GDPR and Coexistence: where message data goes

What changes for message data when a number uses Coexistence?

The conversations become visible to Cloud API as well as the phone. Meta's Coexistence documentation states that messages sent and received are mirrored between Cloud API and the WhatsApp Business app, that contacts with a WhatsApp number can be synchronised, and that chat messages from the most recent six months can be synchronised during onboarding. Group chats are not synchronised.

From that point the number's one-to-one messages travel through Cloud API, which Meta describes as decrypting a received message and forwarding it to the business, and encrypting outgoing messages with the Signal protocol before delivery.

This page states what Meta documents and what EasyCoexistence does. It is not legal advice, and whether a given setup meets GDPR is for the business and its advisers to decide.

What does Meta say about its own role under GDPR?

Meta's Cloud API data privacy page sets out its position in its own words.

• Where the law recognises a data processor, Meta acts as one on behalf of the business when providing Cloud API.
• Cloud API uses the messages it processes only on behalf of and at the instruction of the business, unless otherwise directed.
• Messages are retained for at most 30 days; user identifiers are deleted within 30 days of a message's last status update.
• Cloud API customers must meet their own obligations under laws such as the GDPR.
• Customers in the European Region are covered by the WhatsApp Business Data Transfer Addendum.

Can message data be stored in the EU?

Meta offers Cloud API local storage, which keeps message content at rest in a chosen country after a short in-use period. For Cloud API that in-use period is up to 60 minutes, during which content may be processed in Meta data centres internationally. The European options are Germany for the EU, Switzerland and the United Kingdom.

Local storage is set when a number is registered, and changing it on a registered number means deregistering and registering again. Meta's registration documentation also states that the deregistration endpoint cannot be used on a number in use with both Cloud API and the WhatsApp Business app, and it does not describe a separate path for enabling local storage on a Coexistence number.

Where do the messages go after Meta?

To whichever endpoint receives the WhatsApp Business Account's webhooks. Meta's webhook override lets an app send a given account's webhooks to a different callback URL from the app's own.

EasyCoexistence uses that override to point message events at the business's own system, so Meta delivers conversation content there rather than to us, and EasyCoexistence never stores conversation content. What we keep are the operational events, such as connection state and quality, that monitoring is made of.

Meta also documents that it has SOC 2 Type II and ISO 27001 reports for Cloud API, published through its Business Messaging Compliance Center.

Common mistakes

• Assuming Meta's processor role covers the business's own obligations. Meta states that customers must meet their own GDPR obligations.
• Accepting history sync without deciding where it lands. Up to six months of chats can be delivered to the receiving system.
• Planning to switch on local storage later. It is set at registration, and changing it means re-registering.

Frequently asked questions

Keep reading