What Are the Rules for AI Calls and WhatsApp Marketing in Malta?

Short answer: the Information and Data Protection Commissioner (IDPC) says marketing by automatic calling machine needs the recipient's prior consent, with a narrow exception for your own existing customers, and that cold calls involving human intervention are permissible if requests not to be contacted are respected. We could not verify how an AI voice agent is classified, so plan on the stricter view. On WhatsApp, Meta requires opt-in, and its policy allows online gambling messages only in five countries, none of them Malta.

What does the IDPC say about marketing calls?

Read on 25 October 2026 from the IDPC's direct-marketing page: electronic marketing is governed by the Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01. No person may send marketing by means including an automatic calling machine without having sought the recipient's prior consent. A business may market to its own customers whose details it collected in an earlier sale, for similar products or services, if every message gives them a free, simple way to opt out. The page also says cold-calling systems that involve human intervention are permissible, that requests not to be contacted must be respected, and that personal data processed for direct marketing may rest on legitimate interest.

Does that cover an AI voice agent?

We do not know. The page speaks of automatic calling machines and of human intervention, and an AI agent that holds a live conversation fits neither label neatly. We found no IDPC guidance on AI callers, and the same page does not address calls to businesses as distinct from consumers. The cautious reading is to treat an outbound AI marketing call as needing prior consent. Put the question to your adviser. We found no calling-hours rule for marketing calls in the sources we read, so choose hours that are courteous, and set them on the called person's clock.

What tools does the product give you?

• A do-not-contact list you keep. Add everyone who asks not to be called.
• Calling hours you set per campaign. The platform sets no window of its own.
• An opening line you write: who is calling, why, and how to stop.
• A transcript and outcome for every call.

It does not collect, check or store consent for you, and it does not screen numbers against any register. Keep proof of consent in your own records. Answering your own inbound calls is a different matter from marketing, and most businesses start there.

What does Meta require on WhatsApp?

Meta's WhatsApp Business Messaging Policy (page dated 23 September 2026, read 25 October 2026) says you may contact people on WhatsApp only if they gave you their number and opted in to receive messages, that you are solely responsible for how you collect the opt-in and for following the laws that apply to you, and that you must respect requests to block or opt out. It suggests getting a separate opt-in for each category of message. Templates are needed outside the 24-hour window and are reviewed by Meta. Whether the IDPC's rules on electronic marketing reach WhatsApp messages is something we could not verify; the page we read names automatic calling machines, fax and email, not messaging apps. See the WhatsApp Business API page and WhatsApp broadcast.

Why can't an online gaming operator use WhatsApp for gaming messages in Malta?

The same Meta policy lists "Regulated Verticals" that may use the platform only in listed countries. For online gambling and gaming the list is Australia, Japan, Colombia, Mexico and Peru, and an operator must first ask Meta for permission and show proof of licensing. Malta is not on it. Messages about regulated verticals also cannot go through the WhatsApp Business App, and cannot be sent to people under 18. Payday loans and debt collection are prohibited outright. So a Maltese remote-gaming business that wants WhatsApp for gaming promotions or player messaging should expect Meta to refuse it, and should ask Meta rather than assume.

That is a Meta rule, not a statement about Maltese law, and we make no claim about gaming-sector licensing or the Malta Gaming Authority's requirements; take those to your compliance team. A gaming-adjacent business that is not itself operating gambling, such as an events company or a payments help desk, should check Meta's policy against what it sends.

Where should you start?

1. Start with inbound calls and with messages to customers who contacted you first, which are the lightest-touch uses.
2. Keep a record of when and how each person opted in, for calls and for WhatsApp separately.
3. Ask your adviser whether your AI marketing calls need prior consent, and plan on the stricter view.
4. Check Meta's policy before you plan WhatsApp messaging in a regulated vertical.
5. Write an opening line that says who is calling and offers a way to stop.

The Malta page sets out the languages, number and data details, and the AI receptionist page shows the product. Read the official texts; this is not legal advice.