What is GDPR?
The General Data Protection Regulation (GDPR) is a set of European laws designed to protect the personal data and privacy of people who live anywhere in the European Union. Importantly, it gives individuals more control over how their personal information is collected and used by the businesses and institutions that they interact with on a daily basis. The onus is on these organizations to ensure data is handled responsibly, and individuals have the right to access, correct, or delete their information if they wish.
GDPR is not static legislation and is expanding and adapting to cover more edge cases and to increase the effectiveness of enforcement measures. For example, the territorial scope of the laws has been expanded, meaning more non-EU based companies are subject to compliance obligations where they process the data of EU residents, offer services to EU residents, or even monitor their online behavior.
Breaking GDPR regulations can result in fines and service suspensions. For brands looking to create engaging and personalized experiences for their customers, it’s all about making sure personal data is treated with care and respect at all stages of the customer journey and at every touchpoint, including both transactional and promotional SMS messages.
SMS regulations in Europe
Our 2025 messaging trends research has shown that SMS is a pillar communication channel for businesses across Europe.
It is therefore important to look at some of the specific GDPR rules that apply to B2C SMS communication.
Consent: Firstly, and most importantly, before sending any SMS, a business must obtain explicit consent from recipients. This means they must actively agree to receive messages and must be informed clearly up front what sort of messages they will receive. There are some caveats to this rule which we will cover later, but consent is still a key component of legislation.
Purpose limitation: You can only use personal data (like phone numbers) for the purposes you specified when collecting it. For example, if people sign up to receive a monthly newsletter, you can’t use their number to send unrelated promotions or share it with partner organizations.
Right to withdraw consent: Recipients must have an easy and clear way to opt out of receiving your SMS messages at any time. For example, by replying “STOP” to unsubscribe or by managing their preferences via your website.
Data minimization: GDPR makes it clear that you should only collect the data that is necessary for the specific purpose – in this case sending SMS messages. For example, when a person registers for a service or applies for a financial product then it is not necessary to request information like their ethnicity, blood type, or marital status.
Data storage and security: All personal data must be securely stored and protected from unauthorized access. Businesses must implement measures like encryption and restricted access and be able to demonstrate them during ad hoc audits. In addition, data should only be stored for as long as it is necessary to fulfill the purpose for which it was collected.
Right of access and erasure: Individuals have the right to access the personal data that any business holds about them and be able to request that it is deleted.
Why is GDPR important for SMS marketing?
GDPR is thorough and well-enforced legislation. Breaking rules can include fines and other penalties. By following guidelines, businesses will not only avoid financial losses but also raise their levels of data security and improve the efficiency and effectiveness of their SMS marketing campaigns.
Customers are far more likely to stick with ethical brands that are transparent and reliable in their communication.
SMS marketing GDPR best practices
There are several best practices that you can adopt to not only ensure compliance with GDPR rules for SMS marketing but also provide better customer experiences that build trust.
1. Obtain clear consent (and keep detailed records of it)
You must have a thorough strategy for obtaining opt-in from customers before sending SMS marketing messages. People must explicitly agree to receive them – so it is best to use a recognized method of collecting opt-ins – for example pre-ticked checkboxes hidden on a T&Cs page is not acceptable.
Very importantly, you must maintain records proving consent was freely provided. These records should include the individual’s identity, the date and time of consent, the specific actions they consented to, and how consent was obtained.
2. Be transparent about the intent of messages
During the opt-in process recipients should be made aware of what they are signing up to receive, and how their data will be used. This should be communicated in clear everyday language that doesn’t include legal jargon.
Complete details should be included in a privacy policy that you can link to, but again this should be easy to understand and access. This policy should cover:
- What data you collect (for example, phone numbers, purchase history, etc.)
- The reason for collecting this data and how it will be used.
- The length of time that you intend to store the data
- Clear instructions on how customers can withdraw their consent.
3. Provide clear and simple opt-out options
Consent isn’t necessarily the gift that keeps giving indefinitely. GDPR makes it clear that recipients should be able to withdraw their consent at any time. Hopefully this will be a rare event if you are sending relevant and valuable messages, but you must make recipients aware of how they can opt-out, for example by replying with “STOP” or following a link to a page where they can update their preferences.
4. Only collect relevant data
Only collect the information you genuinely need for your marketing efforts. Remember that data that has been de-identified, encrypted, or pseudonymized but can still be used to re-identify a person and therefore falls within the scope of GDPR.
5. Ensure data security
All personal and transactional data that an organization holds must be securely stored and protected from unauthorized access.
GDPR does not outline specific measures for data security for SMS marketing but requires organizations to take appropriate action based on the risks they face.
This may involve implementing measures such as:
- Access controls and authentication
- Data encryption and anonymization.
- Security awareness training for staff
- Regular security audits and vulnerability assessments.
In addition, data should only be stored for as long as it is necessary to fulfill the purpose for which it was collected.
6. Keep up to date with evolving GDPR regulations
GDPR regulations are not static and are regularly reviewed and updated as technology and consumer habits evolve. It’s therefore essential to regularly review and update your compliance measures.
