PECR-safe abandoned cart messages on WhatsApp (UK checklist)

To send PECR-safe abandoned cart messages on WhatsApp in the UK, get a clear opt-in at checkout that names your business, only remind people about what's in their own basket, put a simple way to opt out (like "Reply STOP") in every message, and keep a record of who agreed, when and to what wording. WhatsApp's own policy also requires opt-in, so you need consent for both the law and the platform.

Does PECR apply to WhatsApp abandoned cart messages?

Yes. The Privacy and Electronic Communications Regulations (PECR) have rules for marketing by "electronic mail", and the ICO reads that widely. Its training notes list email, SMS and messaging apps such as WhatsApp. So a WhatsApp message is covered in the same way as a marketing email or text.

Is a cart reminder marketing? Treat it as marketing. It's there to encourage a purchase, and Meta usually classes cart reminders as marketing templates too. A pure service message, like a dispatch notice for an order someone already paid for, is different, and the electronic mail marketing rules don't cover it.

The stakes went up this year. Since 5 February 2026, under the Data (Use and Access) Act 2025, the ICO can fine PECR breaches up to £17.5 million or 4% of global annual turnover, whichever is higher. The ICO's statement sets this out. That's a ceiling, not a typical fine. Still, it's a good reason to get the basics right.

Two sets of rules: the law and WhatsApp

This is the part people miss. Being fine under PECR doesn't automatically make you fine with WhatsApp, and the other way round.

PECR lets you send electronic mail marketing to individuals in two cases: with their consent, or under the "soft opt-in". The soft opt-in needs all of these: you collected the details yourself, during a sale or negotiations for a sale; you only market your own similar products; and you offered a way to opt out when you collected the details and in every message after. The ICO's small business guidance says adding something to an online basket can count as negotiations for a sale.

WhatsApp's policy says you may only contact people who gave you their number and opted in to receive messages from you. The opt-in should make it clear which business the messages come from. The policy also says you must honour any request to stop, made on WhatsApp or anywhere else.

In practice the simplest safe route is the same for both: an unticked opt-in at checkout that names your business and says what kind of messages you'll send.

The WhatsApp abandoned cart PECR checklist

Go through this before your first reminder goes out.

Before you send anything

• Unticked opt-in box at checkout. Not pre-ticked, and separate from accepting your terms.
• Wording that names your business and says what they'll get, for example basket reminders and offers on WhatsApp.
• Opt-out offered at that point too. The checkbox itself can do this: leaving it unticked means no.
• Consent saved with proof. Store the mobile number, the date and time, the exact wording shown and where it was shown.
• Privacy notice updated. Say you use WhatsApp, what for, which providers process the data, and how to stop.
• Template approved by Meta. Reminders sent outside the 24-hour window must use an approved template.

In every reminder

• Only their own basket. Remind them about what they left, not unrelated products from other brands.
• A clear opt-out, like "Reply STOP to opt out", in every message.
• Your business name so nobody wonders who's messaging them.
• One reminder, two at most. Then stop for that basket.

After you send

• STOP works straight away and adds the number to a suppression list that every workflow checks.
• Stop requests from other channels count. If they unsubscribe by email or ask by voice, WhatsApp stops too.
• A log of every send, with the consent record it relied on.

Example opt-in and reminder wording

Keep it plain. Here's wording you can adapt. Change "Linen & Co" to your store name.

That's close to the flow in my abandoned cart demo: one reminder about an hour after the shopper leaves, with the item, price, checkout link and a STOP opt-out. The demo uses a fictional store and sample data.

How I build the checks into the workflow

The rules above only help if the workflow enforces them every time. In n8n, every run checks these before sending:

1. Is there an opt-in record for this number, and does it cover WhatsApp marketing?
2. Is the number on the suppression list?
3. Has an order been placed since the basket was abandoned? If yes, stop.
4. Have we already sent a reminder for this basket, or too many to this person this week?

The template only goes out if every answer is right. Each decision is logged: sent, skipped for no consent, skipped because they bought, and so on. If a STOP comes in, a separate step updates the suppression list straight away. When a shopper replies with a question instead, a WhatsApp AI agent can answer it from your store data.

For the full step-by-step flow, timing and the app vs custom build choice, read how to recover abandoned carts with WhatsApp automation. To see where cart recovery fits with your other automations, have a look at abandoned cart recovery on the workflow automation page.

Mistakes that cause trouble

• A pre-ticked box or consent hidden in the terms. That isn't valid consent under UK GDPR.
• Messaging numbers from an old list or another company. The soft opt-in only covers details you collected yourself.
• No opt-out line in the message. PECR needs it in every message, not only the first.
• STOP that only works on one flow. Someone opts out of reminders and then gets a promo blast the next week.
• Reminding people who already paid. Annoying, and it gets your number reported.
• No records. If someone complains, you need to show when and how they agreed.

Not sure your current set-up passes? Book a free 15-minute audit and I'll go through your checkout opt-in and reminder flow with you.

Frequently asked questions