SMS marketing rules in the UK: PECR, consent and opt-outs

A plain-English guide to UK SMS marketing rules: PECR, UK GDPR, consent, the soft opt-in, opt-outs and what the ICO expects from businesses that send texts.

The two sets of rules that apply

Two pieces of law shape SMS marketing in the UK. The Privacy and Electronic Communications Regulations 2003, usually called PECR, set specific rules for electronic marketing, including texts. UK GDPR and the Data Protection Act 2018 govern how you collect and use personal data such as mobile numbers. Both are enforced by the Information Commissioner's Office. This guide is general information, not legal advice, and it is written for UK businesses sending texts to UK recipients. If your situation is unusual, or you are planning a large campaign, take advice from a qualified professional.

The key idea is simple: under PECR, you generally need a person's consent before sending them a marketing text, unless a narrow exception called the soft opt-in applies. Separately, UK GDPR requires a lawful basis for holding and using their number at all, a privacy notice explaining what you do, and sensible security. Meeting one set of rules does not automatically satisfy the other, so it helps to think about both when you plan a campaign.

What counts as a marketing text

PECR applies to direct marketing, which the ICO interprets broadly. It covers advertising and promotional messages about products or services, and also messages promoting an organisation's aims or ideals, which is why charities and political parties are caught. A text offering a discount, announcing a sale, inviting people to an event that promotes your business or encouraging them to book a paid service is almost certainly marketing.

Service messages are different. Appointment reminders, order and delivery updates, account security codes, payment reminders and operational notices are not marketing, provided they do not include promotional content. The line can blur: adding a special offer to the bottom of a delivery update turns it into a marketing message. If you want to keep service texts out of the marketing rules, keep them purely informational and send promotions separately.

Consent: what good looks like

Where you rely on consent, it must meet the UK GDPR standard. In practice that means the person has taken a clear, positive action to agree to receive marketing texts from you, and they understood what they were agreeing to. Consent hidden in terms and conditions, assumed from silence or collected with pre-ticked boxes does not count. It should be specific to SMS, or at least clearly include it, and name your organisation rather than vague partners.

• Freely given: not a condition of buying something unless genuinely necessary.
• Specific: covers marketing texts from your organisation.
• Informed: the person knows who will contact them and about what.
• Unambiguous: a clear opt-in action, such as ticking an unticked box.
• Recorded: you can show when, where and how consent was given.

Keeping records matters as much as collecting consent properly. If the ICO investigates a complaint, you will need to show the wording people saw, the date they agreed and the source, such as a website form or an in-store sign-up. Consent does not last forever either, so refresh it if you have not contacted someone for a long time.

The soft opt-in for existing customers

PECR includes a limited exception, often called the soft opt-in, that lets you send marketing texts to existing customers without fresh consent. All of the conditions must be met: you obtained their number during a sale, or negotiations for a sale, of a product or service; you are only marketing your own similar products or services; you gave them a simple way to refuse marketing when you collected the number; and you offer an easy opt-out in every message.

The soft opt-in does not cover prospects who never bought or enquired, numbers from third parties, or contacts collected by another company in your group. It also only applies to your own similar offers, so a garage could text previous customers about servicing, but not about a partner's insurance product. The Data (Use and Access) Act 2025 extends a version of the soft opt-in to charities and raises the maximum penalties under PECR, with changes being brought in in stages, so check the ICO's current guidance for what is in force.

Opt-outs and identifying yourself

Every marketing text must make it easy to stop receiving them, free of charge apart from the normal cost of sending a message. A line such as Reply STOP to opt out is the familiar approach, and Orbis SMS handles STOP opt-outs so those numbers are not messaged again. You should also respect opt-outs made in other ways, such as a phone call, an email or a conversation at your counter, and add those numbers to your suppression list promptly.

You must not disguise who you are. Your message should make clear that it comes from your business, either through a recognisable sender ID or by naming the business in the text. Spoofing another organisation's name, or using a sender that misleads people about who is contacting them, is against the rules and against our Acceptable Use Policy. Clear identification also helps your texts stand out from the scam messages people are now wary of.

Business numbers and practical good habits

The consent rules in PECR apply to individual subscribers, which includes sole traders and many partnerships. Texts to corporate subscribers, such as limited companies, are treated differently, but many work mobiles are personal contracts, so it is usually safer to treat every mobile number as if consent is needed. UK GDPR still applies to named individuals at companies. Whatever the type of recipient, never use bought, rented or scraped lists, which carry serious risk.

Good habits go a long way. Keep marketing and service contacts in separate groups, so promotions never reach people who only agreed to reminders. Send at sensible times, keep messages relevant and do not over-message. Review your suppression list before every campaign, and keep records of consent alongside your contacts. If a complaint arrives, deal with it promptly and politely. These steps protect your customers, your reputation and your ability to keep sending.

This guide is general information, not legal advice. For guidance on your own obligations, see the ICO website or speak to a qualified adviser.

Frequently asked questions