WhatsApp Business API for Schools: Real Cost & TCPA Rules

Regulatory notice: This article is for informational purposes only and does not constitute legal advice. For situations specific to your institution, consult a data-privacy attorney or your privacy/compliance officer.

What changed in WhatsApp Business API pricing

Since July 1, 2025, Meta bills WhatsApp Business Platform messages one at a time, not by conversation window. Every delivered template message is charged individually, at a rate that depends on the template's category (marketing, utility, or authentication) and the recipient's country calling code.

Before that date, Meta used what it called "conversation-based pricing": a single charge opened a 24-hour conversation window, and every message sent inside that window — however many — was covered by the one fee, per Meta's own documentation of the (now deprecated) conversation-based model. That model no longer applies to any school evaluating WhatsApp today; if a vendor or a Business Solution Provider (BSP) quotes it in the present tense, treat that as a signal their pricing information is out of date.

Under the current per-message pricing structure, two categories of messages remain free: service messages (free-form replies a school sends inside the 24-hour window an applicant opened by messaging first) and utility templates sent inside that same window. Everything else — proactive marketing templates, authentication codes, utility templates sent outside the window — is billed per message.

There is a further change to track, not act on prematurely: Meta is expected to end the free-form-reply exemption inside the service window starting October 1, 2026, according to early BSP partner notices. No official Meta pricing page currently documents exact rates for that change, so any figure quoted for it today should be treated as provisional. Our companion article on what the October 2026 billing change means for a school covers the applicant-experience side of that shift.

The BSP: the mandatory middleman and its hidden cost

A school cannot buy meaningful WhatsApp Business Platform access directly from Meta at the volume admissions teams need. Access runs through a Meta-vetted intermediary — historically called a Business Solution Provider (BSP), now formally a "Solution Partner," with a lighter "Tech Provider" tier for smaller integrations, per Meta's overview of WhatsApp solution providers.

The BSP handles what a school cannot self-serve: template submission and approval tracking, dedicated number registration, quality-rating monitoring, and a multi-agent inbox so more than one admissions counselor can work the same number. In exchange, it layers its own software subscription on top of Meta's per-message fees — the cost most schools miss when they estimate "what WhatsApp costs," because Meta's fee schedule is the only one that shows up in a first search.

What US privacy law actually requires for prospect messaging

Messaging a prospective student on WhatsApp is not governed by a single federal privacy statute — it sits at the intersection of telemarketing law, state consumer-privacy law, and Meta's own platform rules, and getting the framework wrong is the most common compliance mistake schools make on this channel.

The Telephone Consumer Protection Act (TCPA) is the primary federal exposure. The FCC has consistently treated text messages sent through automated platforms as "calls" for TCPA purposes, and that interpretation extends to messages sent through business messaging platforms like WhatsApp, per the FCC's guidance on prior express written consent. Marketing messages sent to a wireless number through an automated system require prior express written consent before the first message goes out; a lower "prior express consent" standard applies to purely transactional or informational messages. The FCC's one-to-one consent rule, effective January 2026, adds two practical constraints: consent obtained for one sender cannot be shared with or resold to another organization, and a prospect must be able to revoke consent through any reasonable method, not only by replying "STOP." TCPA violations carry statutory damages of $500 to $1,500 per message, which is why plaintiffs' firms actively monitor education-sector text and WhatsApp campaigns; treating WhatsApp outreach as exempt from TCPA because "it's not SMS" is a costly assumption to get wrong.

State privacy law adds a second layer, led by the California Consumer Privacy Act (CCPA) as amended by the CPRA. Any school recruiting nationally will reach California residents, which brings CCPA/CPRA's opt-out-of-sale-and-sharing framework into play: prospects have the right to know what personal information a school or its WhatsApp vendors collect, and to opt out of its sale or sharing for cross-context advertising, per the California Attorney General's CCPA guidance. Virginia, Colorado, Connecticut, and other states have enacted comparable statutes, so a school recruiting outside California should not assume CCPA/CPRA is the only state law in scope.

The FTC Act's Section 5 prohibition on unfair or deceptive practices is the backstop. The FTC's guidance on privacy and security applies regardless of state, and covers misrepresenting what a chatbot or WhatsApp integration collects, or failing to honor a stated opt-out.

FERPA does not govern this channel. The Family Educational Rights and Privacy Act protects "education records" tied to a student's formal relationship with the school. A prospect who has not applied or enrolled is not the subject of an education record, so FERPA does not regulate marketing messages sent before that point — TCPA and CCPA/CPRA, not FERPA, are what actually govern prospect outreach. That confusion is common enough to flag: "this is a school, so FERPA covers everything it does" overstates FERPA's enrollment-triggered scope.

Meta's own opt-in requirement runs in parallel. Meta separately requires documented proof of opt-in before approving templates for proactive messaging, independent of whatever legal basis the school has under federal or state law. Satisfying TCPA and CCPA/CPRA does not automatically satisfy Meta's narrower, procedural template-approval bar, and vice versa — a school needs a timestamped consent record that clears both.

How long to retain WhatsApp conversation data

For prospect data — anyone who has not yet enrolled — the safest posture is to tie retention to the disclosed purpose and delete once that purpose is served, the data-minimization principle the CPRA's implementing regulations built into California law and that most comprehensive state privacy statutes now share. No single US statute sets a universal retention number for prospect messaging data, but in practice, comparable institutions apply roughly a 2-3 year ceiling from the date of last contact — a window consistent with what enrollment-management professionals already use for other prospect-marketing channels, and one that mirrors the 3-year rule published explicitly by EU regulators like France's CNIL under the same storage-limitation logic.

