Is it legal to ask for Google reviews on WhatsApp in South Africa?

Short answer: yes, if you get consent first. POPIA (the Protection of Personal Information Act) treats a WhatsApp review request as direct marketing, and direct marketing to an individual needs their permission before you send it, not after. This isn't a technicality to skip. It's also the rule that protects you if a customer complains to the Information Regulator.

What POPIA actually requires

Section 69 of POPIA covers direct marketing by electronic communication, and a review request sent to a customer's phone number counts. The rule is simple: you need the customer's consent before you message them, unless one narrow exception applies.

• Consent must be opt-in, not opt-out. Silence isn't agreement. A customer has to actively say yes, whether that's a checkbox at checkout, a verbal "sure, WhatsApp me" your staff logs, or a tick when they book.
• The existing-customer exception is narrow. POPIA allows marketing to an existing customer about your own similar products or services without fresh consent, but only if you got their contact details in the course of a sale and you give them a clear way to opt out every time. It's a defence you fall back on, not a licence to skip asking. Getting a real yes is safer and it's what PeakReviews defaults to.
• Every message needs an opt-out. "Reply STOP to stop these messages" or equivalent, and you have to honour it immediately, not eventually.
• You need to be able to prove consent existed. If the Information Regulator or a customer ever asks, "we assumed it was fine" isn't a record. A timestamp and a name against a checkbox is.

What this looks like in practice

For most small businesses this is less scary than it sounds. You're not cold-messaging strangers, you're messaging someone who was just in your salon, dental chair or workshop. Ask at the point of service: "Mind if we WhatsApp you afterwards for a quick review?" A nod, a tick on a form, or a reply to your own WhatsApp Business number all count. Log it, timestamp it, and you're covered.

What doesn't count: buying a phone list, scraping numbers from a Facebook group, or messaging every number in your till system without ever asking. That's the version that gets a business reported, not the version that gets a bad review.

Consent is a POPIA rule. Incentives are a Google rule.

These are two separate lines businesses sometimes blur. POPIA governs whether you're allowed to message the customer at all. Google's own policies govern what you're allowed to say once you do. Offering a discount, a prize entry or "free thing" in exchange for a review, or asking only your happiest customers ("review gating"), breaks Google's terms and can get reviews deleted or a listing suspended, regardless of whether the customer consented to being messaged. Ask everyone who consents, ask for an honest review, and never attach a reward to it. Paying a stranger to post a review outright is the same problem taken further; see why bought reviews get caught and what it costs you.

How PeakReviews handles this

Every contact you add gets a required consent checkbox before a single message can go out; there's no way to bulk-import a number list and skip it. Consent is timestamped against the contact, opt-outs are tracked automatically, and messages go from an official WhatsApp Business number, not a personal phone, which is what POPIA's record-keeping expectation actually wants to see if it's ever questioned.

Want the message itself sorted too? See the WhatsApp review request templates for wording that asks well, or start a free trial and let PeakReviews track consent for you automatically.

This is a practical guide, not legal advice. If POPIA compliance is business-critical for you (large customer database, regulated industry), get a qualified opinion.