WhatsApp Follow-Ups in B2B Sales: A Guide to IYS and Consent

Oct 14, 2026

Strategy

In Turkey, WhatsApp is one of the channels B2B sales teams use most, yet it is one of the least clearly defined in terms of process. When a sales rep messages a decision-maker after a discovery call with "Attached is the proposal we discussed," they will most likely get a faster reply than they would by email. But when the same rep sends a mass promotional message to hundreds of mobile numbers bought from a data provider, they expose their company to administrative fines, number bans and reputational damage. The channel is the same; the difference lies in the method.

In this guide, we look at how to use WhatsApp for B2B sales follow-ups in a way that is both effective and legally compliant. We explain how Law No. 6563, the Message Management System (IYS), KVKK (Turkey's Personal Data Protection Law) and Meta's WhatsApp Business policies relate to one another, and walk you step by step through consent collection methods, sample follow-up flows, and CRM and automation setup. A note: This article is for general information purposes only. For decisions specific to your situation, always work with your legal counsel.

Why Is WhatsApp So Powerful in B2B Sales, and Why Is It Risky?

WhatsApp's strength in sales follow-ups comes from three characteristics:

Visibility: A proposal reminder that would get lost among dozens of vendor messages in an inbox appears as a direct notification on WhatsApp.
Low friction: A decision-maker can send a short reply like "Works for me, Thursday at 2:00 pm" even between meetings.
Relationship warmth: Used in the right tone, the channel offers a communication space that is more personal than formal correspondence while remaining professional.

The risks stem from the same characteristics. WhatsApp is the business channel closest to people's personal space. An unsolicited message feels far more intrusive than an unwanted email. The recipient can block you or report you as spam with a single tap. If you use the WhatsApp Business Platform, these reports lower your number's quality rating and can restrict your messaging limits. On top of that comes the legal dimension: In Turkey, commercial electronic messages are strictly regulated, and WhatsApp messages fall within this scope.

The Legal Framework: Law No. 6563, IYS and KVKK

The Difference Between a Commercial Electronic Message and an Informational Message

The foundation of compliance is correctly classifying the type of message you send. Under Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages, there are two main categories:

Commercial electronic message: Messages sent to promote or market your goods or services, or to promote your business. New product announcements, campaigns, webinar invitations and cold messages along the lines of "Would you like to try our product?" fall into this group.
Informational message: Non-promotional messages sent within the scope of an existing relationship or transaction. Reminders for a scheduled meeting, delivery of a requested proposal, contract or invoice notifications, and replies to support requests belong to this group.

Informational messages do not require commercial electronic message consent. But there is a critical trap here: The moment you slip promotional content into an informational message, it may qualify as a commercial message. "Just a reminder about our meeting tomorrow; by the way, our new module is 20% off" is no longer a purely informational message.

A practical test: Ask yourself whether the recipient will think "I asked for this / this relates to my transaction" or "Why are they sending me this?"

The Merchant and Tradesperson Exemption: The Most Misunderstood Rule

The Regulation provides that commercial electronic messages may be sent to tradespeople and merchants without prior consent. Most B2B teams read this provision as "B2B doesn't require consent." That reading is incomplete, and the exemption has three important limits:

The right to opt out always applies. A merchant or tradesperson recipient can state that they do not wish to receive messages. Continuing to send messages after an opt-out notice is a violation.
An IYS check is required. Opt-out records are managed through IYS. Even if you send messages based on the merchant exemption, you are expected to check whether the recipient has an opt-out record in IYS.
Who owns the number? A company's corporate line and the personal mobile phone of a manager working at that company are not the same thing. A procurement manager's personal number may not be considered a contact address belonging to the legal entity. In that case, relying on the merchant exemption becomes debatable, and the personal data dimension also comes into play.

In practice, the safest approach is this: Obtain explicit, recorded consent for any promotional WhatsApp message sent to mobile phones belonging to individuals. Treat the merchant exemption as a last resort, limited to corporate, company-owned communication channels.

How Does IYS Work?

