Before a UK firm switches on Meta Business Agent

This note is for UK firms deciding whether to switch on Meta Business Agent, if and when it reaches them. It answers customers on WhatsApp, and it can hand a chat over to the business. WhatsApp's help centre says "This feature is currently only available in limited countries to select businesses."

A business that switches it on chooses to put its customers' messages through Meta's AI, and it chooses what those customers are told. Under the UK GDPR those look like controller decisions for the business, whatever role Meta takes.

These are the questions a UK firm should be able to answer before the agent goes live (none of them is a finding that anyone is in breach):

1. What role does Meta play, and for which processing?

The Addendum to Meta's Business Agents and Platform Terms (last updated 16 July 2026) names Meta as the business's "Processor/Service Provider" for listed processing. One listed instruction is to "create and maintain Customer profiles for Company for customer relationship management based on Interface Data". Interface Data covers the chats themselves. The same Addendum lets Meta use "Designated Interface Data" (broadly, chats on Meta's own apps, and on other channels where Meta's user terms apply) as "Content", and the terms say Meta "has independently obtained rights to use that content from such consumer end-users under separate terms". Neither the terms nor the Addendum uses the word "controller". So the same customer chats fall under two sets of terms (some processing on the business's instructions, some under rights Meta says it holds itself). A firm should map which processing falls on which side, as its records and its privacy notice both depend on that map.

2. Will customer chats train Meta's models, and can the business stop it?

The terms let Meta use Content "to improve our artificial intelligence models and algorithms, including Business Agents". WhatsApp's help centre says "Messages sent or received in chats that have connected Meta Business Agent will still be collected by Meta when you are chatting with the business, even when you mute Meta Business Agent." Pausing the agent doesn't stop the learning - the help centre describes the paused state as "Paused for new chats but learning" and says "While paused, it will continue to collect data from new chats to learn how to respond to customers." Apart from declining past chats at setup or deleting the agent, no business-side opt-out from training appears in the terms and help pages read for this note (the logged-in settings were not inspected). Customers may be in a different position. The update notice at the top of Meta's Privacy Policy, as served in the UK, says "Info shared with AI at Meta features is used to improve AI at Meta unless you have objected." The pages checked don't say whether that covers a customer's chat with a business's agent. What will the firm say to a customer who asks whether their chat trained Meta's AI?

3. Should past chats be shared at onboarding?

Setup offers two choices: "Use past chats: Teach Meta Business Agent how to respond to customers using your chats from the past six months." and "Ignore past chats: Do not use past chats to teach Meta Business Agent." The Addendum treats historic chats shared at onboarding as Business System Data. For a business located in the UK, that definition also covers "prior chat history on other Meta Company Products (including Instagram and Messenger)". The Addendum instructs Meta, as the business's processor, to use Business System Data "for the purposes of assisting, developing and maintaining Business Agents". The customers in those chats wrote to the business for their own reasons (usually an order or a booking), and the firm has to decide whether sharing them serves its own purpose or Meta's product.

4. What must customers be told?

The terms include the words "You also recognize and agree that you - not Meta - are responsible to users". WhatsApp's help centre, however, points customers two ways. It sends them to Meta ("Since these AI chats are a Meta service, you'll need to approach Meta to request data access or deletion.") and to the business ("Users who want to access or delete information that businesses have collected about them should contact the business for more information."). A firm should check whether its privacy notice covers any of this, and whether a customer could tell which of the two to ask.

5. Who carries the loss?

Meta's liability to the business under these terms is capped: "Our aggregate liability arising out of or relating to any access or use of Business Agents, will not exceed the greater of one hundred dollars ($100) or the amount you have paid us in the past twelve months." The firm needs to know who pays if an ICO inquiry or a customer claim starts with something the agent said (and whether its insurance responds).

6. Who handles a data protection complaint that arrives through the agent?

Section 164A of the Data Protection Act 2018, in force from 19 June 2026, lets a data subject complain to the controller if they consider there is an infringement of the UK GDPR in connection with their personal data. The controller has to facilitate such complaints, acknowledge each one within 30 days of receiving it, and respond without undue delay. If a customer makes that complaint to the agent, has the business received it? After the agent hands the chat over, the terms say it "may continue to observe the content being shared in the chat" and that "This content shall be deemed Content under these Terms." Where is the complaint logged, and who answers it?

Sources

• Meta, Business Agents Terms and Addendum - last updated 16 July 2026. Primary for Meta's processor role, the processing instructions, the definitions of Business System Data, Interface Data and Designated Interface Data, the use of Content to improve Meta's AI, the handover clause and the liability cap - checked 24 September 2026
• Meta, Commercial Terms - read alongside the Addendum - checked 24 September 2026
• WhatsApp Help Centre, Meta Business Agent pages: setting up (Android and iPhone versions), using, and customer questions - checked 24 September 2026
• Meta Privacy Policy, update notice dated 23 July 2026, as served in the UK - checked 24 September 2026
• Data Protection Act 2018, section 164A, in force from 19 June 2026 - checked 24 September 2026

Based on Meta's published terms as checked on 24 September 2026, which Meta can change. Janus Compliance is not a law firm and this page is general information, not legal advice.

For ongoing AI compliance support, work with Janus DPO-as-a-Service. For other vendors, browse the full index, or see real agent failures analysed legally in the AI Agent Incident Register.