ChatGPT
Claude
Perplexity
Gemini
GrokRegulatory notice: This article is for informational purposes only and does not constitute legal advice. For situations specific to your institution, consult a data-protection lawyer or your Data Protection Officer (DPO).
What changed in WhatsApp Business API pricing
Since 1 July 2025, Meta bills WhatsApp Business Platform messages one at a time, not by conversation window. Every delivered template message is charged individually, at a rate that depends on the template's category (marketing, utility, or authentication) and the recipient's country calling code.
Before that date, Meta used what it called "conversation-based pricing": a single charge opened a 24-hour conversation window, and every message sent inside that window — however many — was covered by the one fee, per Meta's own documentation of the (now deprecated) conversation-based model. That model no longer applies to any school evaluating WhatsApp today; if a vendor or a BSP quotes it in the present tense, treat that as a signal their pricing information is out of date.
Under the current per-message pricing structure, two categories of messages remain free: service messages (free-form replies a school sends inside the 24-hour window an applicant opened by messaging first) and utility templates sent inside that same window. Everything else — proactive marketing templates, authentication codes, utility templates sent outside the window — is billed per message.
There is a further change schools should track, not act on prematurely: Meta is expected to end the free-form-reply exemption inside the service window from 1 October 2026, according to early Business Solution Provider partner notices. No official Meta pricing page currently documents exact rates for that change, and any figure quoted for it today should be treated as provisional rather than budgeted. Our companion article on what the October 2026 billing change means for a school covers the applicant-experience side of that shift.
The BSP: the mandatory middleman and its hidden cost
A school cannot buy meaningful WhatsApp Business Platform access directly from Meta at the volume admissions teams need. Access runs through a Meta-vetted intermediary — historically called a Business Solution Provider (BSP), now formally a "Solution Partner" in Meta's tiered partner ecosystem, with a lighter "Tech Provider" tier for smaller integrations, per Meta's overview of WhatsApp solution providers.
The BSP handles the parts a school cannot self-serve: template submission and approval tracking, dedicated number registration, quality-rating monitoring, and a multi-agent inbox so more than one admissions counsellor can work the same number. In exchange, the BSP layers its own software subscription on top of Meta's per-message fees — and that second layer is the cost most schools miss when they estimate "what WhatsApp costs," because Meta's fee schedule is the only one that shows up in a first search.
Legal basis and opt-in: what UK GDPR requires
Messaging an applicant on WhatsApp is personal-data processing, and it needs a UK GDPR Article 6 legal basis before the first message goes out — the same requirement that applies to any other channel carrying identifiable data. Consent, under Article 6(1)(a), is the basis that fits in practice: WhatsApp is a direct, individually-addressed channel inside a personal messaging app, which makes legitimate interest under Article 6(1)(f) a weak fit given how intrusive the channel can feel to the recipient.
The ICO's guidance on the lawful bases for processing sets out the balancing test a school would need to pass to rely on legitimate interest instead of consent — and a proactive message landing inside an applicant's personal chat app, alongside messages from friends and family, is a hard case to win on intrusiveness grounds alone. For a fuller treatment of how consent should be captured on the admissions form itself, see our guide on GDPR consent for the student application form.
UK GDPR consent is not the only requirement in play. Meta separately requires its own documented opt-in before a business can message someone proactively, independent of whatever legal basis the school has under UK GDPR — the two obligations run in parallel, and satisfying one does not satisfy the other. A school needs a timestamped consent record for its own compliance file and a version of that same consent that meets Meta's template-approval bar, which is a narrower, more procedural check than a UK GDPR-compliant consent flow.
How long to retain WhatsApp conversations
For prospect and applicant data — anyone who has not yet enrolled — the storage-limitation principle sets the retention ceiling: data should be kept no longer than necessary for the purpose it was collected for, per the ICO's guidance on the storage limitation principle. In practice, comparable schools apply roughly a 2-3 year ceiling from the date of last contact for pure prospecting data — a figure that mirrors the published 3-year rule French regulator CNIL applies to prospect data under EU GDPR, since both regimes enforce the same underlying storage-limitation principle even though the UK and EU frameworks have diverged post-Brexit.
That ceiling applies to WhatsApp conversation content and its associated metadata — timestamps, delivery status, template category — kept for prospecting purposes. Once an applicant enrols, the relationship changes: data can then be retained for the duration of enrolment plus a reasonable period afterwards, which is a separate retention schedule from the prospecting one and should be documented as such. Our detailed breakdown of prospect data retention periods under UK GDPR covers how that transition should be reflected in a school's retention schedule.
Subprocessing: the Article 28 agreement with every vendor in the chain
A school running admissions through WhatsApp is rarely dealing with a single processor. Meta operates the platform itself; the BSP sits between the school and Meta; and if the school layers a separate chatbot or CRM vendor on top to read and write WhatsApp conversations, that is a third, distinct processor in the same data flow.
