SMS and WhatsApp

WhatsApp marketing for hotels: opt-in rules and a setup checklist

You will be able to decide where to capture WhatsApp consent at your hotel, which Meta-approved template category each message belongs in, and what to measure weekly.

13 min read3,184 words

Key takeaways

Add an unticked WhatsApp checkbox to your WiFi login that names your hotel and stays separate from the WiFi terms, as GDPR Article 7(4) and Recital 32 require.
Add the same box to the check-in card to reach lead bookers who never connect, and add a separate stay-updates box to the booking form.
Store the mobile number with its country code, locale, wording shown and date of consent, so you can demonstrate consent under GDPR Article 7(1).
Verify your Meta Business account, choose a BSP or Meta's Cloud API, and register a dedicated number before you write any message.
Submit templates in the honest category, because a booking confirmation that includes a spa discount is marketing and Meta will recategorise it.
Start with a ceiling of one to two marketing messages per guest per month, and raise it only if opt-outs and your quality rating hold steady.
Report opt-in rate, delivery and read rate, opt-outs and blocks, revenue per send, repeat stay rate and cost per booking weekly, per venue.

Hotels can send WhatsApp marketing only to guests who opted in to WhatsApp messages from that named hotel. Capture consent with an unticked checkbox on the WiFi login and the check-in card, and record when it was given. Use Meta-approved templates outside the 24-hour reply window, and keep promotions tied to the stay.

What does WhatsApp marketing do for a hotel?

WhatsApp marketing should move three numbers you already report on. The first is direct rebooking. The second is spend in your restaurant, bar and spa during the stay. The third is the share of guests you can reach again after checkout.

The channel suits hotels because guest contact is already conversational. Guests ask about parking, breakfast times and late checkout. A WhatsApp thread puts those answers and your offers in the same place.

The mechanism has two halves:

A list. You need guests who agreed to hear from you on WhatsApp.
Messages. You need messages that Meta will approve and that guests will not block.

Most hotel teams work hard on the messages and stall on the list.

Why the list matters more than the sending tool

Mailchimp, Klaviyo and HubSpot send campaigns to contacts you already hold. They do not collect a consented mobile number from the guest who connected in your lobby ten minutes ago.

Purple does. Every guest who logs in to your Guest WiFi can tick a WhatsApp consent box. That record lands as first-party data you own, with the mobile number and country code attached.

Purple runs across 80,000+ live venues and recorded 440 million logins in 2024 (Purple's own data). Hotel groups including Premier Inn and Whitbread use Purple. For your property, one measure matters more than scale: how many arriving guests leave with a consented WhatsApp number on file.

What do you need before you start WhatsApp marketing?

Hotel campaigns run on the WhatsApp Business Platform, Meta's API product. This is different from the free WhatsApp Business app. The app suits a small team on a few devices. The platform adds approved message templates, API access and integrations with your CRM.

Line up the following before you write a single message:

A verified Meta Business account. Business verification confirms the legal entity behind the hotel. It also unlocks higher messaging limits.
An access route. Most hotels connect through a Meta Business Solution Provider (BSP). A BSP is a company Meta approves to provide API access, a shared inbox and campaign tools. Groups with in-house developers can use Meta's Cloud API directly.
A dedicated phone number. The number cannot be active on the WhatsApp app at the same time as the platform.
A display name that matches your brand. Meta reviews the display name against your business, so use the hotel's trading name.
Consent wording. Meta requires the guest to know they are opting in to WhatsApp messages from your named business. GDPR Article 4(11) adds that consent must be freely given, specific, informed and unambiguous.
An updated privacy notice. Name WhatsApp as a channel and list your BSP among the companies that process guest data.
A consent record. GDPR Article 7(1) requires you to demonstrate that each guest consented. Store the channel, the wording shown and the date.
An opt-out route. Article 7(3) says withdrawing consent must be as easy as giving it. Decide how a "STOP" reply updates the guest record.
Three to five draft templates. Write them early, so Meta's review does not hold up your first send.

Most hotels have two natural capture points: the WiFi login and the check-in desk. Use both. They reach different guests and leave different evidence.

