%201.png)
5. SMS Compliance in the UK
Ask AI
Ask questions about this page
5.1 Which are the regulatory bodies that govern SMS in the UK?
Information commissioner's office (ICO)
The ICO is the primary enforcer of data protection and direct marketing law in the UK. It writes and enforces the rules governing,
- Consent Opt-outs
- Unsolicited marketing messages
- Fines for non-compliance
It can issue civil monetary penalties, enforcement notices ordering a business to stop, and, in the most serious cases, pursue criminal prosecution.
Ofcom
Ofcom is the UK's communications regulator. It sets the General Conditions of Entitlement that mobile networks and messaging providers must follow. Since 2025, it also directly regulates two areas that matter for SMS: premium-rate and shortcode services and anti-scam obligations for business (A2P) messaging.
Advertising standards authority (ASA) and Committee of advertising practice (CAP)
The ASA enforces the CAP Code, the rulebook for marketing content. The Code explicitly covers "text transmissions (including SMS and MMS)" and governs honesty, clear identification of an ad, and substantiation of claims.
Competition and markets authority (CMA)
Since the Digital Markets, Competition and Consumers Act 2024 (DMCCA) took effect, the CMA can fine businesses directly, without going through the courts, for unfair commercial practices such as misleading claims, drip pricing, and hidden subscription terms. Fines can reach 10% of global turnover.
Mobile ecosystem forum (MEF)
MEF is an industry body that runs the voluntary SMS Sender ID Protection Registry, letting brands register the sender names used for their texts to make impersonation harder.
PECR 2003 (as amended)
The Privacy and Electronic Communications Regulations 2003 (PECR) is the core regulation governing SMS marketing. Regulation 22 sets the actual rule: you need consent, or a valid soft opt-in, before sending marketing texts to an individual. SMS is treated as "electronic mail" under PECR, which puts it in the same strict category as email marketing.
PECR was significantly amended by the Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025.
The core changes came into force on 5 February 2026, with further obligations following on 19 June 2026. The amendment,
- Raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global annual turnover, aligning it with UK GDPR.
- Removed the requirement to prove a breach caused "substantial damage or distress"
- Introduced a new soft opt-in for charitable fundraising communications.
- Added new cookie consent exemptions (a separate area from SMS, but part of the same regulation).
5.2 Consent: The foundation of SMS compliance in the UK
Every marketing text sent to a person in the UK needs one of two things in place before it goes out.
Explicit consent: A clear, affirmative opt-in, specific to SMS. Consent collected for email doesn't cover texts, and vice versa. Pre-ticked boxes, inactivity, or consent buried in general terms and conditions are not valid.
The soft opt-in: You can text existing customers about similar products or services without separate consent, but only if all four conditions below are met.
- The number was obtained in the course of a sale, or genuine negotiations for a sale
- The message is about your own similar products or services, not a third party's
- The customer was given a clear, simple chance to opt out when their number was first collected
- Every message since has included an easy opt-out, and they haven't taken it
Corporate subscribers are treated differently. You can send marketing messages to limited companies, LLPs, and government organizations without obtaining prior consent. However, every message must still include a clear way to opt out.
Sole traders and non-limited partnerships are not considered corporate subscribers, so the usual consent rules for individuals still apply.
Soft opt-in for charities: From 5 February 2026, charities can use a soft opt-in to send fundraising messages, following the rules introduced by the DUAA. However, this only applies to contact details collected on or after that date. It doesn't cover contacts collected earlier.
Opt-out preferences must always be respected: Once someone opts out, you can't send them further marketing messages, whether you originally relied on consent or the soft opt-in. Unlike some countries, the UK doesn't have a central text messaging preference registry, so businesses are responsible for maintaining their own opt-out lists.
Message types and what each one allows
Message Type
Consent Needed
Opt-out Required
Sending Window
Transactional or service (delivery updates, OTPs, account alerts)
No, if purely transactional
No, but good practice
No legal restriction
Marketing to individuals
Yes, explicit
Yes
No fixed legal window
Marketing to corporate subscribers
No
Yes
No fixed legal window
Charity fundraising, soft opt-in
No, if conditions met and contact obtained on or after 5 Feb 2026
Yes
No fixed legal window
Premium-rate or shortcode
Varies by service type
Yes
Governed by Ofcom's PRS Order 2024
Unlike some other markets, UK law doesn't set a fixed statutory sending window for marketing texts, and there's no automatic technical rejection outside certain hours. The ICO's expectation of "reasonable" timing is judged after the fact, through complaints, rather than enforced at the point of sending. Many businesses use something like 8 am to 8 pm on weekdays as a self-imposed guideline, but this is more of a best practice than a law.
A message stops being "transactional" the moment it includes promotional content. Adding a discount code or a cross-sell line to what would otherwise be a service message reclassifies it as marketing, and the consent and opt-out rules above then apply in full.
