If you’re looking to automate customer service on WhatsApp, you’ve probably seen impressive demos of chatbots that “understand natural language”, “handle orders” and “never sleep”. The reality in 2026 is that the technology is powerful, but it has technical, commercial and legal limits that nobody tells you about until you come to implement it. This article cuts through the hype and explains what is viable today, what is still fiction and what could cost you a fine from the AEPD (Spain’s data protection authority).
You won’t find made-up success stories or guaranteed ROI promises here. You’ll find a direct, technical guide to what the official WhatsApp Business API allows in Spain, the restrictions of the RGPD (Spain’s name for the GDPR), and the real architecture of a chatbot that works without your number getting banned.
This page is for information only and is not binding advice. Each case is tailored after a diagnosis.
TL;DR
- An AI WhatsApp chatbot can understand context, reply in natural language and send documents and buttons, but only within the 24-hour window or using pre-approved templates.
- It cannot start conversations freely, read groups, process native payments in Spain or make voice calls from the app.
- Meta’s official API is mandatory for serious commercial use; unofficial alternatives breach the terms of service and can get your number banned.
- The GDPR requires consent, data minimisation, retention periods and the right to erasure; a chatbot without compliance is a legal time bomb.
- The typical architecture: a webhook that receives messages, an AI engine (GPT, Claude, Gemini) that processes context, a backend that queries your CRM or knowledge base, and a formatted reply sent via the official API.
- Viable use cases: FAQs, appointment confirmations, order tracking, lead qualification; oversold use cases: complex contract negotiation, binding medical diagnosis, complete replacement of human teams.
What an AI WhatsApp chatbot is (and isn’t)
An AI WhatsApp chatbot is a programme that:
- Receives messages sent to your business number on WhatsApp.
- Processes them with a language model (GPT-4, Claude, Gemini, Llama).
- Queries your business data (opening hours, stock, policies) if necessary.
- Generates a reply in natural language.
- Sends it back to the user through the official API.
What it is NOT:
- It isn’t a person. It has no intuition, no real empathy and no ability to bend the rules when the context calls for it.
- It isn’t magic. If your knowledge base is poorly documented, the AI will hallucinate answers or say “I don’t know”.
- It isn’t a standalone system. It needs to integrate with your CRM, ERP or database to be useful.
- It isn’t free. The official API charges per conversation (varying by country and message type), plus the cost of the AI model, plus the infrastructure that orchestrates it all.
The confusion arises because many providers sell “chatbots” that are actually pre-programmed button flows with no AI. That isn’t a conversational chatbot, it’s a text-based IVR. A genuine AI chatbot interprets intent, maintains multi-turn context and generates dynamic replies.
What it CAN do in 2026
Understand natural language and context
Current models (GPT-4o, Claude 3.5 Sonnet, Gemini 1.5 Pro) understand Spanish as spoken in Spain, with idioms, spelling mistakes, changes of subject and references to earlier messages. They can extract intent (“I want to change my appointment”) even if the user writes “hey, Thursday doesn’t work for me at all, can it be moved”.
Reply within the 24-hour window
When a user messages you, you have 24 hours to reply freely with text messages, images, PDF documents, locations, button lists and quick-reply buttons. Here the chatbot can hold entire conversations without needing templates.
Send pre-approved templates outside the window
If more than 24 hours have passed since the user’s last message, you can only send templates that Meta has approved in advance. Typical cases: appointment reminders, order confirmations, shipping notifications. You can’t send spontaneous promotions or personalised messages outside a template.
Query external systems in real time
The chatbot can make API requests to your CRM, ERP, product database or Google Calendar to reply with current data. Example: “Do you have size 42?” → checks stock → “Yes, 3 units available in our Málaga shop”.
Send documents and multimedia
It can send PDFs (menu, quote, invoice), images (product photo, location map), audio (less common but possible) and short videos. Useful for sending confirmations or visual instructions.
Escalate to a human with context
When it detects that it can’t resolve something (an angry user, a request outside its scope, a request to speak to a person), it can transfer the conversation to your human team on a customer service platform with the full history visible.
Collect structured data
It can guide the user to capture their name, email, phone number and preferences, and validate the format in real time (“the email has no @, could you repeat it?”). It then sends that data to your CRM or spreadsheet.
Integrate with automations
Using tools such as n8n, the chatbot can trigger workflows when events occur: new lead → creates contact in CRM → notifies sales via Slack → schedules a follow-up in 48 hours. All without human intervention.
What it CAN’T do (technical)
Start conversations freely
You can’t have the chatbot send a “hi, how are you?” to your whole contact list. WhatsApp isn’t email marketing. The only ways to start a conversation are:
- The user messages you first (implicit opt-in for that conversation).
- You have prior explicit consent and use an approved template.
If you try spamming, Meta bans your number. It’s non-negotiable.
