yerman

UK SMS marketing compliance checklist

This guide explains UK SMS marketing compliance checklist, who it’s for, and what to do next.

What “compliant SMS marketing” means in the UK (PECR + UK GDPR in plain English)

In the UK, “compliant SMS marketing” means you only text people promotional messages when you have the right permission (or a very limited exception), you’re clear about who you are, and you respect people’s choices. Two main rulesets apply: PECR (which covers electronic marketing like SMS) and the UK GDPR (which governs how you collect, use, and store personal data such as phone numbers).

PECR in plain English: for most marketing texts to individuals, you need prior consent—a clear opt-in. You must also include a simple way to opt out in every message (e.g., “Reply STOP”). There’s a commonly used exception called the “soft opt-in”: if someone bought from you (or negotiated to buy), you can market similar products by SMS only if you gave them a chance to opt out at collection and in every message.

UK GDPR in plain English: you need a valid reason (a “lawful basis”) to process the phone number and send the texts—typically consent for SMS marketing. Consent must be freely given, specific, informed, and easy to withdraw. You should keep evidence of consent (what they agreed to, when, and how), use data minimisation (only collect what you need), and set sensible retention rules.

Consent checklist: when you need opt-in, when soft opt-in applies, and what counts as valid consent

Use this checklist to decide whether you can text someone marketing messages in the UK and what evidence you should keep.

How to build a compliant SMS opt-in journey (web, checkout, lead gen, offline capture)

Design your SMS opt-in so consent is clear, specific, and easy to prove later. Start by deciding what people are signing up for (e.g., “marketing texts about offers and product updates”) and keep that wording consistent across every capture point.

Proof and controls: Log the phone number, consent wording, source (URL/store), date/time, and any double opt-in confirmation. Provide an unsubscribe mechanism in every message and suppress numbers immediately after STOP. Keep a preference centre so people can change topics without fully opting out.

Opt-out and preference management: STOP keywords, unsubscribe flows, and suppression lists

Make opting out as easy as opting in. Every UK marketing SMS should include a clear opt-out instruction (for example: “Reply STOP to opt out”). Use common keywords and variants (STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) and treat them consistently. If you use short codes or virtual mobile numbers, test opt-outs across UK networks and ensure replies are free or clearly priced.

Build an automated unsubscribe flow that acts immediately. When a recipient texts a STOP keyword, your system should: (1) recognise the keyword reliably (case-insensitive, ignores extra spaces), (2) suppress the number from future marketing sends, and (3) send a single confirmation message such as “You’re unsubscribed and won’t receive marketing texts from us. For help, reply HELP.” Avoid sending further promotional content after an opt-out, including “win-back” messages.

Maintain a suppression list (also called a do-not-contact list) that is separate from your marketing list and cannot be overwritten by imports. Store the mobile number, opt-out date/time, source (STOP reply, link click, customer service request), and campaign identifier where available. Apply suppression across all brands or sender IDs you control, unless the customer has clearly opted in separately to a different brand.

Add preference management where practical: let people opt down (e.g., fewer messages) or choose categories (offers, delivery updates, events). If you use links to a preference centre, keep it mobile-friendly, minimal steps, and don’t require login.

Message content rules: identification, transparency, timing, frequency, and avoiding misleading copy

Identify yourself clearly. Put your brand name at the start of the SMS so recipients instantly know who’s contacting them (e.g., “Yerman:” or your trading name). If you use a short code or unfamiliar number, add a brief identifier in every message, not just the first one.

Be transparent about why they’re receiving it. Reference the consent context in plain English (“You opted in on our website”) and keep the purpose consistent with what was agreed. If the message is promotional, make that obvious—don’t disguise ads as “service updates” or “account alerts” unless it genuinely is one.

Include an easy opt-out every time. Add a simple instruction such as “Reply STOP to opt out”. Avoid complicated steps, links only, or requiring a login. If you use keywords (STOP/UNSUBSCRIBE), make sure they’re monitored and actioned promptly.

Respect timing expectations. Send at reasonable hours and avoid early mornings, late nights, and sensitive dates unless the customer expects it (e.g., delivery updates). If you operate across the UK, assume local time and avoid weekend blasts unless your audience has shown engagement then.

Control frequency and set expectations. Match your actual send rate to what you stated at sign-up (“up to 4 msgs/month”). If you need to increase frequency for a campaign, consider re-confirming preferences or offering a “pause” option.

Avoid misleading copy. Don’t imply urgency, scarcity, or “official” status unless it’s true. Be careful with “free”, “guaranteed”, “last chance”, and “winner” language—qualify offers clearly (key terms, eligibility, end date) and avoid bait-and-switch wording.

Data protection essentials for SMS: lawful basis, minimisation, retention, and security controls

UK SMS marketing must meet UK GDPR and PECR requirements, so your checklist should start with a clear lawful basis and evidence to match. For most promotional texts, this will be consent (freely given, specific, informed, unambiguous) or, in limited cases, the soft opt-in for existing customers where you collected details during a sale/negotiation, market similar products, and offered an opt-out at collection and in every message. Record what you relied on, when, how, and what wording was shown.

