Short answer, then the nuance: in the UK, letting an AI answer your WhatsApp is legal in the case that matters most to you: when a customer messaged you first. They started the conversation. Answering it, and booking them in, is the same thing you'd do by hand, only faster. UK GDPR doesn't ban that. PECR doesn't either.
Those are the two rules people picture when they get nervous: UK GDPR (how you handle personal data) and PECR (the rules on marketing messages). Neither one stops an AI reading an inbound WhatsApp and replying to it. What they care about is consent, honesty, and giving people an easy way out. This isn't legal advice. It's the plain-English shape of it.
Start with the easy case, because it's most of your day. A customer sends hiya, any chance of getting in Saturday? They've initiated. Checking the diary and offering a slot is using their details for the exact thing they asked for. About as clean as it gets.
GDPR does apply: a name and a number are personal data whether they arrive by phone, email, or WhatsApp. But "GDPR applies" isn't the same as "you're in trouble." It means: keep the details for the booking, don't quietly reuse them for something else, and be able to say what you hold if someone asks. Most owners already do this without ever naming it.
Three small habits keep you clean. A short privacy line: one sentence on your site or in the chat saying you use WhatsApp to handle bookings and enquiries. Don't repurpose the data: a booking number is not a marketing list. An easy way out: if someone says stop, you stop.
The line was never AI or human. It's answering someone who wrote to you versus chasing someone who didn't.
Which brings us to the part with actual teeth. PECR is about unsolicited marketing: the blast to a few hundred old numbers shouting twenty percent off this week. That needs a proper opt-in, and it did long before AI turned up. Sending it faster with a bot doesn't make it fine; it just makes it a faster mistake. If you wouldn't send it by hand without consent, don't automate it.
So the honest dividing line is simpler than the acronyms. Answering inbound and booking people in: fine. Reminding a booked customer about their own appointment: fine. Cold-blasting people who never opted in: not fine, bot or no bot.
Does an AI need extra consent just to reply? Not to answer a message someone sent you. You don't ask permission to pick up your own WhatsApp. It is courteous, and increasingly expected, to be clear a customer might be talking to an assistant, and to hand to a human when it should. That's good manners more than red tape, and it's how we built Luna anyway.
Luna only ever works the inbound side. She answers your customers on WhatsApp, books and reschedules, handles the price and hours questions, and passes to you when something needs a human. She isn't built for spraying strangers. That's the bit the law frowns on, and frankly the bit that annoys everyone.
Want to see exactly what she says to a customer? The live demo on the salons page lets you message her yourself. If your setup is unusual, we build custom agents too, and you can read who's behind this on the about page, or the rest of the blog.
Questions
Is it legal to use AI to reply on WhatsApp in the UK?
Yes, replying to a customer who messaged you first is the easy case, because they started the conversation. Answering their enquiry and booking them in is using their details for exactly what they asked for. This isn't legal advice, but that's the plain shape of it.
Do I need consent for an AI to answer and book?
Not to reply to a message someone sent you. You don't need permission to answer your own WhatsApp. Consent is the thing that matters for unsolicited marketing, which needs a proper opt-in whether a human or a bot sends it.
Does GDPR apply to WhatsApp messages?
Yes. A name and phone number are personal data on WhatsApp just as anywhere else. In practice that mostly means keeping the details for the booking, not quietly repurposing them, and being able to say what you hold if someone asks.
What about PECR and marketing messages?
PECR governs unsolicited marketing. A discount blast to people who never opted in needs consent. Sending it faster with a bot doesn't change that. Answering inbound enquiries and booking people in isn't marketing, so it sits outside that rule.
Your turn
See how Luna replies.
Message our demo number like one of your clients would. 14 days free once Luna is live, then £99 a month + VAT. No contract.
Related posts
You did the work. They took the cut.
Some booking apps take 20–35% of the new clients they send you. The honest breakdown of subscription vs commission pricing, and why a flat fee keeps more of what you earned.
They didn't cancel. They just didn't come.
Booking deposits are legal in the UK when they are fair and clearly agreed. But the real win is refilling the slot the second a reschedule lands.
She won't message back tomorrow.
What happens to the WhatsApps you don't see after closing time. The honest version, without invented numbers. Just what every salon owner already knows.