Short answer, then the nuance: in the UK, letting an AI answer your WhatsApp is legal in the case that matters most to you — when a customer messaged you first. They started the conversation. Answering it, and booking them in, is the same thing you'd do by hand, only faster. UK GDPR doesn't ban that. PECR doesn't either.
Those are the two rules people picture when they get nervous: UK GDPR (how you handle personal data) and PECR (the rules on marketing messages). Neither one stops an AI reading an inbound WhatsApp and replying to it. What they care about is consent, honesty, and giving people an easy way out. This isn't legal advice — it's the plain-English shape of it.
Start with the easy case, because it's most of your day. A customer sends hiya, any chance of getting in Saturday? They've initiated. Checking the diary and offering a slot is using their details for the exact thing they asked for. About as clean as it gets.
GDPR does apply — a name and a number are personal data whether they arrive by phone, email, or WhatsApp. But "GDPR applies" isn't the same as "you're in trouble." It means: keep the details for the booking, don't quietly reuse them for something else, and be able to say what you hold if someone asks. Most owners already do this without ever naming it.
Three small habits keep you clean. A short privacy line — one sentence on your site or in the chat saying you use WhatsApp to handle bookings and enquiries. Don't repurpose the data — a booking number is not a marketing list. An easy way out — if someone says stop, you stop.
The line was never AI or human. It's answering someone who wrote to you versus chasing someone who didn't.
Which brings us to the part with actual teeth. PECR is about unsolicited marketing — the blast to a few hundred old numbers shouting twenty percent off this week. That needs a proper opt-in, and it did long before AI turned up. Sending it faster with a bot doesn't make it fine; it just makes it a faster mistake. If you wouldn't send it by hand without consent, don't automate it.
So the honest dividing line is simpler than the acronyms. Answering inbound and booking people in: fine. Reminding a booked customer about their own appointment: fine. Cold-blasting people who never opted in: not fine — bot or no bot.
Does an AI need extra consent just to reply? Not to answer a message someone sent you — you don't ask permission to pick up your own WhatsApp. It is courteous, and increasingly expected, to be clear a customer might be talking to an assistant, and to hand to a human when it should. That's good manners more than red tape, and it's how we built Luna anyway.
Luna only ever works the inbound side. She answers the WhatsApp your customers already message, books and reschedules, handles the price and hours questions, and passes to you when something needs a human. She isn't built for spraying strangers — that's the bit the law frowns on, and frankly the bit that annoys everyone.
Want to see exactly what she says to a customer? The live demo on the salons page lets you message her yourself. If your setup is unusual, we build custom agents too — and you can read who's behind this on the about page, or the rest of the notes.