Apply data minimisation: only collect what you need to send and manage SMS campaigns (typically mobile number, consent status, timestamp, source, and suppression/opt-out status). Avoid collecting sensitive data and don’t use inferred attributes unless you can justify necessity and transparency. Keep segmentation proportionate and explain it in your privacy information.

Set retention rules that are practical and defensible. Keep active subscriber data only while you market to them, and retain suppression lists (opt-outs) for as long as needed to ensure you don’t text them again. Define time limits for inactive contacts and logs (e.g., consent records), and document deletion routines.

Implement security controls across people, process, and tech: role-based access to your SMS platform, MFA, strong passwords, audit logs, encrypted exports, secure API keys, and least-privilege permissions for agencies. Use Data Processing Agreements with providers, check UK/international transfer safeguards where relevant, and have an incident process to handle mis-sends, data leaks, and prompt suppression updates.

Record-keeping and audit readiness: what to log (consent proof, source, timestamps, wording)

Build an “evidence trail” for every number on your SMS list so you can quickly show how and why you’re messaging. Keep records in a central CRM or consent log that’s searchable by phone number, campaign, and date.

Set a retention schedule (e.g., keep consent and suppression evidence for as long as you market to the contact, plus a reasonable period after) and restrict access to logs to reduce accidental changes.

Working with an SMS platform: due diligence checklist (DPA, sub-processors, UK/EU hosting, features)

When comparing SMS platforms for UK marketing, use this checklist to quickly spot compliance-friendly options and reduce operational risk.

Comparison: UK SMS Marketing Compliance Checklist (What to Include)

Not all “compliance checklists” cover the same ground. Use the comparison below to quickly assess whether a provider’s checklist (or your internal one) is likely to meet common UK expectations around consent, transparency, and message handling.

Checklist area Basic checklist (often incomplete) Compliance-ready checklist (recommended) Why it matters
Legal basis & consent Mentions “get consent” without defining what qualifies Defines consent requirements, when “soft opt-in” may apply, and how to evidence it SMS marketing typically requires a clear lawful basis and provable permission.
Sign-up wording & transparency Generic “by signing up you agree…” copy Clear opt-in language including brand identity, purpose, and links to privacy info People should understand who will message them and why before opting in.
Opt-out (STOP) handling Includes “Reply STOP” but no process behind it STOP instructions in every message (or consistently), automated suppression, and confirmation handling Opt-outs must be easy and acted on promptly to reduce complaints and risk.
Sender identification Assumes sender ID alone is enough Ensures the message clearly identifies the organisation (especially if sender ID is ambiguous) Recipients should be able to recognise the sender to avoid confusion and complaints.
Data minimisation & retention No retention rules; keeps lists indefinitely Defines what data is collected, retention periods, and deletion/suppression rules Keeping unnecessary data increases compliance and security exposure.
Proof of consent & audit trail Relies on “we have a list” Stores timestamp, method, source, wording shown at capture, and any preference changes If challenged, you need to show how and when permission was obtained.
Third-party lists & lead gen Allows purchased/shared lists with minimal checks Strong controls: verifies consent wording, named third parties, and prohibits unclear list sources Many SMS complaints stem from unclear or invalid third-party consent.
Frequency & expectations No guidance on how often to message Sets frequency expectations at opt-in and enforces caps (e.g., per week/month) Over-messaging increases opt-outs and complaint rates.
Quiet hours & timing “Avoid late night” as a suggestion Defines sending windows and applies timezone-aware scheduling Timing affects customer experience and complaint likelihood.
Content rules (clarity & fairness) Focuses only on marketing copy Checks for clear offers, accurate claims, and avoids misleading urgency Clear, accurate messaging reduces complaints and improves deliverability.
Privacy notice & rights Links to a privacy policy somewhere on the site Ensures privacy info is accessible at sign-up and covers SMS processing and rights Recipients should know how their data is used and how to exercise rights.
Suppression lists Deletes opted-out numbers (losing the record) Maintains suppression lists to prevent re-messaging and accidental re-imports Suppression helps prevent repeat contact after opt-out.
Vendor & platform controls Assumes the SMS platform “handles compliance” Checks vendor features: consent fields, STOP automation, segmentation, logs, access controls Tooling gaps often cause compliance failures even with good intentions.
Security & access management Shared logins and broad access Role-based access, MFA, and change logs for list imports/exports Reduces risk of data misuse and accidental sends.
Complaints & incident process No documented process Defines how to handle complaints, investigate consent, and pause campaigns if needed Fast, consistent handling can limit escalation and reputational damage.

Quick “provider checklist” questions to ask

If you’re comparing tools or services, prioritise the checklist that is most specific about evidence, processes, and controls—those are typically the areas that determine whether SMS compliance is repeatable at scale.