Personal Data Protection in Business-Operated WhatsApp Groups: Controller Duties, Lawful Basis, Retention and Incident Response

Full title: Personal Data Protection in Business-Operated WhatsApp Groups: Controller Duties, Lawful Basis, Phone-Number Exposure, Retention and Incident Response under the LGPD and the GDPR Originally published on OSF: osf.io/zg9u7 · DOI: 10.17605/OSF.IO/ZG9U7 Ivan Schroll Independent Researcher, Brazil · ORCID: 0009-0007-0680-5570 Narrative review / technical report · October 2026 · Language: English · License: CC BY 4.0 Abstract Companies increasingly run WhatsApp groups and Communities as part of their operations: customer communities, groups for resellers and distributors, pre-sales and support groups, and internal team groups. Each of these groups is also a processing operation involving personal data, starting with the phone numbers and profile information of every member. This narrative review examines how the Brazilian General Data Protection Law (LGPD) and the European Union General Data Protection Regulation (GDPR) frame the obligations of an organisation that operates such groups. It draws on the consolidated text of both laws, guidance from the Brazilian national authority (ANPD) and the European Data Protection Board (EDPB), ANPD Resolution 15/2024 on security incidents, the WhatsApp Business terms, data processing terms and messaging policy, WhatsApp Help Center documentation and peer-reviewed research on group exposure and workplace messaging. All sources were accessed and verified on 30 October 2026. The review finds that the household exemption that may cover a private individual does not cover an organisation acting for its business purposes; that the organisation is the most likely controller of the processing it decides to carry out through a group, while WhatsApp acts as processor only for the specific services and data described in its business terms; that the main exposure inside a group is lateral, because every member can see the phone numbers of the others; and that retention, administrator access and incident response are the areas where organisations most need written rules, because the platform does not provide a central record. The paper proposes a minimum compliance file for business groups. It reports no original data and is not legal advice. Keywords WhatsApp; WhatsApp Business; LGPD; GDPR; data protection; controller; lawful basis; phone numbers; data retention; security incidents; customer communities; B2B 1. Introduction Earlier reports by the same author discussed moderation governance in large WhatsApp groups, the legal responsibility of individual administrators, account takeover, scams and the exposure of members through invite links and phone numbers. Those reports looked mainly at the group and at the person who runs it. This report changes the point of view to the organisation. When a company opens a group for its customers, a channel for its resellers or a coordination group for a sales team, it is not a private person sharing a chat. It is an organisation that has decided to collect and use personal data for a business purpose, using a third-party platform. That shift has consequences. Data protection laws apply to legal entities in full, they require a lawful basis for every processing operation, they require transparency, security and limited retention, and they assign responsibility to whoever decides why and how data are processed (Brasil, 2018, arts. 5, 6 and 7; European Union, 2016, arts. 4, 5 and 6). At the same time, the platform was designed first for personal messaging, and several of its default behaviours, such as the visibility of members' phone numbers in groups, are not under the organisation's control. This review asks four questions: When does an organisation that runs WhatsApp groups act as a controller under the LGPD and the GDPR, and what role does WhatsApp play? Which lawful bases and transparency duties are relevant to the most common business uses of groups? Which personal data are exposed inside a business group, and to whom? What does the law expect about retention, administrator access and incidents, and how can these expectations be met with the features that WhatsApp documents? The paper is written for compliance, legal, customer experience and operations teams. It does not take a position on any individual case. 2. Background 2.1 Business use of groups WhatsApp groups can be created by any account, including accounts on the WhatsApp Business app, and hold up to 1,024 members (WhatsApp Help Center, n.d.-a). Admins can invite people through links, approve new members, and restrict who can send messages, edit group information and add others (WhatsApp Help Center, n.d.