The WiFi login, also called a captive portal, is the page a guest sees before they get online. With Purple, you add a checkbox custom field to that page.

Two GDPR rules shape that checkbox:

Leave it unticked. Recital 32 rules out pre-ticked boxes as a form of consent.
Keep it separate from the WiFi terms. Article 7(4) means you cannot make internet access depend on marketing consent.

Good wording is short and names both the channel and the hotel:

Send me offers from [Hotel name] on WhatsApp. Reply STOP at any time to opt out.

Purple calls this a conscious-choice opt-in. The guest reads one line, decides, and connects either way. The same approach builds your email list too. Our guide to collecting customer emails in a restaurant without sign-up forms covers the email version.

The login captures more than a tick. Purple holds these fields against the guest profile:

Mobile number. This is the number you message.
Mobile country code. WhatsApp sends to numbers in full international format, so the country code must travel with the number.
Locale. A value such as en_GB tells you which language version of a template to send.
Marketing status. This records whether the guest is opted in to marketing.

At check-in

The check-in card or digital check-in form reaches the lead booker, who may never connect to WiFi. Add the same unticked box with the same wording.

If your property management system (PMS) stores the flag, record the date as well. A signed paper card is evidence, but nobody can search it. Key the consent into your CRM the same day.

Consider a second, separate box on the booking form: "Send my booking updates on WhatsApp". That gives you permission for stay messages without implying consent to offers.

Which capture point should you prioritise?

Capture point	When it happens	Data you capture	Consent evidence	Who it reaches
WiFi login checkbox	First connection on property	Name, email, mobile, country code, locale, checkbox value	Checkbox value stored against the guest profile at login	Every connected guest, including companions and non-resident diners
Check-in card or digital check-in	Arrival at reception	Mobile from the booking, plus checkbox or signature	Signed card or dated PMS flag	Lead booker only
Direct booking form	At booking, before arrival	Mobile and email from the booking engine	Booking engine consent log	Direct bookers, not guests booked through online travel agencies
QR code that opens a WhatsApp chat	Any time on property	Mobile number only	The guest's first message opens a 24-hour service window, which is not marketing consent	Guests with a question, whom you can ask for consent in the thread

The WiFi login wins on reach and data quality. It reaches guests who did not make the booking. It also records consent digitally at the moment the guest gives it. Check-in fills the gap for lead bookers who never connect.

Send consented data to your CRM

Purple's connectors push data from Purple into external systems, so you can send communications from them. The Introduction to Connectors article lists what is available.

Many hotels run Cendyn, a hotel CRM. The Cendyn connector works like this:

It syncs consent. The connector syncs checkbox custom fields from the WiFi login with Cendyn newsletter subscriptions.
It sends data at login. Data goes to Cendyn as soon as the guest authenticates on the WiFi.
It matches existing records. It finds an existing member by email and last name. If none exists, it creates the member and the subscriptions.
You control the mapping. You choose which Purple fields map to Cendyn member properties.
It fits your estate. You can set it up at account, group or single-venue level.

The Cendyn connector article covers the setup steps. If you run campaigns in Purple Engage, the same opted-in profiles sit in your audience without an import.

Which WhatsApp templates does Meta approve for hotels?

WhatsApp separates two kinds of message.

Replies inside the window. When a guest messages you, a 24-hour customer service window opens. Inside it, your team can reply freely.
Messages you start. Outside that window, any message you start must use a template that Meta has approved.

Every template sits in one of three categories, and the category decides the rules and the charge.

