SMS Marketing in the UK: A PECR and UK GDPR Compliance Guide

SMS marketing works in the UK because people read their texts. Restaurants fill quiet midweek tables, salons recover cancelled appointments, e-commerce brands announce sales and service businesses send seasonal reminders, often with better response than email. But the UK also has clear, enforced rules about unsolicited marketing texts, and the Information Commissioner's Office (ICO) regularly fines businesses that ignore them.

This guide explains the rules in practical terms. It is general information rather than legal advice; for complex programmes, take specialist advice.

The rules that apply

Two sets of rules work together:

• The Privacy and Electronic Communications Regulations 2003 (PECR) set specific rules for electronic marketing, including texts, emails, automated calls and other electronic messages.
• The UK GDPR and the Data Protection Act 2018 govern how you collect, store and use personal data, including mobile numbers.

Both are enforced by the ICO. In 2025 the Data (Use and Access) Act amended PECR, including raising the maximum PECR fines to UK GDPR levels. The details are being phased in, so check the ICO's current guidance before a major campaign.

The core rule: consent for marketing texts to individuals

Under PECR, you generally must not send marketing texts to individuals unless they have specifically consented to receive them from you. For consent to be valid under UK GDPR standards, it must be:

• Freely given: not a condition of service unless genuinely necessary.
• Specific: clearly about marketing by text, not bundled with terms and conditions.
• Informed: the person knows who you are and what they are signing up for.
• Unambiguous and affirmative: an unticked box they tick, a keyword they text, not a pre-ticked box or silence.
• Recorded: you can show who consented, when, how and what they were told.

A good consent statement reads:

Tick to get offers and news from [Business] by text. You can opt out at any time by replying STOP.

The soft opt-in

PECR includes an exception commonly called the soft opt-in. You may send marketing texts to existing customers without fresh consent if all of these are true:

1. You obtained their details in the course of a sale, or negotiations for a sale, of a product or service.
2. You are marketing your own similar products or services.
3. You gave them a simple opportunity to refuse marketing when you collected their details.
4. You give them a simple way to opt out in every message.

The soft opt-in does not cover people who only entered a competition, downloaded a free guide without any sale negotiation, or whose details you bought from a third party. Historically it has applied to commercial marketing; the Data (Use and Access) Act extends a similar approach to charities, subject to commencement.

Business-to-business texts

PECR's consent rules for texts apply to "individual subscribers", which includes sole traders and some partnerships. Texts to corporate subscribers are treated differently, but if you text an employee's personal mobile, UK GDPR still applies and you should be cautious. In practice, many UK businesses apply consent-based rules to all marketing texts because it is simpler and safer.

Identity and opt-out in every message

Every marketing text should:

• Clearly identify your business, ideally starting with your name or using a registered alphanumeric sender ID.
• Include a simple, free or low-cost opt-out, such as "Reply STOP to opt out".
• Not disguise or conceal who it is from.

When someone opts out, stop marketing to them promptly and add them to a permanent suppression list so they are not re-imported later.

Bought lists: why not to use them

Buying or renting a list of mobile numbers is one of the most common causes of ICO enforcement. Consent given to a list broker or a third party does not usually extend to your business unless you were specifically named. Even if a list seller claims "opted-in data", you need to be able to prove valid consent for your messages. Build your own list instead.

Practical ways to grow a compliant SMS list

• Checkout: an unticked SMS marketing box at online and in-store checkout, which can also support the soft opt-in for customers.
• Bookings: an SMS offers option on booking forms for restaurants, salons and clinics.
• Keyword campaigns: "Text JOIN to [number] for 10% off your next visit", with clear terms.
• QR codes: in-store or on packaging, linking to a short sign-up form.
• Loyalty schemes: offers by text as a benefit of membership, with separate marketing consent.

Sender IDs and numbers

In the UK you can send from:

• Alphanumeric sender IDs (up to 11 characters, such as your brand name). Recipients cannot reply directly, so include an alternative opt-out method, such as a link or a free number.
• Long virtual numbers, which allow replies and STOP processing.
• Short codes, which are memorable and support keyword campaigns.

Industry efforts to fight SMS fraud, including sender ID protection schemes, mean well-known brand names may be protected against misuse. Use a sender ID that clearly matches your brand.

Timing and frequency

PECR does not set specific sending hours for texts, but sensible timing matters:

• Send during normal daytime hours, typically late morning to early evening.
• Avoid very early mornings, late nights and Sundays unless your business is relevant then (for example, a Sunday lunch offer).
• Keep frequency moderate. Two to four texts a month is plenty for most businesses.
• Remember that excessive, irrelevant texts generate complaints, and complaints drive ICO investigations.

Writing texts that work

• Lead with your name: "Luca's Pizzeria: .."
• One offer, one action: "2-for-1 pizzas Tue–Thu this week. Book: lucas.co.uk/book"
• Clear terms: if there are conditions, link to them.
• Opt-out: "Reply STOP to opt out".
• Under 160 characters where possible, and avoid emojis if you want to stay in a single SMS part.

Data protection housekeeping

• Mention SMS marketing in your privacy notice, including how long you keep data.
• Keep consent records linked to each number.
• Restrict access to your list and use providers with appropriate data protection terms.
• Delete numbers you no longer need and clean the list regularly.

Measuring results

Compliance is the foundation, but the point of SMS marketing is results. Track for each campaign:

• Delivery rate, to spot old or invalid numbers
• Click-through rate on tagged links to your website
• Redemptions or bookings, using a unique code or landing page per campaign
• Opt-out rate, which signals whether frequency and relevance are right
• Revenue per message sent, to compare SMS fairly with email and paid social

If opt-outs rise above your normal level after a campaign, look at frequency, timing and how well the offer matched the segment.

What does SMS marketing cost in the UK?

Prices are in US dollars and follow our current price list. These figures are positioned below typical UK agency and platform rates. Contact us for an exact quote based on your volume.

Checklist before you press send

1. Every recipient consented or meets all soft opt-in conditions.
2. You have records of that consent.
3. The message identifies your business.
4. It includes a working opt-out.
5. Opted-out numbers are suppressed.
6. The send time is reasonable.
7. Links go to your own domain and work on mobile.

How DND Teams helps

We help businesses in London, Manchester and Birmingham set up compliant SMS marketing, from consent wording to campaign delivery. Learn more about our bulk SMS services and our UK SMS compliance guide. Interested in richer messages? Read our UK RCS guide.

Prices shown are indicative ranges in US dollars and exclude taxes and third-party charges (such as Meta or carrier fees, billed at cost) unless stated. Your price depends on your requirements; get a custom quote for an exact figure. This article is general information, not legal advice, and reflects our understanding as of October 2026.