Read or take part in groups
The official API only works in one-to-one conversations with your business number. It can’t:
- Read group messages.
- Reply in groups.
- Create groups.
- Send messages to multiple people simultaneously without an active conversation with each of them.
If you need group communication, you’ll have to use other channels (Telegram, Discord, Slack).
Process native payments in Spain
WhatsApp Pay isn’t available in Spain in 2026. Chatbots here usually:
- Generate a link to a payment gateway (Stripe, Redsys, PayPal).
- Send the link via WhatsApp.
- The user pays outside the app.
- The gateway’s webhook notifies the chatbot, which confirms the order.
There is no transaction inside WhatsApp. You can’t “send money” or “pay here” natively as you would with Bizum.
Make voice calls or video calls
The official API doesn’t expose voice calls. The WhatsApp Business API only handles messages. If you need voice, the chatbot can:
- Invite the user to call your customer service number.
- Send a link to an external AI phone agent.
- Escalate to a human who calls from another system.
There’s no way for the chatbot to “call you” inside WhatsApp.
Interpret complex images or audio with 100% accuracy
Current models (GPT-4 Vision, Claude 3.5 with vision, Gemini) can analyse images that the user sends (a photo of a damaged product, a screenshot of an error), but:
- They aren’t infallible. They can misinterpret.
- They need good image quality.
- They aren’t valid for legal or medical diagnoses without human review.
The same goes for audio: automatic transcription (Whisper) is good but not perfect. Strong accents, background noise or technical jargon can cause errors.
Operate without an internet connection
Every AI WhatsApp chatbot needs a constant internet connection. If your server goes down, the chatbot doesn’t respond. There’s no local offline version of the official API.
What it CAN’T do (legal)
Store data without a legal basis
The GDPR requires you to have a legal basis for processing personal data. For a chatbot, the typical bases are:
- Explicit consent (the user accepts the terms).
- Performance of a contract (the user requests a service).
- Legitimate interest (customer service about a product already purchased).
You can’t keep conversations “just in case”. You must define the purpose, retention period and security measures. If the AEPD audits you and you haven’t documented the processing, the minimum fine in 2026 is 10,000 euros.
Retain conversations indefinitely
Data minimisation: you only keep what’s necessary for as long as it’s necessary. Typically:
- Conversation history: 30-90 days.
- Data from unconverted leads: 12 months (if there’s consent for marketing).
- Data from active customers: for the duration of the business relationship plus legal time limits (invoices 4 years).
After that period, anonymise or delete. You can’t keep data “in case the customer comes back” without specific consent.
Make automated decisions without the option of human review
Article 22 of the GDPR: the user has the right not to be subject to decisions based solely on automated processing that significantly affect them. Example:
- If the chatbot rejects a return.
- If it turns down a quote.
- If it cancels a booking.
There must be a way for a human to review. You can’t fully automate decisions with a significant impact without supervision.
Transfer data outside the EEA without safeguards
If your chatbot uses GPT-4 (OpenAI servers in the US), Claude (Anthropic, US) or Gemini (Google, global), you are technically transferring personal data outside the European Economic Area. You need:
- The European Commission’s standard contractual clauses.
- A risk assessment (Schrems II).
- Or to work with models hosted in Europe (less common and more expensive in 2026).
In practice, most SMEs in Spain use OpenAI/Anthropic with standard clauses and document this in their record of processing activities. But it isn’t automatic: you have to justify it.
Use data for different purposes without fresh consent
If a user contacts you with a technical support query, you can’t then use their number to send commercial offers without asking for their explicit permission. Consent is specific to each purpose. If you change the purpose, you need a new opt-in.
Typical architecture: the real components
A functioning AI WhatsApp chatbot has these components:
1. WhatsApp Business API account
This isn’t the WhatsApp Business app (that’s something else, for the autónomo (self-employed) with no API). The official API is contracted through a BSP (Business Solution Provider) certified by Meta. Examples: Twilio, Vonage, 360dialog, Infobip. Cost: from 0.005 euros per message in Spain in 2026, depending on the type of conversation.
2. Webhook that receives incoming messages
When a user writes to your number, Meta sends an HTTPS POST to your server (webhook) with the message content, the sender’s number and metadata. Your server must respond within 20 seconds or Meta retries.
3. AI engine that processes context
Your backend (Node.js, Python, whatever you like) takes the message, retrieves that conversation’s history (stored in your database), builds a prompt with context and sends it to the AI model’s API (OpenAI, Anthropic, Google). The model returns the generated reply.
4. Integration layer with your business
If the AI needs data (stock, opening hours, appointments), your backend makes requests to your CRM, ERP or database. This is where it connects with automation and internal systems. Without this layer, the chatbot just repeats static information.