Category	Hotel examples	Permission you need	Meta charge (per-message pricing, from July 2025)
Marketing	Direct-booking offer, spa promotion, seasonal package	WhatsApp opt-in plus marketing consent under GDPR	Charged per delivered message, at a rate set by the guest's country code
Utility	Booking confirmation, check-in reminder, confirming a late checkout the guest requested	WhatsApp opt-in for stay updates	No charge inside an open 24-hour window, charged outside it
Authentication	One-time passcode for a guest app or loyalty login	WhatsApp opt-in	Charged per delivered message

The approval rules that catch hotels out

Choose the honest category. Meta checks content against the category you select and can recategorise it. A booking confirmation that includes a spa discount is marketing.
Supply a sample for every variable. Templates use numbered placeholders, such as {{1}} for a first name. Reviewers need an example value for each one.
Do not start or end with a variable. Meta rejects templates that open or close on a placeholder.
Build one version per language. Each language is a separate translation under the same template name. Use the locale from the WiFi login to choose your top three.
Allow time for review. Meta reviews every new and edited template, and review can take up to 24 hours.
Protect your quality. Meta can pause templates that draw blocks and reports.
Add an opt-out button. Meta lets you add a quick-reply opt-out button to marketing templates. Use it, and connect it to your suppression list.

What should a hotel send on WhatsApp, and when?

Guests opted in to hear from a hotel, not to read a newsletter. Messages that land are tied to the stay, or give a clear reason to come back. Brand stories and long-form content belong in email.

By stage of the stay

Before arrival (utility). Send the booking confirmation, check-in time, parking, directions and a digital check-in link. These are the messages guests expect from a hotel.
During the stay (service replies, plus one offer). Answer questions inside the 24-hour window. Send at most one marketing message, such as a dinner table or spa slot on a quiet evening.
At checkout (utility). Send a thank-you message with the folio, the guest's final bill.
The return window (marketing). Send a direct-booking offer timed to the date the guest stayed last year, or to a major event in your city.

Start with a ceiling of one to two marketing messages per guest per month. Raise it only if your opt-out rate and quality rating hold steady.

SMS follows similar consent logic but different economics. Our guide to SMS marketing for restaurants: costs, consent and what to send compares the two channels.

Worked scenario: a 200-room city hotel builds its list from the lobby

Situation. A 200-room city hotel held mobile numbers only for direct bookers, with no WhatsApp consent recorded. Its booking engine was its only capture point, so guests from online travel agencies never joined the list.

What it did. The hotel added an unticked WhatsApp offers checkbox to the WiFi login and the check-in card. It mapped the mobile number, country code, locale and checkbox to its CRM. It then submitted two utility templates and two marketing templates in English, French and German.

Outcome. The hotel set its first-year target with the planning model below. The rates are illustrative assumptions, so replace them with your own login data after the first month.

Arrivals. At 70% occupancy and a two-night average stay, the hotel welcomes about 70 arriving parties a day, or 2,100 a month.
Logins. If 60% of those parties connect to the WiFi, that gives 1,260 logins a month.
Opt-ins. If 25% of those guests tick the box, the hotel gains 315 opted-in guests a month.
Annual total. That adds up to about 3,780 consented WhatsApp contacts a year from one property, before check-in opt-ins.

How do you know your WhatsApp marketing is working?

Measure six numbers weekly, per venue:

Opt-in rate. Divide WhatsApp opt-ins by WiFi logins. This tests your wording and the placement of the checkbox.
Delivery and read rate. Your BSP reports both. Guests can switch off read receipts, so treat the read rate as a floor.
Opt-out and block rate. Rising blocks lower your phone number's quality rating, which Meta reports as high, medium or low.
Revenue per send. Divide attributed revenue by marketing messages delivered. Give each campaign a unique booking code or tagged link.
Repeat stay rate. Compare opted-in guests with guests who did not opt in, over the same 12 months.
Cost per booking. Add Meta charges and BSP fees, then divide by attributed bookings.

What goes wrong, and how do you avoid it?

If guests must agree to WhatsApp messages to get online, their consent is not freely given under Article 7(4). Keep the checkbox optional and separate from the terms of use.

A pre-ticked box

Recital 32 is explicit that silence and pre-ticked boxes are not consent. Any list built this way cannot be used for marketing.

GDPR consent must be specific, and Meta requires WhatsApp-specific opt-in. An email subscriber has not agreed to WhatsApp messages. Ask again, on the right channel.

Marketing dressed as utility

Situation. A 120-room resort with a spa wrote one template: "Your booking is confirmed. Treat yourself to 20% off spa treatments this weekend." It submitted the template as utility. The resort planned to send it to 1,100 guests that month who had asked for booking updates on WhatsApp. Only 340 of those guests had also opted in to offers.

