PSA / Documentation: Reminder regarding WhatsApp's Terms of Service (ToS) and Account Suspension Risks

[Amr-Os]

Hello community and maintainers,

I wanted to open a brief discussion/reminder thread for developers—especially those building tools for production or client work—regarding WhatsApp's strict enforcement of their Terms of Service (ToS).

As a direct heads-up based on WhatsApp's Acceptable Use Policies, utilizing unofficial third-party wrappers, automation clients, or web-scraping libraries like OpenWA to interact with their servers is a definitive violation of their standard Terms of Service (specifically under unauthorized automation and third-party API use).

What this means for developers:

• Ban Risks: Meta's anti-abuse algorithms actively flag non-official automated signatures. Connecting a personal or primary phone number to an automated workflow via unofficial scripts carries a high risk of permanent, un-appealable account suspension.
• Compliance: For production systems, commercial projects, or environments where absolute ethical/legal compliance is required, Meta's official WhatsApp Cloud API remains the only authorized path.

This isn't an issue with the code itself—OpenWA is a fantastic project—but rather a reminder about platform risk. I hope this helps anyone planning their deployment architecture to avoid losing their primary numbers!

If the maintainers think it's useful, it might be beneficial to add a small "Risk/Disclaimer" section to the README to protect less-experienced developers from running into immediate bans.

[rmyndharis]

Hi @Amr-Os — thanks for writing this up, and you're absolutely right on every point. This is exactly the kind of reminder the project needs in front of users before they link a real number, and your suggestion to add a Risk/Disclaimer section to the README has now been actioned: ⚠️ Before you connect a number — please read.

The section covers:

• OpenWA being unofficial (uses whatsapp-web.js / @whiskeysockets/baileys, not Meta's Cloud API), and the resulting non-zero ban risk.
• The per-engine ban-risk vs. resource-cost trade-off.
• Six practical safe-sending guardrails (warm-up, no cold-blast, rate-limit, opt-in recipients, keep a fallback, mind the hosting IP).
• Known platform-side behaviours (cold-contact first-send silent drop, tracked in [Bug]: First message to a brand-new contact sometimes never arrives (track this here) #830) that look like bugs but are WhatsApp policy.
• An explicit compliance pointer to the official WhatsApp Cloud API for regulated deployments (healthcare, finance, EU/EEA under DMA/GDPR framings).

Thank you again for the push — it landed in v0.10.2. Closing this as resolved. 🙂