Article
Israel's spam law on WhatsApp: what you may send, what you may not, and how an AI agent stays inside the law
Israel's spam law on WhatsApp: when you need consent, service vs. marketing messages, Meta's rules, and how an AI agent sells without breaking the law.
Israel's spam law on WhatsApp: what you may send, what you may not, and how an AI agent stays inside the law
Israel's spam law bars businesses from sending advertising by WhatsApp, SMS, email or auto-dialer without explicit prior consent; recipients may claim up to ₪1,000 per message sent knowingly, no damage required. Service messages are not advertising. An AI agent stays legal by answering inbound inquiries, contacting only people who consented, identifying itself, and honoring "remove" at once.
A pharmacy in Hadera sent a patient stock and price updates on WhatsApp. It was sure that was service. In September 2026, as reported by the Hebrew news site HaHadashot, the Magistrate's Court thought otherwise and awarded her ₪5,000 of the ₪75,000 she claimed. That is how most businesses meet the spam law: not through a spam campaign, but through an "update" that looked harmless to them. The consent you are sure you have, you probably don't.
Notice what the pharmacy did not do. It did not buy a list, did not message strangers, did not hide who it was. It wrote to its own customer about products she buys, and "that's service" sounded reasonable to it, because from the business's side every message to a customer is service. The law looks from the other side: what the message asks of the recipient. If it asks them to buy, it is advertising, no matter how well they know you. This is an educational explainer, not legal advice; for your specific case, ask a lawyer.
What the spam law says, in plain language
"The spam law" is section 30A of the Communications Law (Bezeq and Broadcasts), Israel's anti-spam provision, added in Amendment 40 and in force since December 2008. The full text, with definitions, exceptions and damages, is in the consolidated Hebrew text of the Communications Law. The line that decides everything: no sending advertising material by fax, automatic dialer, electronic message or text message without the recipient's explicit prior consent.
The section was written in 2008, before WhatsApp existed, and that is what makes it broad: it names no app, only the type of message. There is no "safe channel". What is banned by SMS is banned on WhatsApp, and on the next channel too.
Three terms do all the work. "Advertising material": a commercial message meant to encourage buying a product or service, or spending money. Not every message from a business, but every message meant to sell. "Electronic message": the courts apply the section to WhatsApp, and no Supreme Court ruling to the contrary has been found. Treat WhatsApp as covered. "Explicit prior consent": the rule. Everything else is an exception.
Consent: what counts as opt-in and what doesn't
Consent is explicit, prior and documented: a checkbox that says "I agree to receive marketing messages", or a confirmation by message. The two common mistakes do not pass: accepting general terms of use with a clause buried inside, and a phone number the customer handed over. A phone number is an address, not consent. The customer gave it so their appointment could be confirmed, not so they could be sold to.
And what is not documented does not exist. Good consent is consent you can pull up: when, where, to what they agreed.
Two exceptions. Existing customer (section 30A(c)): four cumulative conditions. The customer gave their details during a purchase or a negotiation; they were told the details would be used for advertising; they were given a chance to refuse on the spot and did not; and the advertising concerns the same kind of product. One missing, no exception. B2B: a one-time message to a business asking for consent. Nothing more.
Service message or marketing message: the distinction that decides
The law does not ban talking to customers. It bans advertising to them without consent, and the line runs through the content, not the subject line.
| Service message (no consent needed) | Marketing message (consent needed) |
|---|---|
| Order or appointment confirmation, verification code, delivery update | Promotion, discount, coupon, "this week only" |
| Reminder for an appointment already booked | Offer to book a new appointment to someone who didn't ask |
| Reply to a question the customer asked | Unsolicited message about a new product |
| Invoice, receipt, notice the law requires | "Stock and price update" that invites a purchase |
The last row is the Hadera case. The rule it yields: a message that mixes service with an offer is advertising. And almost everyone does that mix in good faith, because the reminder goes out anyway and "it would be a shame not to use it". The question worth asking before every message: if we deleted the selling part, would we still send it? If yes, it is service. If not, it is advertising with an excuse.
What every marketing message must contain
Even with consent, the law requires three things: the word "advertisement" at the start of the message; the sender's name, address and contact details; and a simple, reasonable way to refuse, including on the same channel, on WhatsApp usually "reply REMOVE". A refusal has to be recorded and enforced in every system that sends, not only the one that received it. A customer who wrote "remove" on WhatsApp and gets an SMS the next day from your other system does not see two systems. They see a business that doesn't listen.
What happens when you break it
Statutory damages: up to ₪1,000 for every message sent knowingly in breach of the law, with no proof of damage, and it adds up per message. The important word is "adds up". A business is not sued over one message; it is sued over a list that received dozens of messages across a year, and the arithmetic is a multiplication.
The sum is a ceiling, not a rate. In March 2026, as reported by the Hebrew news site Arutz 7, a plaintiff who claimed ₪25,000 for 23 messages was awarded ₪23, one shekel per message, because the court found she had joined the list on purpose in order to sue. In Hadera, ₪5,000 of ₪75,000. The damages are real. They are just not automatic.
