A grocery delivery service in Almaty and Astana has 15,000 customers, and 5,000 of them haven't ordered for more than a month. The owner suggests messaging all of them on WhatsApp: "We have their phone numbers, don't we?" Everyone's number is indeed on file, since the courier can't deliver without it. But people gave it for delivery, not for advertising. Before picking a channel you need to settle two things: whom you are allowed to message, and what you will be able to measure afterwards. It's the same service as in the lesson on push and retention, and the numbers are made up.
Service messages and promotional ones
Every channel carries two kinds of message, and the rules differ. Service messages are things like "payment received", "courier at the door", "order delivered": people expect them because they placed the order. Promotional messages are offers, product picks, "you haven't ordered in a while".
A service notification takes the person into the order it is about, not to the home screen. The picture shows this with an order waiting at a pickup point.
Mixing the two kinds in one message doesn't pay. On WhatsApp, Meta puts an order-update template in the utility category, but once you add an offer to it, the template is classed as marketing, and marketing messages cost more. On iPhone, a promotional push needs separate consent under rule 4.5.4 of App Review, and someone who switches offers off shouldn't lose courier updates. The lesson on push and retention shows how to set that up in the app.
Whom you may message
A promotional message needs an address and the person's permission: Apple's and WhatsApp's rules require it, and in Kazakhstan the personal data law points the same way. Phone numbers and email addresses in a customer database, sitting next to names, addresses and order history, are safer treated as personal data. Since 2026 the law defines personal data through identifiers (Article 1, subparagraphs 2 and 14-1), and the list of identifiers in Article 6 doesn't include phone numbers or email, so lawyers may assess a bare number differently. Until the client's lawyer says otherwise, assume the law applies to this data. Then it may be collected and processed with the person's consent (Article 7, paragraph 1); consent is given in writing or in another way that lets you prove it was received (Article 8, paragraph 1); and the data may only be used for the purposes stated when it was collected (Article 14). If the consent given at checkout names only delivery, an advertising campaign to that number is a different purpose, and under Article 14 it needs consent that names that purpose. If the consent text is broader, read it together with the client's lawyer. This is our reading of the law as amended up to 14 September 2026, and it is not legal advice. It has been amended more than once since 2013, so check the current version on adilet.zan.kz, and have the client's lawyer approve the wording of the marketing consent.
The service has an address for almost everyone, but permission only for some:
| Channel | What a promotional message needs | Reachable out of 15,000 |
|---|---|---|
| App push | Notifications on, "Offers" switched on in the app | 9,000 |
| Web push | A subscription, with the screen before the request saying offers will come | 600 |
| An address and the "Send me offers" box ticked at sign-up | 4,500 | |
| SMS | A phone number and the same box | 4,500 |
| A number and consent to receive the service's messages on WhatsApp | 7,000 | |
| Telegram bot | The person started the bot themselves and agreed to offers with a button | 1,200 |
Web push. The Push API has worked in all major browsers since March 2023. On a Mac, Safari has supported it since version 16 on macOS Ventura and only lets a site ask for a subscription in response to something the person does, such as tapping a button. On iPhone, web push is only available to a site added to the Home Screen (WebKit), and why that is a weak route for a delivery service is explained in the lesson on mobile-first. For this service, web push stays a channel for people who order on the website, hence the 600 subscribers.
Email and SMS. If you send more than 5,000 emails a day to Gmail addresses, Google requires SPF, DKIM and DMARC on your domain, one-click unsubscribe and a visible unsubscribe link in the message body, and wants your spam complaint rate kept below 0.3%. With SMS the address is a phone number, and consent to marketing messages is checked the same way as for email.
WhatsApp. The WhatsApp Business policy only allows messaging people who gave you their number or username and confirmed they want to receive messages from you, and it requires you to honour any request to stop, made on WhatsApp or off it. A business can only open a conversation with a template; free-form text is allowed for 24 hours after the customer's last message. Meta charges for every delivered message, and the price depends on the category and the country of the recipient's number (WhatsApp Business Platform pricing). On the rate card in force from 1 October 2026, a marketing template to a Kazakhstan number costs $0.0604 and an order-update (utility) template $0.018. A free-form reply to the customer within the 24-hour window (the service category in Meta's pricing) costs the same, but the first 1,000 a month per number are free.