The Message Management System is the central system where consents and opt-outs for commercial electronic messages are stored. The key points you need to know as a service provider:

Registration: Businesses that send commercial electronic messages must register with IYS.
Channel-based consent: Consents are kept separately for channels such as calls, messages (SMS and instant messaging) and email. Email consent does not mean consent for WhatsApp messages.
Recording consent in IYS: You must upload the consents you collect to IYS within the specified time frames. Consents not recorded in IYS may not protect you in the event of a dispute.
Opt-out management: Recipients can exercise their right to opt out through the channel you provide or directly through IYS. Once an opt-out notice is received, you must stop sending messages within three business days.
Pre-send check: Synchronizing your list with IYS before every campaign or bulk send is a fundamental compliance step.

The law provides for administrative fines for violations. Fines are updated every year by the revaluation rate, and in violations involving multiple recipients at once, the fine can multiply. This is why a small process error in bulk sends can turn into a major financial burden.

The KVKK Dimension

While IYS governs commercial message consent, Personal Data Protection Law No. 6698 (KVKK) protects the phone number itself as personal data. KVKK topics to watch in WhatsApp follow-ups:

Obligation to inform: At the point where you collect the number (form, event registration, meeting), provide a privacy notice explaining the purpose for which the data will be processed.
Purpose limitation: Adding a number collected for a support request to a marketing list carries the risk of use beyond the original purpose.
Cross-border transfer: WhatsApp's infrastructure runs on servers abroad. The rules on transferring data abroad have recently been updated. Evaluate this together with your legal counsel and reflect it in your privacy notice.
Commercial message consent and explicit consent are separate concepts. Rather than cramming both into a single checkbox, obtain each required consent separately and clearly.

WhatsApp Business Platform Rules: Meta's Rules Alongside the Law

Complying with Turkish legislation is not enough; you also need to follow the platform's rules. If you operate through the WhatsApp Business Platform (API):

Opt-in is required for business-initiated conversations. Meta requires consent showing that the user has agreed to receive WhatsApp messages from you.
24-hour customer service window: When a user messages you, you can send free-form messages for 24 hours. After the window closes, only templates approved by Meta can be sent.
Template categories: Templates are divided into categories such as marketing, utility and authentication. If you set up a meeting reminder as a marketing template, both the cost and the approval process change. Disguising marketing content as a utility template can lead to the template being rejected and your account being restricted.
Quality rating: As blocks and spam reports increase, your number's quality drops and your messaging limits tighten.

Conversations that sales reps run from the WhatsApp Business app on their personal phones are not exempt from these principles either. In this scenario, the company also loses control over conversation history and consent records. When the rep leaves, the customer relationship leaves with them.

Practical Ways to Collect Consent

Collecting consent may look like a legal obligation, but when set up correctly it becomes a natural part of the sales process. Methods that work in B2B:

1. Separate WhatsApp Consent on Web Forms

Add channel-specific, unchecked consent boxes to demo request, content download or contact forms:

"I would like to receive emails about product updates and event invitations."
"I agree to be contacted via WhatsApp with promotional content related to meeting and proposal follow-ups."

Each consent's timestamp, IP address, form name and text version should be recorded in the CRM.

2. Verbal Request During the Discovery Call and Written Confirmation

At the end of the call, the rep asks: "Would it be convenient for you if we followed up on the proposal and next steps via WhatsApp?" After a positive answer, a confirmation is sent by email or in the first WhatsApp message: "As you confirmed during our call, we will keep you updated via WhatsApp. If you'd rather not receive messages, just reply STOP."

Verbal consent on its own is weak evidence. It should be backed up by written confirmation and a CRM record.

3. User-Initiated Conversations

Add a "Message us on WhatsApp" link to your website, email signature and proposals. When the user sends the first message, the 24-hour window opens and the context of the conversation is clear. You can request separate consent for marketing content in the first automated reply.

4. Event and Trade Show Registrations

A short form opened via a QR code at a trade show booth, or an event registration page, is an efficient point for collecting consent. Collecting business cards, however, is not the same as collecting consent. A mobile number on a business card does not give you permission to send promotional messages.

