WhatsApp Business API for Australian Schools: Cost & Privacy Act

Regulatory notice: This article is for informational purposes only and does not constitute legal advice. For situations specific to your institution, consult a privacy lawyer or your privacy officer.

What changed in WhatsApp Business API pricing

Since 1 July 2025, Meta bills WhatsApp Business Platform messages one at a time, not by conversation window. Every delivered template message is charged individually, at a rate that depends on the template's category (marketing, utility, or authentication) and the recipient's country calling code — which, for an Australian admissions team, means the +61 rate card applies to every domestic prospect message.

Before that date, Meta used what it called "conversation-based pricing": a single charge opened a 24-hour conversation window, and every message sent inside that window — however many — was covered by the one fee, per Meta's documentation of the (now deprecated) conversation-based model. That model no longer applies to any Australian institution evaluating WhatsApp today; if a vendor or a BSP quotes it in the present tense, treat that as a signal their pricing information is out of date.

Under the current per-message pricing structure, two categories of messages remain free: service messages (free-form replies a school sends inside the 24-hour window an applicant opened by messaging first) and utility templates sent inside that same window. Everything else — proactive marketing templates, authentication codes, utility templates sent outside the window — is billed per message.

There is a further change Australian admissions teams should track, not act on prematurely: Meta is expected to end the free-form-reply exemption inside the service window from 1 October 2026, according to early Business Solution Provider partner notices. No official Meta pricing page currently documents exact rates for that change, and any figure quoted for it today should be treated as provisional rather than budgeted.

The BSP: the mandatory middleman and its hidden cost

A school cannot buy meaningful WhatsApp Business Platform access directly from Meta at the volume admissions teams need. Access runs through a Meta-vetted intermediary — historically called a Business Solution Provider (BSP), now formally a "Solution Partner" in Meta's tiered partner ecosystem, with a lighter "Tech Provider" tier for smaller integrations, per Meta's overview of WhatsApp solution providers.

The BSP handles the parts a school cannot self-serve: template submission and approval tracking, dedicated number registration, quality-rating monitoring, and a multi-agent inbox so more than one admissions counsellor can work the same number. In exchange, the BSP layers its own software subscription on top of Meta's per-message fees — and that second layer is the cost most Australian schools miss when they estimate "what WhatsApp costs," because Meta's fee schedule is the only one that shows up in a first search.

What the Privacy Act and Spam Act actually require

Messaging a prospective student on WhatsApp is personal information handling under the Privacy Act 1988, and it sits on top of a second, separate law that specifically governs commercial messaging: the Spam Act 2003. Both apply, and neither substitutes for the other.

Under the Australian Privacy Principles (APPs):

• APP 3 (collection) requires that personal information — a prospect's name, phone number, programme interest — is collected only by lawful and fair means, and only where reasonably necessary for the school's admissions function.
• APP 5 (notification of collection) requires the school to tell the prospect, at or before collection, who is collecting their data, why, and whether it will be disclosed overseas — relevant here because WhatsApp messaging routes through Meta's infrastructure, which is not exclusively Australian-hosted.
• APP 6 (use and disclosure) requires that personal information collected for one purpose — say, answering an open-day enquiry — is not used for an unrelated purpose, such as ongoing WhatsApp marketing, without a compatible secondary purpose or fresh consent.

The OAIC's guidance on the Australian Privacy Principles sets out these obligations in full, and applies to any TEQSA-registered provider with annual turnover above $3 million — a threshold virtually every private higher education institution exceeds.

Separately, the Spam Act 2003 regulates "commercial electronic messages," a category that the Australian Communications and Media Authority (ACMA) confirms covers instant messaging platforms, not only email and SMS. A promotional WhatsApp message about an open day or an application deadline needs the recipient's prior consent (express or reasonably inferred from an existing relationship), must clearly identify the school as sender with working contact details, and must include a functional unsubscribe mechanism that is honoured within 5 business days and stays active for at least 30 days. ACMA enforces the Act and has pursued civil penalties running into the millions of dollars against repeat offenders, so this is not a theoretical obligation for an institution running proactive WhatsApp campaigns at scale.

Meta's own opt-in rule stacks on top of both. Meta separately requires documented proof of opt-in before it will approve a marketing template for proactive messaging — independent of whatever legal basis the school has under the Privacy Act or whatever consent record satisfies the Spam Act. Satisfying one of these three obligations does not satisfy the other two: a school needs a consent record that clears the Privacy Act's collection and use tests, meets the Spam Act's consent-plus-unsubscribe standard, and matches the format Meta's template review expects.

How long to retain WhatsApp conversation data

For prospect and applicant data — anyone who has not yet enrolled — APP 11 sets the retention ceiling: an institution must take reasonable steps to destroy or de-identify personal information once it is no longer needed for the purpose it was collected for, per the OAIC's guidance on APP 11 — security of personal information. In practice, comparable Australian universities and private providers apply 3 years from the date of last active contact as the outer limit for pure-prospecting data — the same benchmark this blog uses for prospect retention generally, since it reflects the same underlying purpose-limitation logic regardless of channel.

