A first SMS campaign for a small business, step by step

A first SMS campaign comes down to six decisions: who you're allowed to text, how the list gets built, what the text says, when it goes, how you test it and what you count afterwards. The first one is set by law. Regulation 22 of the Privacy and Electronic Communications Regulations (PECR) says you need a person's consent before you text them marketing, unless the soft opt-in applies to them as your existing customer. The regulator is the Information Commission, which took over from the Information Commissioner's Office on 30 September 2026 and still publishes its guidance under the ICO name.

Most UK businesses are small. The Department for Business and Trade's business population estimates, published on 2 October 2025, counted 5.7 million private sector businesses in the UK at the start of 2025. Of those, 5.64 million had fewer than 50 employees and 4.27 million had none at all.

So the steps below assume one person, a contact list of some sort and an afternoon.

Step 1: work out who you can text

PECR treats a marketing text as "electronic mail", and regulation 22 gives you two routes to an individual's phone. The first is consent. The second is the soft opt-in in regulation 22(3), which lets you text someone without consent if you got their details "in the course of the sale or negotiations for the sale of a product or service" to them, you're only marketing your own "similar products and services", and they were given a simple, free way to refuse when you collected the number and in every message since.

The ICO's guidance on electronic mail marketing fills in the edges. You must have collected the number yourself: "There is no such thing as a third-party marketing list that is compliant with the soft opt-in." The person doesn't have to have bought anything, but they must have shown an interest in buying, such as signing up for a free trial, asking for a quote or asking for details of what you sell. Browsing your website isn't enough, and nor is a question that has nothing to do with buying. And the opt-out has to be offered at the time you collect the number; the ICO's example of a company that only mentions it in the order confirmation text is marked as bad practice, with the note that further marketing texts "would breach PECR".

Two groups sit outside this. Limited companies, LLPs and other corporate subscribers don't need to have consented under PECR, though sole traders and some partnerships count as individuals. And texts that aren't marketing at all, such as a booking confirmation, don't need marketing consent, until someone adds an offer to them. Our post on service and marketing texts works through the grey areas.

Step 2: build the list properly

If the people you want to text haven't bought from you or asked about buying, you need consent, and the ICO sets the standard by borrowing UK GDPR's definition: "freely given, specific, informed and unambiguous". In practice that means a free choice kept separate from your terms, your business named in the request, no pre-ticked boxes, and wording that names texts. The ICO's own example of good practice is a blank tick box next to "I would like to receive marketing from you about your services by text message", and its bad example leaves out "by text message". It adds: "You should ask for consent for each type separately", because some people want your emails and not your texts.

Consent can be spoken. The ICO's example is a restaurant that asks a caller, while taking a booking, whether they'd like marketing texts about discounts and events, and logs the time and date of the yes. The same example without the question is bad practice: the booking number doesn't become a marketing number on its own.

Keep the record. Article 7 of UK GDPR says that where you rely on consent you "shall be able to demonstrate" it, and that "It shall be as easy to withdraw as to give consent". For a small business, a spreadsheet column with the date, the place and the wording someone agreed to can do the job. Our post on writing a consent request that stands up has sample wording, and why bought-in lists fail explains why a purchased list isn't a shortcut.

A sign-up keyword is a simple way to build the list from nothing: a card on the counter that says "Text JOIN to 07700 900123 for offers, about two a month" collects the consent and the number in one go, and the person did it themselves.

Step 3: write the text

The CAP Code, which the Advertising Standards Authority enforces, applies to marketing texts. Rule 2.1 says "Marketing communications must be obviously identifiable as such", and rule 10.7 says a marketing text must contain "the marketer's full name (or, in the case of SMS messages, a recognisable abbreviation) and a valid address", such as a short code or number people can send opt-out requests to. PECR regulation 23 says the same about identity and the opt-out address. In practice: your name at the front, the opt-out at the end, and an offer in between that's true.