Telegram. A bot can't message first, as the mobile-first lesson also explains, so a bot's audience is only the people who started it themselves. Starting the bot makes it possible to message them; consent to offers is asked for with a separate button. The lesson on messenger marketing explains how to sell through chat.
What each channel will show in the report
| Channel | What the channel itself reports | How to link it to an order |
|---|---|---|
| App push | Firebase: sent; received and shown on Android only; opens only if the app was in the background | The app logs an open from a push as an event, and the order arrives as a purchase from the same user |
| Web push | Depends on the sending service | UTM tags in the notification link, then the session and order in GA4 |
| The email service shows delivery and bounces; opens are unreliable | UTM tags on the links in the email | |
| SMS | Delivery status, if the provider passes it on; no opens | A short link with UTM tags |
| Sent, delivered, read, failed | UTM tags on the link or button in the template | |
| Telegram bot | Button taps under a message and blocks of the bot | A link with UTM tags |
For push, the numbers come from Firebase delivery reports. If Firebase responds with a message ID, it only means the message was accepted for delivery. Email opens are unreliable: in the Mail app on iPhone with Mail Privacy Protection turned on, the sender can't learn whether the email was opened, though the protection doesn't cover links. WhatsApp statuses arrive by webhook. A Telegram bot receives a button tap along with the user who tapped, and learns that it was blocked from a my_chat_member update (Bot API).
A WhatsApp read and a push open are different events. "Read" means the message was displayed in an open chat, while a push open means the person tapped it. Comparing channels on those numbers is like comparing impressions with clicks. The one row every channel shares is the order in the order system. But "ordered after the message" won't do either, because some people would have ordered without it. How many orders a channel added is shown only by a group that didn't get the message.
Example: push or WhatsApp for people who haven't ordered in a month
Of the 5,000 customers who haven't ordered for more than a month, 2,000 have promotional pushes on and have consented to WhatsApp. That is where the channels are compared. The customers are split at random into three groups: 800 get the push "Reorder your last basket", 800 get the same offer as a WhatsApp marketing template, and 400 get nothing. After 7 days the team looks at what share of each group placed an order.
| Over 7 days | Push | No message | |
|---|---|---|---|
| Customers in the group | 800 | 800 | 400 |
| What the channel reported | 200 opens | 560 reads | - |
| Placed an order | 96 (12%) | 120 (15%) | 32 (8%) |
| Extra buyers | about 32 | about 56 | - |
| Spent on messages | 0 | about $48 | - |
The owner sees 560 reads against 200 opens and 15% against 12%, and wants to move everything to WhatsApp. We have already separated reads from opens. As for 15% and 12%, they are compared with the no-message group: push added 4 percentage points (an interval of roughly 0.5 to 7.5), WhatsApp 7 points (roughly 3.4 to 10.6). WhatsApp clearly added buyers; push is borderline, with p of about 0.03, and both groups are compared with the same no-message group. Whether WhatsApp is better, this data can't say: the channels are 3 points apart, and the interval for that gap, from minus 0.3 to 6.3 points, includes zero. Groups of 800 are too small to separate a gap like that. Push lifted more here than in the test from the lesson on push and retention, but the audience is different too: there people hadn't ordered for a week, here for a month, and the intervals of the two tests overlap.
If all 800 templates were delivered, WhatsApp cost about $48, or about $0.86 per extra buyer by the central estimate. That's small change next to what a buyer brings in with an order, so the choice between channels comes down to reach and consent. The plan for the whole base looks like this:
- people with promotional pushes on get a push: it's free, and it added buyers in both tests;
- people without pushes but with WhatsApp consent get a WhatsApp message;
- people who only consented to email get an email;
- people who consented to nothing get no message: their number stays a number for the courier;
- in every channel part of the audience gets no message, so that in a month there is something to compare against.
Until a test shows that WhatsApp adds more, the free push stays the first channel.
Exercise: a channel map for your client
Take a business you work with, or one you'd like to pitch an audit to.
If the "reachable" column for SMS or WhatsApp shows every phone number in the database, go back to consent: a number taken for the courier is an address, not permission. If the client can't show when and under what wording a person agreed to marketing messages, put that in your report as a risk and pass the question to a lawyer. If the "what the channel reports" column for email lists opens, add that in the Mail app on iPhone with Mail Privacy Protection turned on the open isn't visible, and count link clicks instead. You end up with a one-page table: whom the client may message in which channel, and how they will check the result afterwards.