That ceiling applies to WhatsApp conversation content and its associated metadata — timestamps, delivery status, template category — kept for prospecting purposes. Once a prospect enrols, the relationship changes: data can then be retained for the duration of enrolment plus a reasonable period afterwards, which is a separate retention schedule from the prospecting one and should be documented as such in the institution's data governance framework.

Vendor chain: contracting with every processor

A school running admissions through WhatsApp is rarely dealing with a single overseas party. Meta operates the platform itself, from US infrastructure; the BSP sits between the school and Meta, and may itself be a non-Australian company; and if the school layers a separate chatbot or CRM vendor on top to read and write WhatsApp conversations, that is a third, distinct recipient of the same data flow.

The Privacy Act does not have a direct equivalent to the EU's Article 28 processor-agreement regime, but APP 8 — cross-border disclosure of personal information does the equivalent work for any of these parties handling data outside Australia. APP 8.1 puts the accountability on the school: it must take reasonable steps to ensure each overseas recipient — Meta, the BSP, the chatbot vendor — handles personal information consistently with the APPs, and the school remains accountable if any of them breaches that standard. In practice, that means a written data-handling agreement with each party in the chain individually, not one agreement assumed to cover "WhatsApp" as a single vendor. Skipping this step because "the BSP handles compliance" is a common gap: a BSP's standard terms rarely extend contractual coverage to a separate chatbot vendor reading the same conversation thread.

The real cost: building the full budget

Meta's own fee schedule is the visible cost. It is rarely the largest one once a school adds the BSP subscription, setup work, and the recurring costs that only appear after the number goes live.

A school evaluating this budget alongside the return should weigh it against the broader chatbot deployment case: schools running an AI chatbot across their admissions funnel report +62% qualified leads and -38% cost per lead (€42 to €26), with 280% ROI within 12 months (Source: Skolbot median results across 18 partner schools, 2024-2025 — a general chatbot-deployment benchmark across all channels combined, not specific to WhatsApp). WhatsApp is one channel inside that funnel, and its cost structure should be assessed as an addition to that broader case rather than in isolation.

Setting it up: the concrete steps

Getting an Australian admissions team live on WhatsApp Business Platform runs through a fixed sequence, most of which cannot be shortcut.

1. Create a Meta Business Manager account for the school, if one does not already exist for its other Meta advertising activity.
2. Complete Meta Business Verification — the identity check that unlocks higher messaging tiers and is a prerequisite for most BSP onboarding flows.
3. Get WhatsApp Business Platform access through a BSP — in practice, this is how nearly every school accesses the platform at admissions scale, rather than through Meta's limited self-serve options.
4. Register a dedicated phone number for WhatsApp use, separate from any number already used for calls.
5. Create and submit templates for Meta approval, categorised correctly (marketing vs. utility vs. authentication), since misclassification is a common cause of rejection.
6. Monitor the quality rating once live — this is an ongoing task, not a one-off setup step, since the rating moves with applicant behaviour.
7. Integrate with the CRM or chatbot so WhatsApp conversations feed the same admissions pipeline as every other channel, rather than sitting in a separate inbox a counsellor has to check manually.

FAQ

Is WhatsApp Business API still billed by conversation?

No. That model — one charge per 24-hour conversation window, regardless of message volume inside it — was retired on 1 July 2025. Meta now bills per delivered template message, at a rate set by the template's category and the recipient's country code. Any quote still describing conversation-based pricing in the present tense is out of date.

Can an Australian school access WhatsApp Business Platform directly from Meta?

Not at the volume an admissions team needs. Meta offers limited self-serve options, but schools access the platform in practice through a Meta-vetted Business Solution Provider or Solution Partner, which handles template submission, number registration, and quality-rating monitoring — and charges its own subscription fee on top of Meta's per-message costs.

Does Privacy Act consent cover the Spam Act and Meta's opt-in requirement too?

No. These are three separate obligations. The Privacy Act's APPs govern lawful collection, notification and use of personal information; the Spam Act 2003 separately requires consent plus sender identification and a working unsubscribe function for any commercial electronic message, enforced by ACMA; and Meta requires its own documented opt-in before approving a template for proactive messaging. A school needs a consent record that satisfies all three.

How long can a school keep WhatsApp conversation data for a prospect who never enrols?

Around 3 years from the date of last active contact, under APP 11's requirement to destroy or de-identify personal information once it is no longer needed for its original purpose. Once a prospect enrols, a different, longer retention schedule applies for the duration of their relationship with the institution.

Who counts as an overseas recipient in a school's WhatsApp setup?

Potentially three separate parties: Meta, the BSP, and — if the school uses one — a distinct chatbot or CRM vendor that reads and writes WhatsApp conversations. Under APP 8, the school must take reasonable steps to ensure each of them handles personal information consistently with the APPs, typically through a written agreement with each party, and the school remains accountable if any of them fails to meet that standard.

For the full governance framework this fits into, see our Privacy Act guide for student data, our breakdown of prospect data retention periods, our guide to Privacy Act-compliant chatbot vendors, and how consent should be captured on the student application form.