5. Reply formatter and sender
The AI’s reply is formatted according to the WhatsApp API’s limits (maximum 4,096 characters per text message, buttons limited to 3 options, etc.) and sent via a POST to your BSP’s API. The user receives the message on their WhatsApp.
6. Human escalation system
If the chatbot detects that it can’t help (intent outside its scope, the user asks to speak to a person, strongly negative sentiment), it sends a notification to your team on a customer service platform (Zendesk, Intercom or a custom dashboard) with the full history, and marks the conversation as “awaiting human”. The agent replies via the same API.
7. Monitoring and logs
You must record conversations (with a retention period), errors, latency, drop-off rate and satisfaction. Typical tools: Sentry (errors), Grafana (metrics), PostgreSQL or MongoDB (history). Without telemetry, you don’t know whether the chatbot is working or burning through your budget in infinite loops.
Viable vs oversold use cases
Viable in 2026
FAQs and level 1 support: Answering frequent questions (opening hours, returns policies, payment methods) without human intervention. Typical resolution rate: 60-80% in businesses with well-documented FAQs.
Appointment confirmation and changes: The user can confirm, cancel or move an appointment. The chatbot checks your calendar (Google Calendar, Calendly) and updates it. Saves receptionists time.
Order tracking: The user sends their order number, the chatbot queries your logistics system and replies with the current status. Works well with carrier APIs (Correos, SEUR, MRW).
Lead qualification: The chatbot asks about needs, budget and timing, and passes the qualified lead to your CRM with a score. The salesperson only talks to hot leads.
Sending personalised content: Depending on what the user asks for (“size guide”, “allergen menu”), the chatbot sends the relevant PDF. It works like an automated library.
Oversold (be careful)
Complex contract negotiation: AI models in 2026 have no binding legal capacity. A chatbot can provide information on general terms and conditions, but it can’t sign contracts or negotiate specific clauses without human review.
Medical or legal diagnosis: A chatbot can offer guidance (“based on your symptoms, it could be X, see your doctor”), but it can’t diagnose or prescribe. Legally, a diagnosis requires a registered professional. The same goes for legal advice.
Complete replacement of human teams: In businesses with high emotional value (weddings, funeral homes, investment advice), people want to talk to people. The chatbot can filter and book, but not close. Complex sales remain human.
Selling highly technical products without an impeccable knowledge base: If you sell industrial machinery with 300 technical specifications and your documentation is out of date, the AI will hallucinate incorrect answers. Before a chatbot, you need a solid knowledge base.
Frequently asked questions
Can a WhatsApp chatbot start conversations without the customer writing first?
Not freely. The official WhatsApp API only allows proactive messages using templates pre-approved by Meta and within a 24-hour window from the user’s last message. You can’t send spontaneous promotions or mass messages without explicit opt-in.
Can the chatbot read all the messages in a WhatsApp group?
No. The WhatsApp Business API only works on individual business accounts, not in groups. A chatbot can’t take part in or read standard WhatsApp group conversations. It only operates in one-to-one chats with the company’s verified number.
Can the chatbot process payments directly within WhatsApp?
Partially. WhatsApp Pay exists in some markets (India, Brazil), but in Spain in 2026 the most common approach is to send a link to an external payment gateway (Stripe, Redsys) or generate an order code that the customer confirms through another channel. The transaction doesn’t happen natively within the app.
Does the chatbot store the whole conversation for ever?
It depends on your design, but legally in Spain (GDPR) you must define retention periods and data minimisation. The typical approach is to keep histories for between 30 and 90 days for service purposes and then anonymise or delete them, unless there’s a legal obligation or the user has given explicit consent for marketing.
Can the chatbot’s AI phone someone if it detects an emergency?
Not natively. The WhatsApp Business API only handles text messages, images, documents and buttons. If you need to escalate to voice, the typical flow is for the chatbot to pass the case to a human who makes the call, or to send a link to book a call. There’s no direct AI-voice integration within WhatsApp.
Can I use a WhatsApp chatbot without Meta’s official API?
Technically yes, using unofficial libraries (scraping WhatsApp Web), but it breaches WhatsApp’s terms of service and your number can be permanently banned. For serious commercial use, the only safe route is the official WhatsApp Business API with a certified BSP.
Next step
If you’re evaluating a WhatsApp chatbot for your business, the first step isn’t choosing a provider. It’s auditing which processes you can automate without losing quality, which data you already have structured and which compliance requirements you need to meet. A badly designed chatbot doesn’t just fail to save time, it eats it up putting out fires with angry customers.
At STAKKER we start every project with a free technical and legal diagnosis: we analyse your conversation volume, identify patterns that can be automated and tell you whether a chatbot makes sense for your case or whether there are more sensible alternatives. We don’t sell chatbots to people who don’t need them.
If you’d like to talk about your specific case, write to contacto. If you’d rather keep researching, take a look at our guide to AI automation or the fundamentals of the WhatsApp Business API.