5. Numbers from Data Providers

Teams doing outbound prospecting often pull contact details from B2B data platforms such as Apollo.io. These tools are extremely valuable for finding target accounts and contacts. However, a phone number found in a database does not give you consent to send promotional messages via WhatsApp. Rather than using these numbers directly on WhatsApp for first contact, it is healthier to build the relationship through LinkedIn, email or a phone call and obtain WhatsApp consent through that contact. For compliant outbound processes and lead generation setup, SAAS Corner's outbound sales service focused on B2B SaaS can help you strike this balance.

A Step-by-Step Compliant WhatsApp Follow-Up Flow

Below is a sample follow-up flow for a B2B opportunity where a discovery call has taken place and WhatsApp consent has been obtained. The figures are for illustration; adapt them to your own sales cycle.

Day 0, after the call (informational): "Hi Ayşe, thanks for today's call. I've sent a summary of the three topics we discussed to your email. I'll send the proposal on Thursday." A short, contextual message with no promotional content.
Day 3, proposal delivery (informational): The proposal is sent by email, with a short heads-up on WhatsApp: "The proposal is in your inbox. The pricing table is on page 3. I'm here if you have any questions."
Day 7, value-focused follow-up: A case summary or a short resource related to a problem the decision-maker mentioned during the call. Since this message may contain promotional elements, check that a consent record exists.
Day 12, decision meeting proposal: "Would you like to schedule a 20-minute Q&A session with your procurement team? Tuesday at 11:00 or Wednesday at 15:00 works for us."
Day 20, polite close: "Your priorities may have shifted during this period. I'm closing the file for now; if it comes up again in the future, just message me here."

Rules to follow throughout the flow:

No more than two messages per week. More frequent follow-ups turn interest into pressure.
Business hours: Weekdays between 09:00 and 18:30. Evening and weekend messages intrude on the recipient's private space.
An opt-out option in every promotional message: A short, free route such as "If you'd rather not receive messages on this channel, you can reply STOP."
Written messages instead of voice notes: Decision-makers can't listen to voice messages between meetings.
Attachment discipline: Formal documents such as proposals should go by email, with WhatsApp used only as a notification channel. This is also important for record integrity.

If you want to align your sales methodology and pipeline stages with these channel rules, Sales Corner's data-driven B2B sales approach offers a good starting point.

Automating Consent Management with CRM and n8n

Leaving consent management to reps' memory is the biggest source of compliance risk. The solution is to define consent as a data field in the CRM and tie sending to that field.

Fields to Keep in the CRM

Whether you use HubSpot, Pipedrive or Zoho, every contact record should include the following fields:

WhatsApp commercial message consent: Yes / No / Opted out
Consent date and time
Consent source: Web form, call confirmation, event form, user-initiated chat
Consent text version: Which text the consent was given to
IYS sync status and date
Recipient type: Individual / merchant-tradesperson (corporate line)
Last message date: For frequency control

In structures where multiple brands reach the same person, keeping these fields in a single central location is especially important. We covered this topic in detail in our article on centralized CRM and data integrity strategies in multi-brand holdings.

A Sample Automation Setup with n8n

With a workflow tool like n8n, you can automate the consent process end to end:

Trigger: A webhook fires when a web form is submitted.
Validation: If the WhatsApp consent box is checked, the contact record is created or updated in the CRM and the consent fields are populated.
IYS transfer: The consent is sent to the system via the IYS integration interface or the IYS integrator you use. The response status is written to the CRM.
Send gate: When a sales rep wants to trigger a WhatsApp template, the flow first checks the consent field in the CRM, then the current status in IYS. If there is no consent or there is an opt-out, the send is stopped and the rep is notified.
Opt-out capture: When expressions such as "STOP," "NOT INTERESTED" or "UNSUBSCRIBE" are detected in incoming messages, the contact record is automatically switched to opted-out status, IYS is notified, and the contact is removed from all active sequences. This way, the three-business-day rule isn't left to manual tracking.
Daily sync: Every morning, changes in IYS are pulled and compared with the CRM. For example, if a recipient opted out directly through IYS, this information is reflected in the CRM.

To connect internal sales team notifications and task assignment to this flow, take a look at our guide to automation in B2B sales team communication with n8n. Our article on CRM and marketing automation integration will also guide you in building a seamless data flow between your CRM and automation tools.