-b). Communities group several groups under one structure with community admins (WhatsApp Help Center, n.d.-c). For businesses there are two product lines. The WhatsApp Business app is a mobile application for small and medium businesses, governed by its own terms, which state that the service is to be used "solely for business, commercial, and authorized purposes" and that the Business App services are "not intended for intra-company usage" (WhatsApp, n.d.-a). The WhatsApp Business Platform, used through the Cloud API, is governed by the WhatsApp Business Terms of Service and related data processing terms (WhatsApp, n.d.-b; WhatsApp, 2025). In 2025 and 2026 Meta opened a Groups API on the Cloud API. Its documentation lists a maximum of 8 participants per group, describes groups as invite-only, joined through a link sent by the business, and limits eligibility to businesses with an Official Business Account; it also states that groups are not available for WhatsApp Business app phone numbers (Meta for Developers, n.d.-a). In practice, therefore, most large business groups observed today are ordinary groups created from a personal or Business app account. Common business setups are described in WhatsApp group automation for business. 2.2 Workplace use of messaging Research on workplace messaging shows why the line between personal and business use is hard to draw. In interviews and focus groups with employees from Dutch workplaces, Mols and Pridmore (2020) found that WhatsApp blurs boundaries by default and that employees adapt settings and devices to negotiate availability and separate contexts. In a qualitative study of mobile shadow IT, Abbas and Alghail (2021) reported that interviewees used applications such as WhatsApp, Dropbox and Google Drive without permission from their IT departments, mainly because their organisations did not provide suitable tools, and concluded that this unmonitored sharing harms knowledge protection. These studies are small and qualitative, but they describe a common starting point for the compliance problem: business groups often begin on employees' own accounts and devices. 3. Method 3.1 Design This is a narrative review of primary legal texts, regulatory guidance, platform documentation and peer-reviewed research. It is not a systematic review and does not report original data. 3.2 Sources Sources were selected in four groups: Laws: the consolidated LGPD (Brasil, 2018) and the GDPR (European Union, 2016). Regulatory guidance and decisions: the ANPD guide on processing agents and the data protection officer (ANPD, 2022), ANPD Resolution CD/ANPD 15/2024 on security incident communication (ANPD, 2024a) and the related ANPD service page (ANPD, n.d.), EDPB Guidelines 07/2020 on controller and processor (EDPB, 2021) and Guidelines 9/2022 on breach notification (EDPB, 2023), and the Irish Data Protection Commission announcement of its 2021 WhatsApp decision (DPC, 2021). Platform documentation: WhatsApp Business app terms, Business Terms, Business Data Processing Terms, the Business Messaging Policy, developer documentation on opt-in and groups, and Help Center articles on groups, admins, disappearing messages and chat export. Research: peer-reviewed studies on group data exposure, phone-number enumeration and workplace messaging. Every URL was opened on 30 October 2026 to confirm that it exists and supports the statement for which it is cited. Claims that could not be verified were removed. 3.3 Analysis Each business use of a group was analysed against the core questions of both laws: who decides, on which basis, with what information to the data subject, with which data, for how long and with which security measures. 4. Findings 4.1 Scope: business groups are within the law Both laws exclude purely personal activity. The LGPD does not apply to processing "realizado por pessoa natural para fins exclusivamente particulares e não econômicos" (Brasil, 2018, art. 4, I). The GDPR does not apply to processing "by a natural person in the course of a purely personal or household activity" (European Union, 2016, art. 2(2)(c)). Neither exemption covers a legal entity acting for business purposes. A customer community, a reseller group or a support group run by or for a company is therefore within scope, even when the account used to run it belongs to an employee. The LGPD also applies regardless of where the organisation is based when the processing aims to offer goods or services to people in Brazil or concerns data collected in Brazil (Brasil, 2018, art. 3). 