SMS marketing rules in the UK

PECR defines direct marketing as 'the communication (by whatever means) of advertising or marketing material which is directed to particular individuals'. The ICO reads 'advertising or marketing material' widely. Offers and sales are obvious, but promoting an organisation's aims and ideals counts too, which is why charity fundraising and campaigning are covered.

Service messages are different. The ICO's examples include confirming or reminding people of appointments, checking contact details and updating people on terms and conditions, and it describes a gym phoning a member to say a monthly payment has failed as a message that isn't direct marketing. Admin like that falls outside the marketing rules.

One promotional line changes the whole message, though. In the ICO's gym example, adding an outline of personal training services to the payment call makes it direct marketing. A neutral tone doesn't rescue it either: the ICO's example of a supermarket telling customers its local store stocks leading brands is still promotional. Logos and general branding on their own don't count.

To individuals, yes, unless the soft opt-in applies. Regulation 22 of PECR says you can't send unsolicited marketing by electronic mail unless the recipient has previously consented, and the ICO's guide to PECR is clear that texts count as electronic mail for these rules.

The ICO uses the UK GDPR standard for consent: freely given, specific, informed and unambiguous, and given by a clear affirmative action. In practice that means:

The soft opt-in is regulation 22(3) of PECR. It lets you text marketing to someone without their consent when all three of these are true:

You must have collected the details yourself, so a bought-in list never qualifies. Browsing your website isn't enough to count as negotiating; the person has to have shown an interest in buying. The opt-out offered at collection has to be visible, too: one hidden in your privacy policy doesn't count, and nor does one that first appears in the order confirmation.

Since 5 February 2026 there has also been a version for charities, regulation 22(3A), added by the Data (Use and Access) Act 2025. A charity can text people who expressed an interest in, or offered or gave support to, its charitable purposes, provided the sole purpose of the texts is to further those purposes and the same opt-out conditions are met. The ICO says it can only be used for contact details obtained on or after 5 February 2026.

PECR splits recipients into individual subscribers and corporate subscribers. Individuals include sole traders and some partnerships, so a self-employed electrician's mobile is treated like anyone else's and needs consent or the soft opt-in.

Corporate subscribers (companies, limited liability partnerships, Scottish partnerships and government bodies) don't need to have consented under PECR. The ICO still recommends keeping a 'do not email or text' list of businesses that object and screening new lists against it, and it notes that marketing to employees at their work addresses can still raise data protection questions.

Regulation 23 of PECR bans sending marketing by electronic mail where your identity has been disguised or concealed, or where there's no valid address the recipient can use to ask you to stop. So every marketing text needs to make it clear who it's from and to give a working way to opt out.

On the opt-out itself, the ICO says it should be simple, such as replying directly to the message, and for texts it suggests telling people to send a stop message to a code number. It must be free of charge apart from the cost of sending the message, and you can't make people create an account or log in to unsubscribe.

'Reply STOP to opt out' covers this neatly when the text comes from a number people can reply to. Send from an alphanumeric sender name and nobody can reply, so the opt-out has to work some other way, such as a link to an unsubscribe page that doesn't ask anyone to log in.

PECR applies to anyone who sends, or instigates the sending of, direct marketing by electronic mail. The ICO says you are likely to be instigating if you encourage, incite, incentivise or ask someone else to send your marketing, and where you instigate, both you and the sender can be responsible.

The ICO's guidance says a service that only provides the technical means of sending, such as a bulk email platform, isn't normally responsible for the messages. You stay responsible. If a third party sends marketing for you using personal information, the ICO says you need a contract with them, and you should check that they're complying.

Refer-a-friend schemes need care too. Ask customers to text their friends about you and you're instigating those texts, you can't rely on the soft opt-in, and you'd need valid consent. The ICO also advises against asking people for their friends' contact details for marketing, because you can't be sure the friends agreed to be contacted.

You stop. Article 21 of the UK GDPR gives people the right to object at any time to their data being used for direct marketing, and once they object, the data 'shall no longer be processed for such purposes'. The ICO adds that there are no grounds you can use to refuse an objection to direct marketing.

Keep the number on a suppression list instead of deleting it. The ICO's guidance is to keep the minimum needed to respect the person's wishes, and it warns that deleting someone's details is a risk: if the number turns up later on a list you buy or import, you'll market to them again without knowing. Opt-outs are often specific to one channel, so the ICO notes that someone who leaves your texts may still get your emails. If a customer's STOP sounds like they want nothing more from you at all, stopping everywhere is the kinder call.

Ofcom's advice to the public points the same way. It tells people to reply STOP to marketing texts from senders they know, to forward unwanted texts to 7726 for free, and to report texts that carry on after they've asked to stop to the ICO.

We handle the mechanics. Campaign texts get your opt-out line ('Reply STOP to opt out' by default, and you can edit it). A reply of STOP, STOPALL, STOP ALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT or OPT OUT puts the number on your opt-out list, pending texts to it are cancelled and refunded, and later sends to it are refused without charge. Every new account is checked before it can send, and every sender name is checked before it's used.

We can't know where your list came from. Consent and the records that prove it stay with you, and so does the call on whether a particular text is marketing.