WhatsApp Business API for Canadian Schools: Real Cost & PIPEDA

Regulatory notice: This article is for informational purposes only and does not constitute legal advice. For situations specific to your institution, consult a privacy lawyer or your privacy officer.

What changed in WhatsApp Business API pricing

Since 1 July 2025, Meta bills WhatsApp Business Platform messages one at a time, not by conversation window. Every delivered template message is charged individually, at a rate that depends on the template's category (marketing, utility, or authentication) and the recipient's country calling code.

Before that date, Meta used what it called "conversation-based pricing": a single charge opened a 24-hour conversation window, and every message sent inside that window — however many — was covered by the one fee, per Meta's own documentation of the (now deprecated) conversation-based model. That model no longer applies to any Canadian institution evaluating WhatsApp today; if a vendor or a BSP quotes it in the present tense, treat that as a signal their pricing information is out of date.

Under the current per-message pricing structure, two categories of messages remain free: service messages (free-form replies a school sends inside the 24-hour window an applicant opened by messaging first) and utility templates sent inside that same window. Everything else — proactive marketing templates, authentication codes, utility templates sent outside the window — is billed per message.

There is a further change Canadian admissions teams should track, not act on prematurely: Meta is expected to end the free-form-reply exemption inside the service window from 1 October 2026, according to early Business Solution Provider partner notices. No official Meta pricing page currently documents exact rates for that change, and any figure quoted for it today should be treated as provisional rather than budgeted.

The BSP: the mandatory middleman and its hidden cost

A school cannot buy meaningful WhatsApp Business Platform access directly from Meta at the volume admissions teams need. Access runs through a Meta-vetted intermediary — historically called a Business Solution Provider (BSP), now formally a "Solution Partner" in Meta's tiered partner ecosystem, with a lighter "Tech Provider" tier for smaller integrations, per Meta's overview of WhatsApp solution providers.

The BSP handles the parts a school cannot self-serve: template submission and approval tracking, dedicated number registration, quality-rating monitoring, and a multi-agent inbox so more than one admissions counsellor can work the same number. In exchange, the BSP layers its own software subscription on top of Meta's per-message fees — and that second layer is the cost most institutions miss when they estimate "what WhatsApp costs," because Meta's fee schedule is the only one that shows up in a first search.

What PIPEDA and CASL actually require for prospect messaging

Messaging a prospect on WhatsApp triggers two federal statutes in Canada, plus a separate platform rule from Meta — three distinct obligations, none of which substitutes for the others.

PIPEDA governs the underlying personal-information processing. Under the Personal Information Protection and Electronic Documents Act, a private institution needs meaningful consent before collecting, using, or disclosing a prospect's name, phone number, and conversation content through a WhatsApp thread. Because a WhatsApp message lands directly inside a prospect's personal messaging app, alongside messages from friends and family, express consent — a clear, proactive opt-in — is the defensible basis for this channel, in line with PIPEDA's consent principle (Principle 3).

CASL applies on top of PIPEDA, and it is the part institutions most often overlook. The Canadian Anti-Spam Legislation, enforced by the Canadian Radio-television and Telecommunications Commission (CRTC), regulates "commercial electronic messages" (CEMs) sent to an "electronic address" — a definition that the CRTC's own guidance confirms explicitly includes an instant-messaging account, not only email or SMS. A WhatsApp message promoting an open house, a program, or an application deadline reads as a CEM under that definition. Some compliance commentary treats messaging apps like WhatsApp as sitting in a historically under-enforced grey zone, but that reading rests on the CEM's commercial content, not on the channel being exempt outright — and it is not the position a Canadian institution should rely on. The safer, defensible approach is to treat any promotional WhatsApp message to a prospect as a CEM and apply CASL's three requirements in full: express consent obtained through a proactive opt-in, sender identification (institution name and contact information) in the message, and a working unsubscribe mechanism, processed within 10 business days, per the CRTC's guidance on implied and express consent.

CASL's consent clock also differs from PIPEDA's. Implied consent from a prospect's own inquiry — someone who messages the school first — lapses after six months if no further relationship is established; after that window, continued outbound commercial messaging needs express consent on file. Purely responsive service messages (a direct reply to a question the prospect just asked) sit outside the CEM definition, but proactive follow-ups, nurture sequences, and open-house reminders do not.

Meta's own opt-in requirement is separate again, and satisfying PIPEDA or CASL does not automatically satisfy it. Meta requires its own documented proof of opt-in before approving a business to message someone proactively — a narrower, more procedural check tied to template approval, independent of whatever legal basis the institution has under Canadian law. A school needs three things on file for the same prospect: a PIPEDA-compliant consent record, a CASL-compliant express-consent record with identification and unsubscribe mechanics, and a version of that consent that clears Meta's own bar.

For institutions recruiting in Quebec, Loi 25 layers provincial requirements on top of this federal framework — including stricter consent formalities and mandatory privacy impact assessments — so a Quebec-recruiting institution needs to satisfy PIPEDA, CASL, Meta, and Loi 25 simultaneously for the same WhatsApp thread. For a fuller treatment of how consent should be captured on the admissions form itself, see our guide on PIPEDA consent for the student application form.

How long to retain WhatsApp conversation data

For prospect and applicant data — anyone who has not yet enrolled — PIPEDA's limiting-retention principle (Principle 5) sets the ceiling: information must be kept only as long as necessary for the purpose it was collected for, then destroyed, erased, or anonymized. The Office of the Privacy Commissioner of Canada's retention guidance treats three years from the date of last active contact as the outer limit institutions can defend for prospect marketing data, WhatsApp conversations included.

