📋 WhatsApp Rules & Costs

Your WhatsApp Business number was restricted. Now what?

Most merchant bans trace to one decision made at signup — and it isn't what you were sending.

A WhatsApp Business restriction is Meta limiting or removing your ability to send messages, and it arrives in stages rather than all at once. Understanding the ladder tells you how much trouble you are actually in, and what to do next.

The enforcement ladder

From Meta's policy enforcement documentation:

StageWhat happensDuration
1Warning—
2Block on one message type (marketing, utility or authentication)1 to 3 days
3Block on all messaging5, 7 or 30 days
4Indefinite account lockAppealable
5Permanent offboardingFinal

Named triggers include spam, template misclassification, high-risk categories — adult content, alcohol, tobacco, drugs, gambling, unsafe supplements — and excessive negative user feedback. Appeals go through Business Support Home and are typically decided in 24 to 48 hours.

The cause most merchants never suspect

A large share of merchant restrictions have nothing to do with what was sent. They come from how it was sent.

There are two ways to automate WhatsApp. One is the official Cloud API, which Meta provides and sanctions. The other is an unofficial route where a tool links itself to the WhatsApp Business app as a device — often set up by scanning a QR code — and drives it. The second is cheaper, needs no template approval, and is against WhatsApp's terms.

Merchants using such tools report being restricted while sending nothing but order confirmations, because the detection is on the automation pattern rather than the message content. One merchant reviewing such an app on the Shopify App Store put it precisely: their account was restricted after months of use, they had sent no broadcasts and no spam, and the cause was that the app connected by linking a device rather than through the official API.

How to tell which you have. If setup involved scanning a QR code with your phone, or the tool asks you to keep the WhatsApp Business app open or reconnect periodically, it is not the official API. If setup involved Meta Business Manager, a display name review and template approval, it is. ConvoFly uses the official Cloud API — which is also why templates need approving here and do not there.

The other common causes

  1. Messaging people who did not opt in. Blocks and reports are the strongest negative signal there is. See opt-in rules.
  2. Template misclassification. Repeatedly submitting promotional content as utility is a named trigger, not a clever saving. See utility versus marketing.
  3. Restricted categories. See what you cannot sell on WhatsApp.
  4. Volume with no engagement. Large sends that nobody replies to, repeatedly.

What to do in the first hour

  1. Read the notice. It names the stage and usually the reason. A 1–3 day block on one message type is very different from an indefinite lock.
  2. Stop sending. Pause broadcasts and switch off marketing automations. Continuing to push against a block makes stage 3 more likely.
  3. Do not create a second account. This reads as evasion and is a reliable route to permanent removal.
  4. Identify what changed. A new campaign, a new template, a new tool, a bought list — restrictions rarely arrive without a change.
  5. Appeal through Business Support Home, stating what happened and what you have changed.

What to fix before you resume

The warning sign before a restriction

Quality rating is the leading indicator. It moves from green to yellow to red based on recent user feedback — blocks and reports — and a downgrade usually precedes enforcement. Meta describes the rating in its Business Help Centre. Treat yellow as a stop signal rather than a caution: what to do when quality turns yellow.

The uncomfortable summary

Merchants who lose their number rarely lose it for one dramatic mistake. They lose it for a cheap setup decision made months earlier, compounded by a list that was never really opted in. Both are fixable in advance and neither is fixable afterwards.

Official API or linked device: how to tell, and why it decides everything

Because this is the cause behind most merchant restrictions, it is worth being able to identify in under a minute.

SignalOfficial Cloud APIUnofficial linked device
How you set it upMeta Business Manager, display name reviewScanned a QR code with your phone
TemplatesMust be approved by Meta before sendingNone needed — send anything
Does the phone need to stay connected?NoYes, and it drops
Message chargesBilled by Meta per template messageUsually just a subscription
Ban riskNormal policy riskStructural

The counter-intuitive part is that the unofficial route looks better on every line except the last one. No approval queue, no per-message fee, faster setup. That is precisely why merchants choose it, and why they are surprised when a compliant-looking operation gets restricted.

The detection is on the automation pattern rather than the message content, so "we only send order confirmations" is not a defence. If your setup involved a QR code, that is the finding, and no change to what you send will alter it.

A triage checklist for the first hour

  1. Read the notice and identify the stage. A 1–3 day block on one message type is a warning shot. An indefinite lock is not.
  2. Pause every marketing automation and broadcast. Leave transactional flows running if messaging is still permitted.
  3. Do not create another account or number. This single decision converts recoverable situations into permanent ones more often than anything else.
  4. Write down what changed in the last seven days. A new list, a new template, a new tool, a higher send volume. Restrictions rarely arrive without a change, and the appeal is stronger when you can name it.
  5. Appeal through Business Support Home, stating what happened, what caused it, and what you have already changed. Decisions typically come in 24 to 48 hours.
  6. Tell your team to stop sending manually too — a blocked automation is pointless if someone is broadcasting from the inbox.

What to fix before you resume

An appeal that succeeds and is followed by the same behaviour produces a second, longer block. The order that matters:

What you lose, and how to be less exposed next time

The reason this matters more than an equivalent email problem is that the number is an asset with your customers' side of the relationship attached: it is printed on your packaging, saved in their phones, and answering your ads. You cannot replace it by opening a new one.

Two things reduce the exposure without much effort. First, separate consent for order updates and marketing at checkout, so the customers who only want tracking never have a reason to block you — opt-in rules covers the structure. Second, lean on utility flows, which generate engagement rather than complaints and are free inside an open conversation window under Meta's pricing rules. A store whose WhatsApp presence is mostly order updates and support is very hard to get restricted.

Warning signs, in the order they appear

Restrictions are the end of a sequence, not the start of one. Each of these is a chance to act while it is still cheap:

  1. Opt-outs rising faster than opt-ins. The earliest signal, and the one nobody watches.
  2. Reply rates falling on transactional messages. People have stopped reading you, which means the next marketing send lands worse.
  3. Quality rating moves off green. Now you have days, not weeks.
  4. Error 131049 on campaigns. Sends are already being declined.
  5. A warning notice. The ladder has started.

By stage three you should have stopped marketing entirely. By stage four you are paying to be ignored. Full triage is in what to do when quality turns yellow.

Worth saying plainly: none of this is about being cautious for its own sake. A store that keeps its number healthy can send more, reach more people and pay less, because a good rating unlocks tier increases and most of its messages sit inside free conversation windows. Account health and commercial performance are the same thing here, not a trade-off.

Frequently asked questions

Why was my WhatsApp Business account restricted when I only send order confirmations?

Most often because the tool sending them connects by linking a device rather than through the official Cloud API. Detection is on the automation pattern, not the message content, so compliant messages sent through a non-compliant route still trigger restrictions.

How long do WhatsApp restrictions last?

Meta's ladder runs from a warning, to 1–3 day blocks on one message type, to 5, 7 or 30-day blocks on all messaging, to an appealable indefinite lock, to permanent removal.

How do I appeal a WhatsApp Business restriction?

Through Business Support Home. Appeals are typically decided in 24 to 48 hours. Do not create a second account in the meantime — that reads as evasion.

How can I tell if I am on the official WhatsApp API?

If setup involved scanning a QR code, or the tool asks you to keep the WhatsApp Business app open or reconnect periodically, it is not official. The official Cloud API involves Meta Business Manager, a display name review and template approval.

Need help? Message us