5.3 Sender IDs and the Two-way messaging limitation
Alphanumeric sender IDs display a business's brand name instead of a number, for example "TESCO" rather than a string of digits. They are one-way only. Because there's no real number behind an alphanumeric ID, a "reply STOP" instruction doesn't work: recipients who try to reply usually see an error, or the reply simply fails to deliver.
Numeric sender IDs and virtual mobile numbers do support two-way messaging, so a reply-based STOP works as expected in those cases.
Because most brand-recognisable UK marketing texts use an alphanumeric sender ID, PECR's opt-out requirement is normally met through one of the following instead of a reply:
- An unsubscribe link included in the message
- A dedicated customer service number or contact address
- A separate long number or short code the recipient can text instead
If an SMS platform advertises "reply STOP" as the opt-out method, it's worth checking whether that's actually routed through a real number behind the scenes.
Ofcom's 2026 Anti-Scam rules for business messaging
On 15 July 2026, Ofcom finalised a set of rules aimed at criminals who hijack business messaging services to impersonate brands. The rules apply to mobile providers and the aggregators that send business texts on their behalf, and they affect anyone running legitimate SMS campaigns, since providers are now expected to vet their client base far more closely.
Under the new General Conditions, providers and aggregators must:
- Run upfront and ongoing "Know Your Customer" and "Know Your Traffic" checks on business senders
- Verify Alphanumeric Sender IDs against the business's actual profile, so a company registered as a hairdresser can't suddenly send parcel delivery texts under another name.
- Maintain a policy on protected sender IDs and generic sender IDs, such as "customer service."
- Block scam messages in transit and act on scam reports from users and third parties Apply volume limits to pay-as-you-go SIM cards
5.4 Penalties and enforcement
The DUAA raised the maximum PECR fine to £17.5 million or 4% of global annual turnover. The ICO has said it intends to use the new ceiling, and enforcement against SMS marketing has continued at a steady pace through 2026
The ICO also relies heavily on 7726, the free number the public can forward spam texts to, as its main source of investigation leads.
- Promotional and Service Explicit messages are blocked outright for numbers on the DND registry, unless the sender holds valid DCA-based explicit consent for that specific subscriber.
- Transactional, Service Implicit, and Government messages always reach DND-registered numbers.
- Promotional and Service Explicit messages may only be sent between 10:00 AM and 9:00 PM IST, every day of the week, including weekends and public holidays. Messages submitted outside this window are rejected automatically by the DLT system.
Penalties and enforcement
Enforcement uses carrier-side AI/ML pattern analysis to find unregistered commercial telemarketing and grey-route traffic. The penalty system relies on a severe, escalating structure:
SMS compliance checklist for the UK
Confirm consent is specific to SMS, not borrowed from an email opt-in or a general marketing tick box.
If relying on the soft opt-in, check that all four conditions are met and documented.
Every message identifies the sender and includes a working opt-out.
If using an alphanumeric sender ID, confirm the opt-out actually works, since reply STOP may not function without a real number behind it.
Process opt-outs the same day where possible.
Check shortcode or premium-rate services against Ofcom's PRS Order 2024, not the retired PSA Code.
Ask an SMS provider or aggregator what KYC and KYT checks they now require under Ofcom's 2026 rules.
Review marketing content against the CAP Code for honesty and clear identification as an ad.
Treat bought-in or third-party contact lists as requiring fresh consent, never soft opt-in.
5.5 FAQs
1. Do I need a fixed sending window for marketing texts in the UK?
No. Unlike some other countries, PECR doesn't set a statutory sending window, and there's no automatic rejection outside certain hours. The ICO expects "reasonable" timing, judged through complaints after the fact, and most businesses use something like 8 am to 8 pm as a self-imposed guideline.
2. Can customers reply STOP to any UK marketing text?
Only if the message comes from a numeric sender ID or a virtual mobile number. Alphanumeric sender IDs, meaning brand-name senders, are one-way, so businesses using them need an alternative opt-out, typically a link or a separate contact number.
3. Is the Phone-Paid Services Authority still the regulator for text-to-donate and shortcode services?
No. Ofcom took over direct regulation of premium-rate services on 1 February 2025, replacing the PSA's Code of Practice with the Regulation of Premium Rate Services Order 2024.
4. What's the maximum fine for unlawful SMS marketing in the UK?
£17.5 million or 4% of global annual turnover, whichever is higher, following the Data (Use and Access) Act 2025. This replaced the previous £500,000 cap and puts PECR fines on the same footing as UK GDPR.
5. Does the soft opt-in apply to bought-in contact lists?
No. All four soft opt-in conditions require that the number was collected directly, during a sale or genuine negotiation. Bought-in, rented, or broker-supplied lists need proper consent instead.