That ceiling applies to conversation content and its associated metadata — timestamps, delivery status, template category — kept for prospecting purposes. It runs separately from the CASL implied-consent clock, which expires after six months if no relationship develops; a prospect can be inside the three-year PIPEDA retention window while already outside the six-month CASL window for further commercial messaging. Once a prospect enrols, the relationship changes and a different, longer retention schedule applies for the duration of enrolment. Our detailed breakdown of prospect data retention periods under PIPEDA covers how that transition should be reflected in a school's retention schedule.

Vendor chain: contracting with every processor

An institution running admissions through WhatsApp is rarely dealing with a single third party. Meta operates the platform itself; the BSP sits between the school and Meta; and if the institution layers a separate chatbot or CRM vendor on top to read and write WhatsApp conversations, that is a third, distinct party handling the same data flow.

PIPEDA's accountability principle (Principle 1) requires the institution to remain responsible for personal information even after it is transferred to a third party, and to ensure — through contract — that each party provides a comparable level of protection. PIPEDA does not use the term "data processing agreement" the way EU-style frameworks do, but the functional requirement is the same: a written agreement with each party in the chain specifying permitted purposes, prohibiting onward disclosure, requiring security safeguards, and mandating breach notification — not a single agreement covering "WhatsApp" as if it were one vendor. Skipping this because "the BSP handles compliance" is a common gap: a BSP's standard terms rarely extend to cover a separate chatbot vendor reading the same conversation thread. Our guide to PIPEDA-compliant chatbot vendors for Canadian schools sets out what to check in that specific agreement, including Canadian data-residency terms where a provincial statute restricts cross-border transfers.

The real cost: building the full budget

Meta's own fee schedule is the visible cost. It is rarely the largest one once an institution adds the BSP subscription, setup work, and the recurring costs that only appear after the number goes live.

An institution evaluating this budget alongside the return should weigh it against the broader chatbot deployment case: schools running an AI chatbot across their admissions funnel report +62% qualified leads and -38% cost per lead (€42 to €26), with 280% ROI within 12 months (Source: Skolbot median results across 18 partner schools, 2024-2025 — a general chatbot-deployment benchmark across all channels combined, not specific to WhatsApp). WhatsApp is one channel inside that funnel, and its cost structure should be assessed as an addition to that broader case rather than in isolation.

Setting it up: the concrete steps

Getting an admissions team live on WhatsApp Business Platform runs through a fixed sequence, most of which cannot be shortcut.

1. Create a Meta Business Manager account for the institution, if one does not already exist for its other Meta advertising activity.
2. Complete Meta Business Verification — the identity check that unlocks higher messaging tiers and is a prerequisite for most BSP onboarding flows.
3. Get WhatsApp Business Platform access through a BSP — in practice, this is how nearly every school accesses the platform at admissions scale, rather than through Meta's limited self-serve options.
4. Register a dedicated phone number for WhatsApp use, separate from any number already used for calls.
5. Create and submit templates for Meta approval, categorised correctly (marketing vs. utility vs. authentication) since misclassification is a common cause of rejection.
6. Monitor the quality rating once live — this is an ongoing task, not a one-off setup step, since the rating moves with applicant behaviour.
7. Integrate with the CRM or chatbot so WhatsApp conversations feed the same admissions pipeline as every other channel, rather than sitting in a separate inbox a counsellor has to check manually.

FAQ

Is WhatsApp Business API still billed by conversation?

No. That model — one charge per 24-hour conversation window, regardless of message volume inside it — was retired on 1 July 2025. Meta now bills per delivered template message, at a rate set by the template's category and the recipient's country. Any quote still describing conversation-based pricing in the present tense is out of date.

Does CASL apply to a school's WhatsApp messages to prospects?

Treat it as applying. CASL regulates commercial electronic messages sent to an "electronic address," a definition the CRTC's guidance confirms includes instant-messaging accounts. A promotional WhatsApp message — an open-house invitation, a program update — reads as a commercial electronic message and needs express consent, sender identification, and an unsubscribe mechanism, on top of whatever consent PIPEDA requires for the underlying data processing.

Does PIPEDA consent cover Meta's opt-in requirement too, or CASL's?

No. All three are separate. PIPEDA requires a lawful basis — express consent, in practice, for this channel — for the institution's own privacy compliance. CASL separately requires express consent plus identification and unsubscribe mechanics before sending a commercial electronic message. Meta separately requires its own documented proof of opt-in before approving templates for proactive messaging. Satisfying one does not satisfy the others; an institution needs a consent record that clears all three bars.

How long can a school keep WhatsApp conversation data for a prospect who never enrols?

Roughly three years from the date of last active contact, per the Office of the Privacy Commissioner of Canada's retention guidance under PIPEDA's limiting-retention principle. That runs on a separate clock from CASL's six-month implied-consent expiry, which governs whether further commercial messaging is allowed, not how long the data itself can be retained. Once a prospect enrols, a different, longer retention schedule applies for the duration of their relationship with the institution.

Who counts as a third party handling data in a school's WhatsApp setup?

Potentially three separate parties: Meta, the BSP, and — if the institution uses one — a distinct chatbot or CRM vendor that reads and writes WhatsApp conversations. PIPEDA's accountability principle requires a written agreement with each one specifying permitted uses and security safeguards, plus a check on where each party hosts data and whether provincial rules restrict transferring it outside Canada.

For the full governance framework this fits into, see our PIPEDA guide for student data in Canada.