WhatsApp chatbot for business: what AI can answer, what Meta charges and what Saudi Arabia's PDPL expects

A WhatsApp chatbot for business works best on the routine questions your team already answers from a price list, a schedule or a written policy. Anything involving money, complaints or judgement should pass to a person inside the same chat.

Since 1 October 2026, Meta also charges for free-form replies inside the 24-hour window once a business number has used its 1,000 free ones for the month [1], so the bill depends on how many messages the assistant sends. This guide is for companies in Saudi Arabia, the wider Gulf and beyond.

Three ways to run a WhatsApp chatbot for business

A WhatsApp chatbot for business is an assistant that answers customers on your company's own number. (Meta AI, built into WhatsApp for personal use, is a separate product.) There are three ways to run one.

When vendors in the Gulf offer "the WhatsApp Business API", they usually mean the third route. A Business app number can often join the Platform and keep using the app ("coexistence") [3]. Meta's terms also restrict AI providers whose AI is the product itself, though a business may hire one as its solution provider [6][7]. The FAQ below covers both.

How to choose: the app's automatic messages cannot answer questions. If answers come from a price list and a few policies, Meta Business Agent may be enough where offered. If they need live data from your own systems, you need the Platform plus integration work; see our guide to ready-made software, integrations or a custom build.

What an AI assistant can answer well

Start with your own chats rather than a vendor's demo. Tag the first message of the last 200–300 chats, or two ordinary weeks, by question type, and count; strip names and numbers from any sample you share. Then give each type a lane:

• Assistant answers: written down and the same for everyone: opening hours, directions, documents needed, delivery areas, listed prices, the return policy.
• Assistant drafts, staff send: depends on the customer's case or on a lookup that can be wrong, such as a custom quote or the reason for a delay. It needs an inbox where staff edit the draft before it goes; without one, treat these as "Person only".
• Person only: money decisions, complaints, cancellations and refunds; anything medical or legal; account questions that need an identity check; distressed customers.

A type goes in "Assistant answers" only if it is frequent, its source is written and current, and a wrong answer is cheap to correct. Copy the grid and add your own types; the filled rows are hypothetical.

When the assistant must hand over to a person

Meta allows automated replies inside the 24-hour window, but you "must also have available prompt, clear, and direct escalation paths", such as transfer to a human agent in the chat, a phone number or email [8].

The 24-hour window sets the deadline for each pickup. Free-form replies are possible only while the customer service window is open, and each customer message resets it. After it closes, only an approved template, charged by category, can go out through the Platform [1][8].

If a customer writes at 9 p.m. on Thursday and nobody answers by 9 p.m. on Friday, the next working day's reply must be a paid template, unless the customer writes again. So decide who covers the window on each market's weekend, or have the assistant say when a person will reply. On a coexistence number, staff replies from the Business app are not bound by the window and stay free [3].

Whoever picks up should get a two-line summary, the details the assistant collected (name, order number, preferred time: no more than needed) and the reason. Staff must be able to take over any chat, and the assistant must go quiet when they do.

WhatsApp chatbot pricing: how Meta charges since 1 October 2026

Meta charges per delivered message, at a rate set by the message category and the recipient's country [1].

Pricing checked on 29 September 2026 against Meta's published 1 October 2026 changes. Meta may change prices on the first day of any quarter [1]; check the current rate cards before you budget.

Messages you start: templates in three categories

Templates are marketing, utility (order updates, reminders) or authentication (one-time codes), priced by category and by the country calling code of the recipient's number [1]. A Dubai company messaging a +966 number pays the Saudi rate.

A template that mixes an order update with a promotion counts as marketing [9]. Volume tiers lower utility and authentication rates only.

Service messages: replies inside the 24-hour window since 1 October 2026

A service message is any free-form reply written by a person or a third-party AI rather than Meta Business Agent [5]. Since 1 October 2026:

• Service messages cost each market's utility and authentication rate, with no volume tiers [1][5].
• Each business phone number gets 1,000 free delivered service messages a month, shared by all its Platform replies, with no roll-over [1].
• Utility templates sent inside the window, free since July 2025, are now charged [5].
• Without a payment method, Meta stops delivering service messages after the free 1,000 [1], so the assistant can go silent mid-month.

