WhatsApp orders and a Shopify store in the Gulf: what works and what to avoid

If you sell in the Gulf, you may be asked for "WhatsApp on the Shopify store", or want it yourself. The trouble is that this phrase covers three different jobs, with different rules, costs and risks. Buy the wrong one and you waste money, or you break Meta's rules and risk limits on your messages.

This guide separates the three jobs. It then sets out what Meta's own documentation says about permission, message templates and pricing, what Shopify's pages say about orders, payments and access, and what the UAE personal data law says about consent. It ends with a question list to use before you buy an app or hire a developer. We read every source on 3 November 2026. Meta's pricing page shows changes on 1 July 2025 and 1 October 2026, so check it again before you decide.

Three jobs people mean by WhatsApp for my store

1. Customers message you. A chat button or link on your store. The customer starts the conversation and you reply.
2. You send updates. Order confirmation, dispatch and delivery messages, sent by software after an order is placed in Shopify.
3. You take orders in chat. The customer agrees to buy in WhatsApp, and your team enters the order in Shopify and arranges payment.

Job 1 needs the least set-up. Job 2 needs the customer's permission, approved message templates and software that watches your Shopify orders. Job 3 is mostly a process problem: it works only if every chat order ends up as a proper order in your store.

What Meta's documentation says about sending messages

Meta's developer documentation covers the WhatsApp Business Platform, an API-based product that businesses use through software. We did not open a Meta page that compares it with the WhatsApp Business app, so ask whoever sets this up which one they mean and what each can and cannot do. These points come from the Platform pages.

• The 24-hour window. A window opens when a customer messages or calls you, and each new customer message resets it. Inside the window you can send free-form replies. Outside it, only approved template messages are allowed.
• Templates. Each template has a name, a category (marketing, utility or authentication) and a language. Meta reviews templates automatically, and a rejected template cannot be sent. Plan an Arabic and an English version of each message.
• Category traps. A utility template must be non-promotional. Meta's page says a template that mixes an order update with a promotion is classed as marketing. For businesses that repeatedly label marketing templates as utility, Meta describes escalating measures: a written warning, then rate limits on utility messages, then recategorising all utility templates as marketing.
• Permission. Meta says businesses must get opt-in before messaging people. You need the person's mobile number and their agreement to hear from your business. The opt-in must say clearly that the person agrees to receive communications and must name your business. Meta suggests covering the types of message you plan to send, and giving clear opt-out instructions that you honour. People can block or report you, and a low quality rating over time can lead to rate limits.

What it costs: a way to work it out

Meta's pricing page says it charges per message, not per conversation, and only for messages that are delivered. This changed on 1 July 2025. Each template falls into one category, and the category sets the rate. Messages from customers to you are free. The page also says that from 1 October 2026 service messages beyond a free monthly allowance are charged again, and utility messages sent inside the 24-hour window are charged too. Both had been free. Read the page again before you budget, because prices can change on the first day of a quarter.

Rates depend on the message category and on the country calling code of the customer's phone number. Meta's page says lower rates can apply for utility and authentication messages at higher monthly volumes. The rate card names the UAE, Saudi Arabia, Qatar, Kuwait and Oman individually. Bahrain falls under a "Rest of Middle East" group. Rate cards come in 16 currencies, including AED and SAR, and the page says the currency is chosen when the account is created and cannot be changed directly. We do not quote rates here, because they sit in Meta's rate files and change.

Work out your own number. Monthly Meta cost equals (delivered marketing messages × marketing rate) plus (delivered utility messages × utility rate) plus service messages beyond the free allowance and any other category you use, calculated for each country. For example, if the utility rate for a country is R and you send 3,000 delivered utility messages to numbers from that country in a month, the cost is 3,000 × R. An app or messaging provider may add its own fee. Ask for the Meta charge and the provider fee separately.

Permission and personal data in the Gulf

Meta's opt-in page tells businesses to comply with applicable law and does not say which laws apply. For the UAE, the government portal says the Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, applies to processing personal data inside or outside the UAE and came into force on 2 January 2022. The text we read says that processing without consent is prohibited except in listed cases. Consent must be a clear positive statement or action, you must be able to prove it, the request must be simple and unambiguous, and withdrawing it must be easy. People may object to processing for direct marketing. The text ties the compliance deadline to executive regulations, with up to six months after they are issued, which the Council of Ministers may extend. Ask your adviser what applies today. The portal lists separate laws for some free zones, such as DIFC.

The pages we read do not mention WhatsApp. We did not confirm the personal data or marketing message rules for Saudi Arabia, Qatar, Kuwait, Bahrain or Oman, so treat them as questions for a qualified adviser in each country. Ask: which law covers our customer phone numbers, what counts as consent for marketing messages, can we message customers who gave their number only for delivery, and where may the data be stored?

This is general information, not legal or tax advice. Check the current rules or ask a qualified adviser before you decide.