UK GDPR Article 28 — which mirrors EU GDPR Article 28 — requires a written data-processing agreement with each processor in that chain, not a single agreement covering "WhatsApp" as if it were one vendor. A school also has to verify, for each processor, where it hosts data and whether an international transfer safeguard is needed for any transfer outside the UK or an adequate jurisdiction — relevant here because WhatsApp's underlying infrastructure is not exclusively UK- or EU-hosted. Skipping this step because "the BSP handles compliance" is a common gap: the BSP's own terms rarely extend a data-processing agreement to cover a separate chatbot vendor reading the same conversation thread. Our guide to GDPR-compliant chatbot vendors for schools sets out what to check in that specific agreement.
The real cost: building the full budget
Meta's own fee schedule is the visible cost. It is rarely the largest one once a school adds the BSP subscription, setup work, and the recurring costs that only appear after the number goes live.
| Cost line item | What drives it | Typical pattern |
|---|---|---|
| Meta per-message fees | Template category (marketing/utility/authentication) × recipient country | Variable — check current rates on Meta's pricing page, do not assume a flat rate across countries |
| BSP software subscription | Monthly fee, often per number or per agent seat | The most underestimated line item — absent from most schools' first WhatsApp budget |
| Setup: Business Verification | Meta's identity check on the school as a business | One-off, but can take several weeks if documentation is incomplete |
| Setup: dedicated number registration | Registering a phone number for WhatsApp Business use | One-off per number |
| Setup: template creation and approval | Drafting templates that meet Meta's category rules | Recurring in practice — new templates need approval every time messaging changes |
| Rejected-template rework | Templates that fail Meta's review on first submission | Recurring, and adds delay to campaign launches |
| Quality-rating recovery | A dropped rating forces a slower, redesigned cadence | Recurring, unpredictable — depends on applicant behaviour, not just school planning |
| Template translation | International recruitment requires locale-specific templates, each separately approved | Recurring, scales with the number of recruitment markets |
A school evaluating this budget alongside the return should weigh it against the broader chatbot deployment case: schools running an AI chatbot across their admissions funnel report +62% qualified leads and -38% cost per lead (€42 to €26), with 280% ROI within 12 months (Source: Skolbot median results across 18 partner schools, 2024-2025 — a general chatbot-deployment benchmark across all channels combined, not specific to WhatsApp). WhatsApp is one channel inside that funnel, and its cost structure should be assessed as an addition to that broader case rather than in isolation.
Setting it up: the concrete steps
Getting a school's admissions team live on WhatsApp Business Platform runs through a fixed sequence, most of which cannot be shortcut.
- Create a Meta Business Manager account for the school, if one does not already exist for its other Meta advertising activity.
- Complete Meta Business Verification — the identity check that unlocks higher messaging tiers and is a prerequisite for most BSP onboarding flows.
- Get WhatsApp Business Platform access through a BSP — in practice, this is how nearly every school accesses the platform at admissions scale, rather than through Meta's limited self-serve options.
- Register a dedicated phone number for WhatsApp use, separate from any number already used for calls.
- Create and submit templates for Meta approval, categorised correctly (marketing vs. utility vs. authentication) since misclassification is a common cause of rejection.
- Monitor the quality rating once live — this is an ongoing task, not a one-off setup step, since the rating moves with applicant behaviour.
- Integrate with the CRM or chatbot so WhatsApp conversations feed the same admissions pipeline as every other channel, rather than sitting in a separate inbox a counsellor has to check manually.
FAQ
Is WhatsApp Business API still billed by conversation?
No. That model — one charge per 24-hour conversation window, regardless of message volume inside it — was retired on 1 July 2025. Meta now bills per delivered template message, at a rate set by the template's category and the recipient's country. Any quote still describing conversation-based pricing in the present tense is out of date.
Can a school access WhatsApp Business Platform directly from Meta?
Not at the volume an admissions team needs. Meta offers limited self-serve options, but schools access the platform in practice through a Meta-vetted Business Solution Provider or Solution Partner, which handles template submission, number registration, and quality-rating monitoring — and charges its own subscription fee on top of Meta's per-message costs.
Does UK GDPR consent cover Meta's opt-in requirement too?
No. UK GDPR requires a lawful basis — consent, in practice, for this channel — for the school's own compliance. Meta separately requires documented proof of opt-in before approving templates for proactive messaging. Both requirements exist in parallel, and satisfying one does not satisfy the other; a school needs a consent record that meets both bars.
How long can a school keep WhatsApp conversation data for a prospect who never enrols?
Roughly 2-3 years from the date of last contact, under the UK GDPR storage-limitation principle, which requires data to be kept no longer than necessary for its original purpose. This mirrors the retention period used across comparable EU regulators for prospect data, since the underlying principle is shared. Once a prospect enrols, a different, longer retention schedule applies for the duration of their relationship with the school.
Who counts as a data processor in a school's WhatsApp setup?
Potentially three separate entities: Meta, the BSP, and — if the school uses one — a distinct chatbot or CRM vendor that reads and writes WhatsApp conversations. UK GDPR Article 28 requires a written processing agreement with each one, plus a check on where each hosts data and whether an international transfer safeguard is needed.
For the full governance framework this fits into, see our UK GDPR guide for student data.
Book a personalised demo