4.2 Roles: controller, processor and the platform The LGPD defines the controller as the person "a quem competem as decisões referentes ao tratamento de dados pessoais" and the processor (operador) as the person who processes data on the controller's behalf (Brasil, 2018, art. 5, VI and VII). The ANPD guide clarifies that the controller is the agent responsible for the main decisions and for defining the purpose of processing, and that employees acting under the organisation's authority are not separate processing agents (ANPD, 2022). The GDPR uses equivalent definitions (European Union, 2016, art. 4(7) and (8)), and the EDPB explains that the controller is whoever determines the purposes and essential means of processing, that this assessment is factual, and that joint controllership arises when entities jointly determine purposes and means (EDPB, 2021). Applied to business groups, three points follow. The organisation is normally the controller. When a company decides to create a group for its customers or partners, decides who is admitted and what the group is for, it determines the purposes and means of the processing that takes place there. An employee who creates the group on instructions acts for the company. Where an employee creates a business group without any instruction, the company may still be responsible if it accepts and benefits from the group, but this review found no regulatory guidance specific to that situation. WhatsApp's role depends on the product. The WhatsApp Business Data Processing Terms apply "to the extent that the Business Terms state that WhatsApp Processes Personal Information in your Customer Data as your Processor", and they describe the data concerned as "customer contact information" of customers "with whom you communicate using the WhatsApp service" (WhatsApp, 2025). Within that scope, WhatsApp commits to process data on instructions, keep it confidential, apply security measures, notify the business of breaches and assist with data subject requests (WhatsApp, 2025). These terms are tied to the Business Terms. For groups created from an ordinary account, members' relationship with WhatsApp is governed by WhatsApp's own terms and privacy policy, and the organisation cannot assume a processor agreement exists. Partner and reseller groups may involve more than one controller. When a manufacturer and its distributors jointly run a group and jointly decide its purpose, the EDPB criteria for joint controllership may be met (EDPB, 2021). Under the GDPR, joint controllers must set out their respective responsibilities in an arrangement (European Union, 2016, art. 26). Under the LGPD, controllers directly involved in processing that causes damage are jointly liable (Brasil, 2018, art. 42, §1, II). In either case, partners benefit from agreeing in writing who answers member requests and who manages admins. 4.3 Lawful basis and transparency The LGPD lists ten lawful bases, including consent, compliance with a legal obligation, performance of a contract at the data subject's request and legitimate interest (Brasil, 2018, art. 7). The GDPR lists six, with the same core options (European Union, 2016, art. 6). For business groups the relevant bases differ by use: Use of the group Plausible basis to assess Notes Post-sale support for customers who asked to be added Contract or pre-contractual steps at the data subject's request Limited to what the support requires Customer or brand community with optional membership Consent or legitimate interest Legitimate interest requires necessity, transparency and balancing (Brasil, 2018, art. 10) Reseller, distributor or partner groups Contract with the partner, or legitimate interest Contact persons of partners are data subjects Internal team groups Employment relationship, legitimate interest Business App terms say the app is not intended for intra-company use (WhatsApp, n.d.-a) Marketing and promotions Consent is the common route Platform opt-in rules also apply Two platform rules interact with the legal basis. The Business Messaging Policy states that a business may contact people only if they have given their number or username and the business has "received opt-in permission from the recipient", and that the business is "solely responsible for determining the method of opt-in" in compliance with applicable law (WhatsApp, n.d.-c). The developer documentation repeats that businesses must obtain opt-in before messaging people and that opt-in must name the business (Meta for Developers, n.d.