Send UK SMS with consent handled properly

UK business texting is governed by two overlapping regimes, neither of which is a registration scheme. PECR, the Privacy and Electronic Communications Regulations, governs electronic marketing: it restricts unsolicited marketing by text and email unless the recipient has consented or a narrow exception applies. UK GDPR governs the personal data behind every message, lawful basis, transparency, retention and the rights individuals can exercise. The two interact, and a messaging programme has to satisfy both rather than either.

We deliberately do not present our word as law. Our compliance guide is the general reference: it is explicitly not legal advice, it was recently updated, and it is honest that service-provider and carrier rules may require pre-registration of message originators and that customers remain responsible for consent. The anti-spam policy covers the sending side, including how we treat sender IDs and originator registration. For the infrastructure side, the service level agreement sets out what we commit to operationally rather than legally.

Direct marketing by text message requires consent in the UK, or the soft opt-in exception. The soft opt-in is specific and limited: it applies to your own customer, for similar products or services, where a clear opt-out was offered at the point their details were collected. It applies to email and text, and it does not cover third-party offers or unrelated promotions. Where the soft opt-in does not apply, positive consent is the safe route, and it should be recorded with evidence: what was offered, when, and how it was withdrawn.

Consent is not the only obligation. UK GDPR requires a lawful basis for processing personal data, and marketing typically needs explicit consent or legitimate interests, depending on the traffic. Every marketing message needs a working opt-out, and the opt-out needs to be respected across channels rather than only the channel it came from. The transactional versus marketing comparison lays out where the line sits in practice, because the boundary is where most UK compliance problems start.

Service messages are a different category. A one-time code, an order update, an appointment reminder or a system alert is information the recipient needs because an event happened. It is not marketing, it does not need marketing consent, and it would be odd to ask for consent before sending a delivery confirmation. Privacy law still applies to the data, so lawful basis, retention and subject access are all still live obligations.

The category boundary should be drawn by trigger and content, not by intent. A confirmation with a promotional footer can drift into marketing territory depending on the assessment, so many UK senders keep promotional material out of transactional messages entirely, or tag message types so consent state is queryable. Our UK transactional SMS page and UK business SMS page cover the practical side, and the compliance guide gives the fuller legal context.

If you cannot tell a compliance officer whether a given message was transactional or marketing, treat that as a system gap rather than a lawyer's problem: the tag should exist in the data, attached at creation, and audit should be a query rather than an archaeology project.

Sender identity is regulated by default in the UK, not by registration. An alphanumeric sender ID can contain up to 11 characters using letters, digits and spaces, and it is what the recipient sees in the inbox. UK mobile networks, including BT/EE, O2, Vodafone, Three and others, maintain reserved or restricted sender IDs. If your ID is on a reserved list, a network may substitute another sender or reject the message; BT/EE publish restricted lists, and some networks support or require sender-ID registration via the aggregator before the ID can be used at all.

Because there is no US-style national registry in the common case, the discipline is per-network and quiet: check the lists, and register where a network requires it. That is exactly what we offer. Where a network requires it, we can check and register your sender ID before you launch, which is the practical equivalent of 10DLC registration without the schedule. The UK SMS gateway page covers the operational handling, and our US compliance page shows how the comparable US regime differs.

The UK messaging ecosystem has been tightening identity for reasons beyond marketing consent. Ofcom, the UK communications regulator, introduced a CLI authentication framework after a 2024 consultation, and the rollout continues: the framework is aimed primarily at spoofed caller IDs, but it sits alongside anti-spoofing and whitelisting work that affects messaging originators too, including the MEF UK whitelist register and Do-Not-Originate lists. The practical implication for a sender-ID-based market is that legitimate, registered originators become easier to distinguish from impersonated ones, which is good news for the majority and a reason not to skip list checks.

Short codes have their own regulatory shape. UK text short codes are Ofcom-allocated, commonly 5-6 digits in the 7000 series, and several ranges such as the familiar 80xxx, 84xxx, 86xxx and 87xxx family remain in use (several ranges are in use; check with us for current allocations). Our inbound SMS page covers the short code options, and the policy pages on data protection, data retention and terms and conditions complete the picture if you need the contractual side.