
The practical position: collect consent to the standard you would use for SMS marketing, and keep the record. That clears Meta's rule comfortably and leaves you defensible under state consent statutes and unfair practice rules however the TCPA question eventually lands. This is general information rather than legal advice, so run your specific program past counsel.
What to do with a list you already bought
Do not upload it to WhatsApp. There are better uses for it.
If you have a lawful basis to reach those contacts on another channel, use that channel to earn a real opt-in. A short email or SMS explaining who you are, what you would send, and asking them to reply JOIN gives you a consent record with your name on it. Response rates are low, which is informative in itself: the share who say yes is roughly the share who would not have blocked you.
If the records are business numbers and the list was bought for outbound sales, calling is usually the more honest home for it than a messaging app people treat as personal space, and an AI calling assistant that qualifies leads and books meetings will get more out of those records than a broadcast that gets you blocked. Whatever you do with it, keep it separate from your WhatsApp contacts so a future list sync cannot pull it in by accident.
Build the list that does work
The sources that produce durable WhatsApp lists are the ones where the customer moves first: an unticked checkbox at checkout, a QR code on packaging, a chat widget on your site, and click to WhatsApp ads, which open a 72 hour window where every message is free. Each one produces a timestamped record naming you, which is exactly what a purchased list can never provide. The seven methods worth setting up are in how to build a WhatsApp opt-in list.
A list of 3,000 people who asked to hear from you will outperform 40,000 bought records on every metric that matters, and it will not cost you the phone number. Store the consent wording and date against each contact when you import, send your first campaign to a small batch, and let the quality rating climb before you scale. That is the whole method.
Can you send WhatsApp messages to a purchased list?
No. Meta's policy requires opt-in permission from the recipient confirming they want messages from your business specifically, and a purchased list carries consent given to someone else. Uploading one leads to blocks and spam reports, a falling quality rating, a reduced messaging tier, and eventually a restricted or banned number. Re-permission the contacts on a channel where you have a lawful basis, or leave the list alone.