Length matters because it decides the price. 3GPP TS 23.040, the standard that defines SMS, gives each part 140 octets, which is 160 characters in the standard GSM alphabet or 70 in Unicode. A longer text is split into parts that carry 153 or 67 characters each, because a header takes up some of the space.

One emoji, or a curly quote pasted from a word processor, can move the whole text into Unicode. Our character counter shows the sums before you send.

Three hypothetical businesses, before and after.

A salon in Leeds sends: "Hi! Big news!!! 20% off ALL treatments this week only, book now before it's too late 💅". It doesn't say who it's from, the emoji makes it a two-part Unicode text, "this week only" needs to be true (sale claims are covered in our post on prices in promotional texts), and there's no way to opt out. Rewritten:

"Bloom Hair Leeds: 20% off colour treatments Tue 3 to Thu 5 Nov. Reply BOOK and we'll call you back with a time. Reply STOP to opt out"

That's 133 characters, one part, with a name, real dates, something to do and a way out.

A garden centre crams in everything: "SALE SALE SALE at Ashby Garden Centre!! Christmas trees, wreaths, lights, gifts, cafe vouchers & more, huge savings across the store this weekend & next, visit us or shop online at" followed by a long tracking link. That runs to 261 characters and two parts, and nobody can tell what's on offer. One offer reads better:

"Ashby Garden Centre: Christmas trees arrive Sat 28 Nov, from £35. Cafe open 9 to 4. Reserve one at example.co.uk/t/tree. Reply STOP to opt out"

A gym announcing a class can lean on a reply, which is free to send:

"The Mill Gym: new 6am HIIT class from Mon 9 Nov, free for members. Reply YES to book your first one. Reply STOP to opt out"

On the opt-out wording, the ICO says you "could offer an opt-out by telling people to send a stop message to a code number", and that it must be free apart from the normal cost of sending a text. Its good practice example is a hairdresser ending a 30% off text with "To opt out text STOP to 12345". One catch: a reply only works if the text came from a number. A text sent from a sender name, such as "BloomHair", can't be replied to, so STOP won't reach you; use a number for marketing, or give a link to an unsubscribe page that doesn't need a login.

Adding the customer's first name with a merge field is fine, but check the longest name on the list doesn't push the text into a second part.

Step 4: pick the moment

Send in the daytime, on a day when the offer can be used, and only as often as you have something worth saying. There's no legal curfew on texts, but a 10pm offer reads badly. Our post on when to send a business text has what the published data and rules say, and our own suggested hours. If you promised "about two a month" on the sign-up card, that promise is part of what people agreed to.

Step 5: send a test

Before the list gets it, send the exact text to your own phone and one other. Check that the name at the front is the one people know you by, that the link opens on a phone, that the merge field filled in, and that the text arrived as one part if you meant it to. Then reply STOP from the test phone and make sure the number lands on your opt-out list, because the first live STOP is a bad time to find out it doesn't. If you're sending through an API, a test key lets you run the whole thing without sending anything.

Step 6: count what you can count

A text has no open signal, so ignore anyone who quotes an open rate (our post on the 98% open rate myth explains why). Four numbers are real. Delivered divided by sent tells you about list quality. Clicks on a tracked link, divided by delivered, tell you how many people looked at the offer. Replies tell you how many acted, if the text asked for one. And STOP replies divided by delivered tell you whether the list wanted to hear from you. The last one matters most for a first campaign: a high STOP rate means the consent was thinner than you thought, and the fix is in step 2.

Write all four down after each campaign; they're most useful set against your own next campaign.

CaptiFi Connect gives every new account 10 free credits with no card, so the test in step 5 costs nothing, and the smallest pack is 500 credits for £25 (5p a text) after that, with credits that never expire. STOP and the other opt-out words sent to your number are handled automatically, and each campaign has delivery reports and click counts for tracked links. New accounts can send straight away, but until the account is approved a person reads each text before it goes, which is a decent second pair of eyes on a first campaign. The SMS marketing page shows how a campaign is set up.