-b). Opt-in under platform policy is not the same thing as consent under the LGPD or GDPR, but a well designed join flow can satisfy both, for example by explaining the group's purpose and the visibility of numbers before the person joins. Consent under the LGPD must be free, informed and unambiguous, for a specific purpose, and the burden of proof is on the controller (Brasil, 2018, arts. 5, XII and 8, §2). Generic authorisations are void (art. 8, §4). Data subjects are entitled to clear information on purpose, duration, controller identity and contact, sharing and their rights (art. 9). In a group, the group description and a pinned or first message are natural places for this notice, with a link to the organisation's privacy notice. A practical companion is WhatsApp group data collection and privacy compliance. 4.4 The lateral exposure problem The main privacy feature of a group is that members see one another. Research on public group links showed that joining groups exposes members' phone numbers to anyone who joins, and that links posted publicly can be collected at scale (Hoseini et al., 2020). Research on contact discovery showed that WhatsApp phone numbers could be enumerated at very large scale, before the platform applied remediation (Gegenhuber et al., 2026). In a business setting, this means that a customer community of several hundred people is also a list of several hundred customer numbers available to every member, including competitors, former employees still in the group and anyone who joined through a leaked link. Lateral exposure matters legally because the controller chose the tool and the configuration. The LGPD principles of necessity, security and prevention (Brasil, 2018, art. 6, III, VII and VIII), the security duty in article 46 and the GDPR principles of data minimisation and integrity and confidentiality (European Union, 2016, art. 5(1)(c) and (f)), together with data protection by design and by default (art. 25), all point the same way: if members do not need to see each other, the organisation should consider a format in which they do not. Options documented by WhatsApp include announcement-only groups, in which only admins send messages (WhatsApp Help Center, n.d.-b), Communities with an announcement group (WhatsApp Help Center, n.d.-c), and one-to-one conversations through the Business app or the Business Platform. These reduce interaction between members but do not, on their own, hide numbers from members of a regular group. In June 2026 Meta announced usernames as a way to connect without giving out a phone number (Meta, 2026); this review found no documentation on how usernames will display to other members of business groups. Admins should also note that, where members are allowed to add others, they can be allowed to send recent message history to the new member (WhatsApp Help Center, n.d.-b), which extends exposure to people who were not present when the messages were written. The Business Messaging Policy also states that a business "may not forward or otherwise share information from a customer chat with any other customer" (WhatsApp, n.d.-c). A group in which customers raise individual problems in front of other customers sits uncomfortably with that rule and with necessity. A common pattern is to use the group for general information and to move individual cases to a private conversation. Options for members are summarised in how to hide your phone number in a WhatsApp group. 4.5 Sensitive data and special contexts The LGPD defines sensitive data to include data on health, among other categories, and restricts the bases on which such data may be processed (Brasil, 2018, arts. 5, II and 11). The WhatsApp Business App terms state that WhatsApp makes no representation that the service meets the needs of entities "regulated by laws and regulations with heightened confidentiality requirements for personal data, such as healthcare, financial, or legal services entities" (WhatsApp, n.d.-a). The Business Messaging Policy prohibits using WhatsApp to send or request health information where applicable regulations prohibit sending it to systems that do not meet heightened requirements (WhatsApp, n.d.-c). Organisations in these sectors should treat groups as unsuitable for case-level discussion unless a specific assessment concludes otherwise. 4.6 Retention Under the LGPD, processing ends when its purpose is achieved, its period ends, or the data subject withdraws consent, and data must then be deleted unless an exception applies, such as a legal obligation (Brasil, 2018, arts. 15 and 16). The GDPR requires that data be kept no longer than necessary (European Union, 2016, art. 5(1)(e)). In a WhatsApp group, retention is distributed. Each member's device holds its own copy of the conversation and of the member list. The organisation can reduce what is kept in the group through disappearing messages, which can be set for a group and restricted so that only admins can change them (WhatsApp Help Center, n.d.