What works

• Ask for permission at checkout, in plain words. Name your business and say which messages the customer will get, for example order updates. Keep a record of the date, the number, the wording shown and where it was collected.
• Keep order updates and promotions apart. Send updates as utility templates with no sales text. Send offers only to people who agreed to offers.
• Make Shopify the record of every order. If a customer agrees to buy in chat, create the order in Shopify. Shopify shows orders paid by a manual method, such as cash on delivery, as pending until you mark them as paid, so your team can see what is still open.
• Plan for missed events. Shopify's webhooks tell an app when something happens, such as a new order. The page says delivery is not always guaranteed and that order is not guaranteed either. It recommends regular checks that fetch data from Shopify to catch gaps. Ask how your integration does this, so no customer misses a dispatch message and nobody gets a double message.
• Give access the safe way. A developer who does the integration work can use a Shopify collaborator account. The partner must turn on two-step authentication, you approve the request and set the permissions, and access expires if the account is not used for 90 days.

What to avoid

• Sending promotions to people who gave their number only to receive a parcel.
• Adding a discount line to an order update template to save a message.
• Letting one staff member's personal phone be the only owner of the number and the chat history. Ask who controls the number if that person leaves.
• Sharing your Shopify owner login with a developer or an app vendor.
• Asking customers to type card numbers into a chat. Send them to checkout or a payment link instead.
• Treating any single feed of events as the only record. Compare orders in Shopify with messages sent each week at first.

Reading an app listing

Shopify's App Store has apps for WhatsApp order alerts. Two listings we opened show what a listing may leave out. The listing for Notify On WhatsApp By SMSIdea describes order and checkout notifications, a connection made with a QR code, and plans with monthly message allowances. The listing for WhatsNotify says it sends order alerts through Twilio's API and offers templates for each order status. When we read them, neither listing named the WhatsApp product it connects to, and neither mentioned Meta's message fees or customer opt-in. That does not mean anything is wrong. It means you should ask. We did not test either app and this is not a recommendation. We also did not find a Shopify help page on WhatsApp that we could open, so this guide does not describe any built-in Shopify WhatsApp feature. Check the current Shopify Help Center.

Questions to ask before you buy or build

1. Which WhatsApp product does this use, and who owns the business account and the phone number?
2. How does it collect and store opt-in, and can I export the record?
3. Which message types will it send, and which category is each template in?
4. Are Meta's message charges included in your price, or billed on top? Show me a worked month for my country mix.
5. What happens when a webhook is missed or an order is edited or cancelled?
6. Does it work in Arabic and English, including right-to-left text in templates?
7. What access does it need to my store, and can I limit it?
8. If I leave, do I keep my templates, my opt-in records and my number?

Need a hand?

ESTASOFT connects Shopify stores to other systems through integrations and APIs, and builds Shopify stores from offices in Dubai, Erbil and London. If you want to plan a WhatsApp set-up that your team can run, send a short brief on the contact page. Before the Ramadan season, read our Ramadan and Eid 2027 checklist.

Sources

• Pricing on the WhatsApp Business Platform (Meta): per-message model from 1 July 2025, categories, delivered messages only, user-initiated messages free, 1 October 2026 changes, rates by category and country calling code, volume tiers, quarterly price changes, named markets, 16 currencies and currency lock (page undated) (checked 3 November 2026)
• Get opt-in for WhatsApp (Meta): opt-in required, must name the business, message types, opt-out advice, rate limits for low quality (checked 3 November 2026)
• Service messages (Meta): 24-hour customer service window, reset by each new customer message, free-form messages inside it and only approved templates outside it (checked 3 November 2026)
• About the WhatsApp Business Platform (Meta): the Platform is an API-based product for developers; the page does not compare it with the Business app (checked 3 November 2026)
• Template fundamentals (Meta): template name, category and language; automatic review; rejected templates cannot be sent; templates are the only message type outside the customer service window (checked 3 November 2026)
• Template categorization (Meta): utility templates must be non-promotional; mixed content is marketing; escalating enforcement for repeated mislabeling (checked 3 November 2026)
• Webhooks (Shopify developer documentation): events, delivery limits and reconciliation (checked 3 November 2026)
• Manual payment methods (Shopify Help Center): orders paid by a manual method stay pending until marked as paid (checked 3 November 2026)
• Collaborator accounts (Shopify Help Center): collaborator access: partner two-step authentication, owner approval and permissions, access expires after 90 days without login (checked 3 November 2026)
• Notify On WhatsApp By SMSIdea (Shopify App Store): what the listing says and leaves out (checked 3 November 2026)
• WhatsNotify (Shopify App Store): what the listing says and leaves out (checked 3 November 2026)
• Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data (UAE Legislation portal): consent, direct marketing objection and executive regulations (checked 3 November 2026)
• Data protection laws (UAE government portal): scope, date in force and regulator, page updated 4 December 2025 (checked 3 November 2026)