What it did. Meta recategorised the template as marketing. The resort split it in two: a utility confirmation for all 1,100 guests, and a separate spa offer for the 340 with marketing consent.

Outcome. Charged marketing messages fell from 1,100 to 340, a 69% reduction. No offer reached a guest who had not agreed to receive one. This is a worked illustration of the rule, not a reported case.

Sending too often

Frequent marketing drives blocks, and blocks lower your quality rating and can pause templates. Meta also caps the number of marketing messages a guest receives from all businesses. Messages above that cap may not be delivered. Keep to your frequency ceiling.

Broken numbers

A mobile number without its country code fails. Store the country code from the WiFi login alongside the number, and test sends to a sample before every campaign.

Your WhatsApp setup checklist for hotels

Verify your Meta Business account.
Choose a BSP or Meta's Cloud API.
Register a dedicated number and a display name that matches your trading name.
Write consent wording that names WhatsApp and the hotel.
Add an unticked checkbox to the WiFi login, separate from the WiFi terms.
Add the same box to the check-in card, and a stay-updates box to the booking form.
Update your privacy notice to name WhatsApp and your BSP.
Map mobile number, country code, locale and checkbox to your CRM through a Purple connector.
Submit two utility and two marketing templates, with sample values, in your top guest languages.
Add the opt-out button to marketing templates and route STOP replies to suppression.
Set a marketing frequency ceiling per guest.
Build a weekly report covering opt-in rate, quality rating, opt-outs and revenue per send.

Frequently asked questions

Yes, provided the guest ticked a separate, unticked WhatsApp box that names your hotel. GDPR Article 4(11) requires consent that is freely given, specific, informed and unambiguous. Article 7(4) means WiFi access cannot depend on it. Store the wording shown and the time of consent, so you can demonstrate it under Article 7(1). An email opt-in alone does not cover WhatsApp messages.

How much does WhatsApp marketing cost a hotel?

You pay Meta for each delivered marketing template, at a rate set by the guest's country code, plus your BSP's platform fee. Utility templates sent inside an open 24-hour customer service window carry no Meta charge. Your replies inside that window are also free. Check Meta's current rate card before you budget, because rates vary by country and Meta revises them.

Do we need a WhatsApp Business Solution Provider?

Not necessarily, but most hotels use one. A Meta Business Solution Provider gives you API access, a shared inbox for front-desk teams and campaign tools without in-house development. Hotel groups with their own developers can connect to Meta's Cloud API directly. Either route needs a verified Meta Business account, a dedicated number and approved templates before your first business-initiated message.

Yes, through Purple's connectors, which push consented guest data into external systems. The Cendyn connector, for example, sends data as soon as a guest authenticates on the WiFi. It matches an existing member by email and last name, or creates a new one, and syncs checkbox fields with Cendyn subscriptions. You choose which fields to map, including mobile number, country code and locale.

How does Purple compare with Mailchimp, Klaviyo or HubSpot for hotel messaging?

Purple builds the list; those tools send to a list you already hold. Mailchimp, Klaviyo and HubSpot run campaigns, but none collects a consented mobile number from a guest connecting in your lobby. Purple captures that opt-in on the WiFi login as first-party data, with the country code and locale WhatsApp needs. You can run campaigns in Purple Engage or pass the data to your existing CRM.

Do we need new WiFi hardware to capture WhatsApp opt-ins?

No. Purple is hardware-agnostic and runs as a cloud overlay on the access points you already own. Supported vendors include Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Adding a WhatsApp consent checkbox changes the login page, not the network, so your IT team does not need to replace any equipment.

How do guests opt out of hotel WhatsApp messages?

Guests reply STOP or tap the opt-out button that Meta lets you add to marketing templates. GDPR Article 7(3) requires withdrawal to be as easy as giving consent, so process every opt-out promptly. Route opt-out replies from your BSP to the guest record in your CRM, and suppress that number from every marketing send. Keep the withdrawal record alongside the original consent.