-d). It can remove members whose purpose has ended, for example when a support case is closed or a reseller contract ends (WhatsApp Help Center, n.d.-e). It cannot delete copies held by members. Conversely, if the organisation needs to keep a record, for example of commitments made to customers, WhatsApp's own export function produces a text file of the chat that cannot be re-imported (WhatsApp Help Center, n.d.-f), which then becomes a separate record that must itself have a retention rule. The organisation should decide which of these two objectives applies to each group and write it down; the two are in tension, and Paper 7 in this series discusses the recordkeeping side for regulated sectors. 4.7 Administrator access as a security measure Admins of a business group can see every member's number, approve entries, remove members and, depending on settings, change the group's information and messaging permissions (WhatsApp Help Center, n.d.-b). Under the LGPD, processing agents must adopt technical and administrative measures to protect personal data from unauthorised access (Brasil, 2018, art. 46), and the controller must be able to demonstrate the measures it takes (art. 6, X). Under the GDPR, the controller must implement appropriate measures and be able to demonstrate compliance (European Union, 2016, arts. 5(2), 24 and 32). Three platform properties matter here. First, the creator of a group "can't be removed and will remain an admin unless they exit the group", and WhatsApp "can't interfere with group administration functions" (WhatsApp Help Center, n.d.-g). If the creator is an employee using a personal number, the organisation depends on that person to leave the group when they leave the company. Second, admin rights attach to accounts, so the security of each admin's account, including two-step verification and linked devices, is part of the security of the group (WhatsApp Help Center, n.d.-h). Third, the platform provides no organisation-wide log of admin actions in ordinary groups; the record has to be built by the organisation. These points are treated in more depth in Paper 7. The admin side of liability is discussed in WhatsApp group admin legal responsibility. 4.8 Records, data protection officer and impact assessment The LGPD requires controllers and processors to keep a record of their processing operations, "especialmente quando baseado no legítimo interesse" (Brasil, 2018, art. 37), and requires the controller to appoint a data protection officer (encarregado), whose identity and contact must be published (art. 41). The ANPD may require a data protection impact report (art. 38). The GDPR requires records of processing activities (European Union, 2016, art. 30) and an impact assessment where processing is likely to result in high risk (art. 35). A business that runs many groups will often find that its groups are missing from its record of processing because they were created informally. Listing them, with purpose, basis, categories of data, admins and retention, is a simple first step that serves both laws. 4.9 Security incidents in groups Several group events can be personal data incidents: a leaked invite link that lets unknown people join and collect member numbers, a compromised admin account used to post to customers, or a former employee who remains an admin. The LGPD requires the controller to notify the national authority and data subjects of incidents that may cause relevant risk or damage (Brasil, 2018, art. 48). ANPD Resolution 15/2024 sets a period of three working days, counted from the moment the controller learns that the incident affected personal data, for communication to the ANPD (art. 6) and to data subjects (art. 9), doubled for small processing agents, and requires the controller to keep a record of every incident, including those not reported, for at least five years (art. 10) (ANPD, 2024a; ANPD, n.d.). Under the GDPR, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk (European Union, 2016, art. 33; EDPB, 2023). Whether a given group incident reaches the reporting threshold depends on the facts. What the rules make clear is that the organisation needs to notice incidents and record them. In a portfolio of groups without any central monitoring, that is difficult. Related controls are in security settings for large WhatsApp groups. 