How to Follow Up on WhatsApp Without Getting Fined (Or Being Annoying)

Most sellers under-follow-up, not over-follow-up — out of a fear of seeming pushy. But silence after a genuine enquiry is very often distraction or a bad week, not a no. A short, well-spaced follow-up sequence recovers real sales that a single unanswered quote would otherwise lose for good.

1. 1
   Touch 1 — around day 2

   New information, not a nudge: an answer to something they asked, a stock update, or a genuinely relevant detail you didn't lead with the first time.

2. 2
   Touch 2 — around day 5–6

   A low-pressure check-in that makes it easy to say not now without feeling chased.

3. 3
   Touch 3 — around day 10–12, only if genuinely warranted

   A polite close: state you'll stop following up unless they reach back out, and mean it.

Two to three touches over a week and a half is a reasonable, defensible cadence for someone who messaged you first. It is not a licence to broadcast to a list of numbers who never contacted you — that's a different, legally riskier activity, covered below.

Kenya's Data Protection Act, 2019 requires consent for processing personal data — and sending marketing messages to a phone number counts as processing that number as personal data. The Office of the Data Protection Commissioner (ODPC) has been actively enforcing this against real businesses, not just publishing guidance. Consent has to be express, specific and informed — not inferred from the fact that someone gave you their number for an unrelated reason.

In December 2025, the ODPC ordered Platinum Credit Limited to pay KES 400,000 to a complainant after finding the lender had repeatedly sent him unsolicited promotional SMS messages and calls about loan products, despite him never having shared his details with the company directly — a breach of his constitutional right to privacy and of the Data Protection Act's rules on lawful processing (reported by Capital FM, Business Daily Africa and the Daily Nation, among others).

Around the same period, the ODPC ordered Pepinos Pizza Inn to pay KES 250,000 after a customer complained about unsolicited promotional text messages. His number had been collected during an M-Pesa payment for an order — and the company argued that providing a number for payment implied consent to receive marketing messages. The ODPC rejected that argument outright: consent for one purpose (processing a payment) does not carry over to a different purpose (marketing) without separate, explicit agreement.

The pattern across both cases is the same one worth sitting with: a phone number given for one reason — placing an order, making a payment — is not automatically permission to message that number for another reason later.

• Valid: a customer messages you first, asking a question — you can reply, including reasonable follow-up on that specific enquiry.
• Valid: a customer explicitly opts in to receiving offers or updates, in words, separate from any single transaction.
• Not valid, per the Pepinos ruling: assuming a number collected for payment can be used for marketing.
• Not valid: adding a number to a broadcast list because you have it, with no prior conversation and no opt-in.

• Did this person message you first, or explicitly opt in? If not, don't add them to a broadcast list.
• Is your follow-up about the thing they asked, not an unrelated promotion?
• Have you kept it to two or three touches, spaced out, with a genuine stopping point?
• If you collected a number for payment, have you avoided repurposing it for marketing without separately asking?
• If in doubt about a specific list or campaign, has someone with legal expertise reviewed it?

Do I need consent to follow up with someone who messaged me first?

Following up on their own enquiry is generally reasonable — they initiated contact about a specific thing. It's repurposing that number for unrelated marketing later, or messaging people who never contacted you at all, where consent becomes the real question.

Does giving my number for M-Pesa payment count as marketing consent?

No — and this is the exact argument the ODPC rejected in the Pepinos Pizza Inn case. A number given to process a payment is consent for that payment, not for marketing messages afterward.

How many follow-ups is too many?

Beyond two or three spaced-out touches on a genuine enquiry, you're past the point of reasonable follow-up — both because it stops converting and because a pattern of repeated unwanted contact is exactly what the enforcement cases above were about.