That ceiling applies to WhatsApp conversation content and metadata — timestamps, delivery status, template category — kept for prospecting purposes. Once an applicant enrolls, data moves to the school's standard student-records retention schedule, a separate policy that should be documented as such. Our detailed breakdown of prospect data retention periods covers how that transition should look.

Vendor chain: contracting with every processor

A school running admissions through WhatsApp is rarely dealing with a single vendor. Meta operates the platform itself; the BSP sits between the school and Meta; and if the school layers a separate chatbot or CRM vendor on top to read and write WhatsApp conversations, that is a third, distinct vendor touching the same conversation data.

Under the CCPA, a business that shares personal information with a "service provider" — a vendor processing data on the business's behalf for a contracted purpose — must have a written contract restricting that vendor to the contracted purpose and prohibiting it from using the data for its own purposes, per California's CCPA service-provider requirements. That functions similarly to GDPR Article 28 in Europe, though the two are not identical: the CCPA framework runs through "service provider" and "contractor" definitions rather than a single Article 28-style clause, and applies at the state level, not federally. A school should verify what each vendor's contract actually covers — "the BSP handles compliance" is a common gap, since a BSP's standard terms rarely extend a service-provider agreement to a separate chatbot vendor reading the same conversation thread. Schools recruiting internationally and messaging prospects located in the EU face a further wrinkle: GDPR can apply to that subset of conversations even though the school itself is US-based, worth flagging to counsel separately. Our guide to GDPR-compliant chatbot vendors for schools sets out what to check in that specific agreement.

The real cost: building the full budget

Meta's own fee schedule is the visible cost. It is rarely the largest one once a school adds the BSP subscription, setup work, and the recurring costs that only appear after the number goes live.

A school evaluating this budget alongside the return should weigh it against the broader chatbot deployment case: schools running an AI chatbot across their admissions funnel report +62% qualified leads and -38% cost per lead (€42 to €26), with 280% ROI within 12 months (Source: Skolbot median results across 18 partner schools, 2024-2025 — a general chatbot-deployment benchmark across all channels combined, expressed in euros as measured on the underlying European partner panel, not specific to WhatsApp). WhatsApp is one channel inside that funnel, and its cost structure should be assessed as an addition to that broader case rather than in isolation.

Setting it up: the concrete steps

Getting a school's admissions team live on WhatsApp Business Platform runs through a fixed sequence, most of which cannot be shortcut.

1. Create a Meta Business Manager account for the school, if one does not already exist for other Meta advertising activity.
2. Complete Meta Business Verification — the identity check that unlocks higher messaging tiers and is a prerequisite for most BSP onboarding flows.
3. Get WhatsApp Business Platform access through a BSP — in practice, this is how nearly every school accesses the platform at admissions scale.
4. Register a dedicated phone number for WhatsApp use, separate from any number already used for calls.
5. Create and submit templates for Meta approval, categorized correctly (marketing vs. utility vs. authentication) since misclassification is a common cause of rejection.
6. Monitor the quality rating once live — an ongoing task, not a one-off step, since the rating moves with applicant behavior.
7. Integrate with the CRM or chatbot so WhatsApp conversations feed the same admissions pipeline as every other channel, rather than sitting in a separate inbox a counselor checks manually.

FAQ

Is WhatsApp Business API still billed by conversation?

No. That model — one charge per 24-hour conversation window, regardless of message volume inside it — was retired on July 1, 2025. Meta now bills per delivered template message, at a rate set by the template's category and the recipient's country. Any quote still describing conversation-based pricing in the present tense is out of date.

Can a school access WhatsApp Business Platform directly from Meta?

Not at the volume an admissions team needs. Meta offers limited self-serve options, but schools access the platform in practice through a Meta-vetted Business Solution Provider or Solution Partner, which handles template submission, number registration, and quality-rating monitoring — and charges its own subscription fee on top of Meta's per-message costs.

Does TCPA consent cover Meta's opt-in requirement too?

No. TCPA requires prior express written consent for marketing messages sent to a wireless number through an automated platform, which is the school's own federal compliance obligation. Meta separately requires documented proof of opt-in before approving templates for proactive messaging. Both requirements run in parallel, and satisfying one does not satisfy the other; a school needs a consent record that clears both bars.

Does FERPA apply to WhatsApp messages sent to prospective students?

Generally, no. FERPA governs education records tied to a student's formal relationship with the school, and a prospect who has not applied or enrolled is not yet the subject of one. TCPA and state privacy laws like the CCPA/CPRA — not FERPA — are the frameworks that actually govern marketing and outreach messages to prospects. FERPA can become relevant once a WhatsApp conversation starts referencing an active application file.

How long can a school keep WhatsApp conversation data for a prospect who never enrolls?

Roughly 2-3 years from the date of last contact is the pattern comparable institutions apply, consistent with the data-minimization principle that CCPA/CPRA and similar state privacy laws build into their purpose-limitation requirements. No federal statute sets an exact number for prospect messaging data, so this should be documented as institutional policy rather than assumed to be legally fixed. Once a prospect enrolls, the school's standard student-records retention schedule applies instead.

For the full governance framework this fits into, see our student data privacy guide and our guide on GDPR consent for the application form for schools that also recruit internationally.