4.10 Enforcement context Regulators have applied transparency obligations to WhatsApp itself. In 2021 the Irish Data Protection Commission concluded an inquiry into whether WhatsApp Ireland met its GDPR transparency obligations towards users and non-users, and, following a binding decision of the EDPB, imposed a fine of 225 million euros, a reprimand and an order to bring processing into compliance (DPC, 2021). The decision concerned the platform, not businesses using it, but it shows that information about non-users, such as contacts whose numbers are uploaded, is within regulators' attention. This review found no published ANPD or EDPB decision addressing a business specifically for the way it ran WhatsApp groups. 5. Discussion: a minimum compliance file for business groups The findings suggest that most of the risk in business groups does not come from exotic legal questions but from the absence of basic documentation. A minimum file, kept for each group or class of groups, could contain: Purpose and owner. What the group is for, which business unit owns it and which corporate account created it. Role analysis. Whether the organisation is sole or joint controller, and, for partner groups, who handles member requests. Lawful basis and notice. The basis chosen and the text shown to members before or at entry, including the fact that other members will see their number. Format choice. Why a group with visible members is necessary, or whether an announcement group, a Community or one-to-one conversations would meet the purpose with less exposure. Entry rules. Approval of new members, who may share links, and link reset after leaks (WhatsApp Help Center, n.d.-b). Retention rule. Disappearing messages, periodic removal of members whose purpose has ended, and any export kept as a business record with its own retention period. Admin list. Named admins, the accounts they use, the date they were granted rights and the date rights were removed. Incident procedure. How leaks or compromised admin accounts are detected, recorded and assessed against ANPD Resolution 15/2024 and GDPR article 33. Group management tools, including the one founded by the author, can apply some of these rules automatically, such as entry filters, scheduled removal of inactive members and records of moderation actions. Such tools act through a connected WhatsApp account and therefore inherit its permissions and its limits, and their use is itself processing that needs to appear in the record and, where the tool processes data on the organisation's behalf, in a processor agreement (Brasil, 2018, art. 39; European Union, 2016, art. 28). 6. Limitations No primary data. The review does not measure how businesses use groups or how often incidents occur. Legal analysis. The discussion is descriptive, covers only Brazil and the EU, and is not legal advice. Sector rules, labour law and consumer law are outside its scope. Platform documentation. Help Center and developer pages describe intended behaviour, can change without notice and may vary by region or app version. Limited research base. The peer-reviewed studies on workplace messaging are small and qualitative, and the group exposure studies predate several platform changes. Author position. The author founded a group management tool. The review is narrative and not systematic. 7. Conclusion A WhatsApp group run for business purposes is a processing operation for which the organisation is, in most cases, the controller. The LGPD and the GDPR expect that organisation to know the group exists, to have a lawful basis and give notice, to limit the data exposed, to define how long data are kept, to control who has administrator access and to detect and record incidents. The platform supplies useful controls, such as member approval, announcement-only settings and disappearing messages, but it does not hide members' numbers from one another in a regular group, does not let the organisation remove a group creator, and does not provide a central log. Closing those gaps is an organisational task. Two research needs stand out: empirical work on how companies actually configure business groups, and regulatory guidance on the status of business groups created from employees' personal accounts. Competing interests The author is the founder of 9bot, a WhatsApp group management tool discussed in this paper. 