A Word of Caution When Using AI

Personalizing message drafts with AI boosts efficiency. However, sending auto-generated messages fully automatically carries both tone and compliance risks. AI may unknowingly add a promotional sentence to an informational message or reference information the customer never shared. Keep the human approval step. We've compiled the common pitfalls on this topic in our article on common mistakes in AI-assisted sales.

Sample Message Templates

Consent confirmation (first message): "Hi Mehmet, this is Elif from [Company]. As you confirmed during our call today, I'll be in touch with you here regarding the proposal and next steps. If you'd rather not receive messages on this channel, just reply STOP."

Meeting reminder (informational): "Hi Mehmet, just a reminder about our meeting tomorrow at 10:30. The link is in your calendar invite. Talk soon."

Value-focused follow-up (requires consent): "Regarding the field team reporting issue you mentioned during our call, I've summarized on a single page the approach we implemented at a manufacturing company of similar size. Shall I send it to your email? If you'd rather not receive messages, you can reply STOP."

Closing: "Mehmet, I understand this isn't a priority for you right now. I'm closing the file. If it comes up in the future, just message me here. All the best."

Common Mistakes

Assuming "B2B doesn't require consent": The merchant exemption does not remove the right to opt out or the IYS check. And relying on the exemption for personal mobile numbers is risky.
Using email consent for WhatsApp: Consents are channel-specific.
Unrecorded conversations run from personal phones: Proof of consent, opt-out management and customer history are lost.
Announcing campaigns via broadcast lists: Every bulk send to people without consent multiplies the number of violations by the number of recipients.
Missing an opt-out notice: An automated sequence continuing a week later for a recipient who said "Please stop messaging me" is both a legal and a reputational problem.
Adding promotion to an informational message: It changes the nature of the message.
Building automation without a consent check: Automation errors grow as they scale. We examined this and similar setup mistakes in our article on critical mistakes in setting up B2B marketing automation.

Additional Considerations for Multi-Brand Structures

When multiple brands operate under a single group umbrella, consent management becomes more complex:

Consent is brand-specific. WhatsApp consent given to one brand is not valid for another brand in the group. The consent text should clearly state which brand will be in contact and for what purpose.
Opt-out management should be centralized. When a person opts out from Brand A, whether Brand B can still message the same person should be evaluated separately. From the customer's perspective, the group as a whole may be perceived as a single counterpart.
Frequency coordination: WhatsApp messages from three different brands reaching the same decision-maker in the same week wear down the relationship, even with consent. A central "last contact date" field reduces this risk.
Shared template library: Consent texts, opt-out phrases and privacy notice links should be consistent across all brands.

How Should You Measure Success?

Evaluating WhatsApp follow-ups by reply rate alone paints an incomplete picture. The metrics you should track:

Consent collection rate: What percentage of people you've had discovery calls with give WhatsApp consent? If this rate is low, the timing or wording of the consent request should be reviewed.
Response time: Compare the average response time for WhatsApp and email follow-ups.
Stage progression speed: How does the time it takes opportunities with WhatsApp follow-ups to move from the proposal stage to the decision stage compare with other opportunities?
Opt-out and block rate: If it is rising, your message frequency, tone or targeting is off.
Compliance indicators: The number of sends with missing consent records and the number of sends not stopped within three business days after an opt-out. The target for these indicators is always zero.

Reviewing these metrics monthly in sales meetings lets you manage both the channel's performance and its compliance together.

Conclusion

WhatsApp is a powerful channel that brings speed and closeness to B2B sales follow-ups. But what makes this power sustainable is not the number of messages; it is the consent discipline behind them. Correctly classifying message types, knowing the limits of the merchant exemption, collecting consents per channel and per brand and recording them in IYS, capturing opt-outs automatically, and tying sending to consent data in the CRM minimize both legal risk and wear on customer relationships. When set up correctly, compliance stops being a burden that slows sales down and becomes the foundation of a reliable, scalable follow-up system.

If you want to bring your WhatsApp follow-up processes into a structure that works with your CRM and n8n automations, centralize consent management across multiple brands, or rebuild your outbound strategy within this framework, get in touch with the Corner Group team. Let's build a roadmap tailored to your sales team's needs together.

Shortening the B2B Sales Cycle: A Case Study ›