What stays free

• Messages customers send you [1].
• Replies inside a free entry point window. When a customer messages you from a click-to-WhatsApp ad on WhatsApp's Android or iOS app (not desktop or web) and you reply within the customer service window, a window opens that "may remain open for up to 7 days", and every message in it is free [1]. Older Meta pages, and the Arabic pricing page, still say 72 hours.
• Staff messages sent from the Business app on a coexistence number [3].

Meta Business Agent pricing: if the AI is Meta's own

Meta Business Agent replies carry one per-token charge covering the AI and delivery, about 4–5 US cents per message by Meta's estimate. They are charged even inside a free entry point window, and never on top of a service charge [5].

A cost worksheet

Count each line per business number per month, then multiply by the current rate.

Worked example (hypothetical). A furniture retailer with showrooms in Jeddah and Dubai has one business number. In a month, customers start 1,200 chats, none from ads, and each gets three replies through the Platform: 3,600 service messages. After the 1,000 free, 2,600 are charged: say 1,800 to +966 numbers and 800 to +971. Add 900 order updates (utility) and one offer to 2,000 opted-in customers (marketing). Meta's bill: 1,800 × the Saudi service rate + 800 × the UAE service rate + each template × its recipient country's rate, then providers' fees. Ad-driven chats are left out: we found nothing in Meta's pricing pages saying whether free-window replies use up the 1,000 free messages.

What changes the bill: one complete answer instead of three short bubbles, since each delivered message is charged [5]; no template where a free-form reply will do, and a check of each template's category [9]; ad-driven chats tracked separately.

What Saudi Arabia's PDPL expects

This article is general information, not legal advice. Check your company's obligations against the current text of the law and its implementing regulations.

Saudi Arabia's Personal Data Protection Law (PDPL) applies to processing in the Kingdom and to processing of data about people residing there "by any means from any party outside the Kingdom" [10, Art. 2]. So a company abroad that answers customers living in Saudi Arabia is covered too, alongside its other markets' laws. SDAIA, the Saudi Data & AI Authority, publishes the law's Implementing Regulation.

Offers need consent; answers need a legal basis

Answering a customer's question differs from sending offers. Article 6 lists legal bases other than consent, such as a previous agreement with the customer or, for data that is not sensitive, a legitimate interest assessed and documented first [10][11, Art. 16]. Which fits is a legal question.

Offers need documented consent, a clearly named sender and a free, easy way to stop that is honoured without delay [10, Art. 25][11, Art. 28–29]. Only the Regulation's Article 28 mentions the "absence of a prior interaction"; the law's Article 25 does not, so the safer course is documented consent from everyone you send offers to; our guide to starting with one AI task sets these articles out. Meta's rule applies everywhere: message only people who gave you their number and an opt-in naming your business, and honour every stop request [8][12].

On WhatsApp that means one consent log (who, when, which channel, what they agreed to), an assistant that checks the stop list before any send, both "stop" and «إيقاف» working, and offers only in templates carrying your business name. Treat an offer added to a reply as marketing for consent purposes, even though Meta won't charge it as a template [5].

Tell customers who they are talking to

The PDPL requires a privacy policy and, when you collect data, telling people the legal basis, the purpose, who receives it and whether it will be processed outside the Kingdom [10, Art. 12–13]. The Regulation adds your identity and contact details, the retention period and how to withdraw consent [11, Art. 4]. If your processing with new technologies is continuous or large-scale, also say how data is protected and whether decisions are fully automated [11, Art. 4(5)]; ask counsel whether that covers your assistant.

The first message should name the company, say it is automated (our recommendation, not a quoted legal duty), link the privacy policy and explain how to reach a person:

Welcome to (company name). I'm the automated assistant and can help with appointments, prices and delivery. Privacy policy: (link). To reach a person, type "staff".