9bot is independent and is not affiliated with, endorsed by or a partner of WhatsApp or Meta. No funding was received for this work. Data availability No new data were generated or analysed. All sources are publicly available at the addresses listed below. License This work is distributed under the Creative Commons Attribution 4.0 International License (CC BY 4.0). References Abbas, J., & Alghail, A. (2021). The impact of mobile shadow IT usage on knowledge protection: An exploratory study. VINE Journal of Information and Knowledge Management Systems, 53(4), 830-848. https://doi.org/10.1108/VJIKMS-08-2020-0155 ANPD. (2022). Guia orientativo para definições dos agentes de tratamento de dados pessoais e do encarregado (versão 2.0). Autoridade Nacional de Proteção de Dados. https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes/Segunda_Versao_do_Guia_de_Agentes_de_Tratamento_retificada.pdf ANPD. (2024a). Resolução CD/ANPD nº 15, de 24 de abril de 2024 (Regulamento de Comunicação de Incidente de Segurança). Diário Oficial da União. https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-15-de-24-de-abril-de-2024-556243024 ANPD. (n.d.). Comunicação de incidente de segurança. https://www.gov.br/anpd/pt-br/canais_atendimento/agente-de-tratamento/comunicado-de-incidente-de-seguranca-cis Brasil. (2018). Lei nº 13.709, de 14 de agosto de 2018. Lei Geral de Proteção de Dados Pessoais (LGPD) (consolidated text). https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm DPC. (2021, September 2). Data Protection Commission announces decision in WhatsApp inquiry. Data Protection Commission, Ireland. https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-whatsapp-inquiry EDPB. (2021). Guidelines 07/2020 on the concepts of controller and processor in the GDPR (version 2.1). European Data Protection Board. https://www.edpb.europa.eu/system/files/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf EDPB. (2023). Guidelines 9/2022 on personal data breach notification under GDPR (version 2.0). European Data Protection Board. https://www.edpb.europa.eu/system/files/documents/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 Gegenhuber, G. K., Frenzel, P. É., Günther, M., Ullrich, J., & Judmayer, A. (2026). Hey there! You are using WhatsApp: Enumerating three billion accounts for security and privacy. In Proceedings of the Network and Distributed System Security Symposium (NDSS 2026). Internet Society. https://doi.org/10.14722/ndss.2026.230805 (open-access version: https://arxiv.org/abs/2511.20252) Hoseini, M., Melo, P., Júnior, M., Benevenuto, F., Chandrasekaran, B., Feldmann, A., & Zannettou, S. (2020). Demystifying the messaging platforms' ecosystem through the lens of Twitter. In Proceedings of the ACM Internet Measurement Conference (IMC '20) (pp. 345-359). ACM. https://doi.org/10.1145/3419394.3423651 Meta. (2026, June 29). It's time to reserve your WhatsApp username. Meta Newsroom. https://about.fb.com/news/2026/06/its-time-to-reserve-your-whatsapp-username/ Meta for Developers. (n.d.-a). Groups API. WhatsApp Business Platform documentation. https://developers.facebook.com/docs/whatsapp/cloud-api/groups/ Meta for Developers. (n.d.-b). Get opt-in for WhatsApp. WhatsApp Business Platform documentation. https://developers.facebook.com/documentation/business-messaging/whatsapp/getting-opt-in Mols, A., & Pridmore, J. (2020). Always available via WhatsApp: Mapping everyday boundary work practices and privacy negotiations. Mobile Media & Communication, 9(3), 422-440. https://doi.org/10.1177/2050157920970582 WhatsApp. (2025). WhatsApp Business Data Processing Terms (last updated 22 August 2025). https://www.whatsapp.com/legal/business-data-processing-terms WhatsApp. (n.d.-a). WhatsApp Terms for WhatsApp Business App. https://www.whatsapp.com/legal/WhatsApp-Terms-for-WhatsApp-Business-App WhatsApp. (n.d.-b). WhatsApp Business Terms of Service. https://www.whatsapp.com/legal/business-terms WhatsApp. (n.d.-c). WhatsApp Business Messaging Policy. https://business.whatsapp.com/policy WhatsApp Help Center. (n.d.-a). How to create and invite into a group. https://faq.whatsapp.com/3242937609289432 WhatsApp Help Center. (n.d.-b). How to change group admin settings. https://faq.whatsapp.com/526742385997912 WhatsApp Help Center. (n.d.-c). How to manage community admins. https://faq.whatsapp.com/441425088132574/?locale=en_US WhatsApp Help Center. (n.d.-d). How to turn disappearing messages on or off in a group. https://faq.whatsapp.com/515705483748188 WhatsApp Help Center. (n.d.-e). How to add and remove group members. https://faq.whatsapp.com/841426356990637/?locale=en_US WhatsApp Help Center. (n.d.-f). How to export your chat history. https://faq.whatsapp.com/1180414079177245 WhatsApp Help Center. (n.d.-g). How to manage group admins. https://faq.whatsapp.com/633713745095781/?locale=en_US WhatsApp Help Center. (n.d.-h). Account security tips. https://faq.whatsapp.com/1095301557782068 All URLs were accessed and verified on 30 October 2026. Learn more about 9bot 9bot is a paid WhatsApp group management tool with a 7-day trial. It is an independent product and is not affiliated with or endorsed by Meta or WhatsApp. Visit 9bot.com.br to see how it supports group administrators.