The court weighs conduct, on both sides. A business that identifies itself, honors "remove" the same day and can show how people joined its list comes to court with a different story from a business that has no idea how the number got there. Compliance does not only protect you from a lawsuit; it decides what the lawsuit will cost.
Meta's rules on top
Above the law sits Meta's private bar. The WhatsApp Business Messaging Policy requires opt-in before proactive messaging, allows free-form replies only within 24 hours of the customer's message, requires approved templates outside that window, and requires a clear escalation path when you use automation: handover to a human agent, a phone number, email or a form. The details are in the article on WhatsApp Business policy and AI agents.
The difference from the law is who enforces. The law needs a plaintiff and a judgment; Meta needs a report. A business that breaks the policy risks having its number blocked, with no lawsuit at all, and a blocked number is a sales channel gone in a day, open conversations included. The 24-hour window is what keeps you on the right side: as long as the customer wrote last, you reply. Once a day has passed and you are the one who wants to talk, you need an approved template and a customer who consented.
Why consent is worth more than the fine
The fine is the worst reason to comply with the spam law. Yes, ₪1,000 per message sounds like an excellent reason, but look at what was actually awarded in the two cases above: the money is the small risk. The big one sits in the list itself.
A list built without consent is a list of people who did not ask to hear from you. They don't open, don't reply, sometimes block, and your response rate tells you that long before a lawyer does. Every such message also teaches the customer something: that messages from you are noise. Then, on the day you have something to tell them, a reminder, a change of appointment, an answer to their question, they are no longer reading.
Consent works the other way. Whoever said "yes" filtered themselves: they want to hear, so they read, so they reply. A small list of people who agreed sells more than a big list of people who were collected. Consent is not a limit on your marketing. It is its filter.
How an AI agent sells on WhatsApp and stays inside the law
When an AI agent runs the conversations, the law does not change. What changes is that compliance stops depending on a rep's memory. Six points:
- Inbound first. Replying to someone who wrote first is not sending advertising. The customer opened the conversation.
- Consent is recorded inside the conversation. At Upperfloor two groups count as having consented: people who approved marketing messages, and people who contacted the business on their own initiative.
- Whoever asks to be removed is removed. The agent stops every proactive message and every follow-up to them, immediately, on every channel.
- Service and marketing don't mix. An appointment reminder is an appointment reminder.
- The business identifies itself in every proactive message.
- Outside the 24-hour window, approved templates only, and only to people who consented.
Here is what it looks like at a clinic with two doctors, in four messages:
- The patient: "Can I move my appointment to Thursday?"
- The agent: "Sure. Thursday at 4:30 is free, booked. A reminder will come the day before." A service message; she asked, it answered.
- What the clinic would be tempted to add: "By the way, there's a promotion on facials this month." One line, and the reminder became advertising without consent.
- What the agent does instead: "Would you like updates on clinic promotions too? If so, reply 'yes'." She replied "yes", the consent was recorded with date and time, and she is in the group that may be contacted. Had she written "remove", every proactive message to her would stop.
Upperfloor is a managed AI sales system on WhatsApp for businesses that already receive inquiries. The agent answers the inquiry and manages it to a close or to a handover to a rep. It does not send spam, because the system is built around people who already reached out, not around lists. Privacy, the duty to disclose and consumer protection are in the article on AI agent regulation.
The list you keep "for the day there's a promotion" is the most dangerous asset in the business. Worth checking how many of the people on it said yes.
FAQ
Does Israel's spam law apply to WhatsApp messages from a business? Yes. The spam law (section 30A of the Communications Law) bars sending "advertising material" by electronic message or text message without explicit prior consent, and the courts apply it to WhatsApp messages a business sends to customers.
What counts as consent to receive marketing messages on WhatsApp? Consent under the spam law is explicit, given in advance and documented, in writing or electronically, for example a dedicated checkbox or a confirmation by message. A general acceptance of terms of use, or a customer handing over a phone number, is not consent.
Can you send a promotion to an existing customer without consent? Only if all four conditions of the spam law hold: the customer gave their details during a purchase, was told they would be used for advertising, was given a chance to refuse and did not, and the promotion concerns a product or service similar to what they bought.
Is a WhatsApp appointment reminder spam? No. A service message tied to a transaction the customer asked for, such as an appointment reminder, an order confirmation or a verification code, is not "advertising material" under the spam law. Add a promotion or an offer to it and it becomes advertising, which needs consent.
How much can you claim for a spam message on WhatsApp? The spam law lets the court award up to ₪1,000 for every message sent knowingly in breach of the law, with no proof of damage, and the sum adds up per message. In practice the court weighs the circumstances, and has awarded both token sums and thousands of shekels.
If your WhatsApp is full of inquiries and you want to manage them, not chase them.