Some examples of recent changes to GDPR include:
- The refinement of laws related to the movement of data across borders
- Rules related to the use of AI-based tools
- Changes to cookie banners to provide more granular consent options and a more user-friendly experience
7. Make GDPR part of your workplace culture
Here are some GDPR-compliant methods for collecting SMS opt-ins.
In all cases you should make it clear what the person is opting in for i.e. the types of messages that you will be sending them, the frequency of messages that they can expect, and that they can opt out at any time.
Sign-up forms: Create online or offline forms that include a clear, unchecked checkbox for individuals to opt in to SMS communications. Make sure it’s explicitly labeled, such as “Yes, I want to receive SMS updates and promotions.”
Promotions and incentives: Offer discounts, exclusive offers, or entry into a contest in exchange for signing up for SMS updates. Be transparent about what they are agreeing to, and only send messages related to the stated purpose.
Checkout pages: Provide an opt-in option on your checkout or subscription pages with clear language like, “Sign up for SMS notifications about your order and related special offers.”
In-store sign-ups: For physical stores, use tablets or printed forms that explain the benefits of signing up to receive SMS messages and provide an option to opt in.
Email campaigns: Include an option in your email marketing to sign up for SMS updates. Use a link or button to direct them to a landing page with the opt-in details.
Customer portals or apps: Offer the option to opt in through a customer account or mobile app, ensuring that the purpose of the messages is clearly explained.
Event registration: If you’re hosting an event, include an opt-in option for SMS updates related to the event as part of the registration process.
What about double opt-in?
Double opt-in is a method where a user must confirm an opt-in, for example by replying “YES” to a follow up message after initially signing up.
While double opt-in is a recommended practice to ensure GDPR compliance and a good customer experience, it is not a mandatory requirement under the GDPR itself. GDPR emphasizes that consent must be freely given and unambiguous, meaning it’s an active choice. Double opt-in strengthens the demonstration of this consent, but single opt-in can be sufficient if consent is clearly and actively obtained.
When is SMS opt-in not required under GDPR?
Under GDPR, businesses can send SMS messages without explicit opt-in consent in limited cases known as “legitimate interest” or when it’s deemed essential for fulfilling a contract.
Examples include:
- Transactional messages: Sending SMS updates related to a purchase or service, such as order confirmations, delivery updates, or appointment reminders. These are considered necessary for providing the agreed service.
- Legal obligations: Businesses can send SMS messages when required by law, such as safety alerts or compliance notifications.
- Existing customer relationship: If an individual has previously purchased a product or service, businesses may be allowed to send related SMS marketing based on their legitimate interest. However, this varies by country and usually applies only to similar products or services.
SMS and GDPR FAQs
Do businesses need to keep records of consent?
Yes. GDPR requires businesses to document when, how, and what the person consented to, including:
- Timestamp of consent
- Method of opt-in (e.g. web form, SMS keyword)
- The exact wording shown at the time of consent
How long should it take to get unsubscribed?
GDPR states that when a person opts out of receiving SMS the organization must honor that request without undue delay. No specific number of days are mentioned, but the expectation is that it should happen as soon as possible.
Most organizations action opt-outs within a couple of days, which means that a person may receive additional SMS messages after they have opted out where an SMS campaign is already in flight, or they perform an action that triggers a message.
What are the fines for breaking GDPR SMS rules?
Fines for breaking regulations are significant.
GDPR has two tiers of administrative fines, depending on the severity of the violation:
- Up to €10 million, or 2% of the company’s global annual turnover (whichever is higher), for less severe infringements.
- Up to €20 million, or 4% of the company’s global annual turnover (whichever is higher), for more serious violations—such as ignoring data subjects’ rights or failing to obtain valid consent.
On June 15, 2023, an online advertising company called CRITEO was fined by France’s data protection authority, CNIL, for €40 million after the company failed to ensure data subjects provided opt-in consent for the processing of their data.
Do GDPR rules apply to businesses outside the EU?
Yes. If businesses send SMS messages to individuals in the EU or UK, GDPR applies regardless of where the business is based.
What measures has Infobip implemented to protect personal data transmitted via SMS in accordance with GDPR?
Infobip has implemented a built-in global compliance engine that is regularly updated with the latest regulations and operator requirements to ensure data privacy and compliance with laws like GDPR. This engine helps protect sensitive data transmitted via SMS, ensuring that Infobip’s products and services align with legal requirements. By maintaining these compliance measures, Infobip aims to safeguard personal data effectively.
Can Infobip’s SMS platform assist in managing and documenting user consent to meet GDPR requirements?
Yes, our SMS platform can help manage and document user consent, which is essential for compliance with regulations like GDPR. By implementing clear opt-in mechanisms, such as web forms or text-to-join options, you can ensure that users provide explicit consent before receiving messages. Additionally, the platform allows for confirmation messages to be sent immediately after a user subscribes, further documenting their consent. This structured approach helps maintain compliance with GDPR requirements.