Meta also requires accurate contact details in your WhatsApp Business profile and a published privacy policy [8].

Your provider and where the data goes

Choose processors "providing the necessary guarantees" and check that they keep to them [10, Art. 8]. The agreement must cover purpose, data categories, duration, breach notice, whether the processor is subject to other countries' rules, notice of any disclosure Saudi law requires of it, and subcontractors [11, Art. 17].

If chat data leaves the Kingdom, as it may when the AI model runs abroad, the transfer rules apply: minimum data, adequate protection, safeguards such as standard contractual clauses and sometimes a risk assessment [10, Art. 29][13]. If your solution provider is an AI provider, Meta's terms bar letting WhatsApp data be used to "create, develop, train, or improve" AI models, except to fine-tune one "for your exclusive use" [7].

A written impact assessment is required, among other cases, where a company processes personal data with new technologies on a large scale or repeatedly [11, Art. 25(1)(c)]: the official Arabic says «أو», "or", though SDAIA's English translation says "and". A daily customer assistant may qualify; ask counsel.

Ask your provider, in writing:

1. Where are chats, voice notes and logs stored and processed, and which AI model provider sees them?
2. How long are they kept, and can we delete them?
3. Is our WhatsApp data used to train any model not reserved for us?
4. Does your service fit Meta's current terms for AI providers?
5. Will you report breaches without undue delay, and can we export everything if we leave?

What never to ask for, and how long to keep chats

Meta's policy bars asking customers for, or sharing, full card numbers, financial account numbers, ID card numbers or other sensitive identifiers [8]. Health data is sensitive under the PDPL [10, Art. 1(11)], so a clinic's assistant books appointments and does not collect symptoms. Chat logs are personal data: destroy them once no longer needed, unless a legal basis requires keeping them [10, Art. 18]. Set a retention period and state it in your privacy policy.

Arabic chatbot testing: what to try before your customers do

Build a test set of 30–50 real past messages, names and numbers removed. Include:

• Saudi and Gulf dialect («وش أسعاركم؟», "what are your prices?")
• Arabizi, Arabic typed in Latin letters with digits for some sounds ("3ndkm tawseel?", "do you deliver?")
• English product codes inside Arabic sentences, and typos
• English or other languages, if your customers use them, including mid-sentence switches
• voice notes and dates in the Hijri (Islamic) calendar
• five questions your sources cannot answer

Score each reply: correct, right answer in the wrong tone, wrong, or should have handed over; the last two must be zero before launch. SDAIA's guidance for the public warns that generative models can confidently state invented "facts" [14, §5.3]; the five unanswerable questions show whether the assistant hands over or invents. Re-run the set whenever a price list, policy or model changes.

Before you switch it on: a checklist

Answers

• A lane for every question type
• A written, dated source with an owner for each "Assistant answers" type

Handover

• A person and a pickup time for each trigger
• The 24-hour window covered at weekends too
• The assistant stops when staff step in

Costs

• A payment method on the account [1]
• The worksheet filled with current rates
• A monthly check of messages per chat

Data

• A first message that names the company and links the privacy policy
• Consent log and stop list connected
• Article 17 items in the processor agreement
• Transfer and impact-assessment questions answered
• Log retention set
• No requests for ID or card numbers

Start with one question type and measure it

Run your most frequent "Assistant answers" type for two weeks, then add the next. Track:

• time to first reply
• chats closed without handover
• wrong answers in a daily spot check of 20 chats (target: zero)
• handovers answered inside the window
• messages per chat, which drive the cost
• opt-outs

Still deciding where AI should start in your company? Read our guide on picking one task and costing it.

O AI, a Saudi AI and software company in Al Khobar, connects AI to the channels companies already run, including customer replies and WhatsApp, in Arabic and English. Pick one question your team answers on WhatsApp every day, then book a free consultation to see whether an AI assistant is worth it. No commitment; we reply within one business day.