Amendment 40 replaced section 30A of Israel's Communications Law in 2008 and regulated advertisements sent through specified communication methods. Prior express consent is the general rule, but the statute contains exceptions and channel-dependent disclosures. On WhatsApp, do not assume that a template approval or an inbound customer message resolves consent.
Review status: this is a working draft pending review by Israeli communications/privacy counsel. It is general information, not legal advice or certification that a message or system complies with law.
What is Amendment 40?
Amendment 40 replaced section 30A of the Communications Law in 2008. The enacted text generally prohibits an advertiser from sending an "advertisement" by fax, automated dialer, electronic message, or short message without prior express consent in writing, including electronic form or a recorded call. The section contains exceptions and disclosure duties, so applying it to WhatsApp requires legal classification of the message and channel.
Why is this relevant to businesses on WhatsApp now?
Businesses send promotional messages, updates, deals, and reminders through WhatsApp, often without sufficient classification. The issue is not only what the business calls the message, but whether it meets the current definition of an advertisement and which communications category applies. Counsel should approve that classification.
With the growing use of the WhatsApp Business API and marketing automations, businesses are entering territory where message volumes increase — and along with them, exposure to legal risks.
What is Allowed and What is Forbidden — Table
| Allowed | Forbidden | |
|---|---|---|
| Consent | Customer filled out an explicit opt-in form ("I agree to receive marketing updates") | Sending to a contact list without explicit consent |
| Content | Service message (order confirmation, appointment reminder) | Commercial offer, deal, advertisement — without consent |
| Identification/disclosure | Advertising label and advertiser/refusal details required for the legally approved classification | Relying on a profile name or template approval alone |
| Opt-Out | A simple path that recognizes every valid refusal and records suppression | A STOP-only parser or continued sending |
| Documentation | Keeping documented consent records with date and method | No documentation of who consented, when, and how |
| After Opt-Out | Immediate cessation of marketing after a removal request | Continuing to send after a STOP request |
| WhatsApp Business API | A Meta-approved template plus opt-in separately collected and evidenced by the business | Assuming Meta approval proves consent or legality |
Three Principles You Must Know
1. Explicit Prior Consent (Opt-In)
This is the foundational principle of Amendment 40: before sending an advertisement, obtain prior express consent in clear, recordable wording. An inbound service inquiry may open a conversation, but it is not by itself consent to later marketing.
What is not enough: that a person is in your contact list, has purchased from you in the past, or mentioned they are "interested in hearing more" in a verbal conversation — without orderly documentation.
Please note: Section 30A(c) contains a cumulative exception for details supplied during a purchase or negotiations, after notice of advertising use, an unused opportunity to refuse, and for a similar product or service. Do not rely on the relationship alone; ask counsel to verify every condition.
2. Clear Right to Opt-Out
Every marketing message must include clear instructions on how to opt-out of the list. The opt-out must be:
- Simple — easy to submit in free text or another valid form, not only through one code word
- Immediate — once the customer requests removal, no further marketing messages may be sent to them
- Documented — keep a record of every opt-out request with a date
3. Sender Identification
Every marketing message must clearly identify who is sending it — the business name and contact information. Sending from an unidentified, hidden number, or from a "server" number without mentioning the responsible party — is problematic.
How to Maintain Compliance in Practice
Build a Clear Opt-In Process
Collect consent as part of your standard process — on a contact form, a landing page, or at the point of purchase. The form should include a dedicated checkbox for marketing (not as part of a general terms agreement), with clear wording: "I agree to receive updates and promotions on WhatsApp from [Business Name]". Do not pre-check the box.
Document Consents
For every stored consent, keep: who agreed, when, and by what means (form URL, date). This is not just a legal requirement — it is also your defense in case of a complaint.
Add an Opt-Out Mechanism to Every Message
Design a refusal path that is easy to use. The system should recognize STOP and free-text refusal, move the number to a suppression list, and retain an audit record. Counsel should approve the advertising label, advertiser details, and refusal method for the channel classification.
Separate Service Messages from Marketing
An appointment reminder — service. An offer for an additional product — marketing. Ensure your systems distinguish between the two, as they are subject to different rules.
Marketing Automation — Controls to Define
WhatsApp marketing automation may be permitted only when the actual flow meets applicable law, WhatsApp policy, and the business's legal decisions. The following is a control checklist, not compliance certification:
Step 1 — Purpose-specific opt-in: The customer gives express, recorded consent to receive advertisements, with wording that identifies the business, channel, and message categories. An inbound service message is not enough by itself.
Step 2 — Record and confirm: The system stores the approved wording, source, time, and version of the consent and sends an appropriate confirmation. A confirmation message cannot retroactively create consent that was never collected.
Step 3 — Marketing: From this point on, marketing messages can be sent — deals, product updates, relevant content — with every message including an opt-out option.
Step 4 — Refusal management: Every valid refusal — not only STOP — updates the suppression list and stops the promotional sequence across downstream systems. The event is documented.
At Automaziot AI, we can implement technical controls approved by the client, such as consent evidence, suppression lists, and human review. We do not certify that the wording or workflow is lawful; the business and its counsel remain responsible for the legal basis and review.
What the WhatsApp Business API Offers in This Context
The WhatsApp Business API uses Meta-approved templates in specified situations. WhatsApp policy makes the business responsible for obtaining appropriate opt-in; the platform does not provide a built-in mechanism that proves consent under Israeli law. Therefore:
- Template approval by Meta is not a substitute for the requirements of Israeli law
- The opt-in for the WhatsApp platform must also be the opt-in according to Amendment 40 — clear, explicit, and documented
- Marketing via API to lists collected without consent — even with approved templates — remains problematic
Frequently Asked Questions by Businesses
"I have a customer list from the last few years — can I send messages to them?" An old list without documented consent is problematic. Do not send a marketing message merely to request consent unless Israeli counsel has confirmed a lawful route for that recipient and channel. Section 30A(b) contains a limited one-time approach for a business recipient; it is not a general permission to email consumers for consent.
"A customer messaged me first on WhatsApp — does that count as consent?" A customer who contacted you on their own initiative opened a conversation — but that is not necessarily explicit consent to receive proactive marketing from you in the future. To leverage this opening, ask for explicit consent during the conversation.
"What about a Click-to-WhatsApp ad campaign?" Clicking an ad and opening a conversation is not automatic proof of consent to continuing marketing. Handle the inquiry the customer requested, and separately obtain express, recorded consent before later advertisements.
Disclaimer
This article provides general information on the principles of Amendment 40 and does not constitute legal advice. The exact interpretation of the law, including specific exceptions, may vary depending on your business circumstances. It is highly recommended to consult with an attorney specializing in communications and privacy law before launching a WhatsApp marketing campaign, especially at large scales.
Summary
Amendment 40 creates a framework that must be translated into business and technical controls. Recorded opt-in, appropriate disclosure, refusal handling, and suppression are important components, but they do not replace legal review of the complete flow or separate privacy duties.
The next step: after your counsel defines the consent, disclosure, retention, and refusal rules, talk to us about implementing the technical controls. We build WhatsApp Agents and automation systems, but do not provide legal approval or compliance certification.
Primary sources for review
- Communications Law Amendment 40 — Sefer HaChukim, 1 June 2008
- Privacy Protection Authority guide to Amendment 13
- WhatsApp Business Messaging Policy
Counsel should also check the current consolidated section 30A and relevant case law, rather than relying only on the original amendment text.
Read also: What is an AI Agent for Business? The Complete Guide
