UK SMS Compliance in 2026: The Landscape
The UK SMS regulatory landscape has evolved significantly since Brexit. Post-2024, the UK operates under its own data protection framework (UK GDPR and UK Data Protection Act 2018), separate from EU GDPR.
Key differences for SMS marketers:
- •UK ICO (not EU DPA) enforces compliance
- •UK GDPR follows EU GDPR closely but with UK-specific nuances
- •PECR (Privacy and Electronic Communications Regulations 2003) remains in force
- •The ICO has increased enforcement activity since 2023 — fines are real
What Hasn't Changed
The core principles of SMS marketing compliance remain the same:
- 1.Consent first — Explicit opt-in for marketing SMS (with soft opt-in exception for existing customers)
- 2.Opt-out must be provided — Every marketing message needs an opt-out
- 3.Sender ID must be honest — Don't impersonate other brands or use misleading identifiers
- 4.Process opt-outs promptly — ICO expects removal within 28 days
- 5.Data minimisation — Only collect what you need
- •Multiple fines of £150,000–£500,000 for PECR SMS violations
- •Focus on "purchased lists" — providers who sold numbers without consent were also fined
- •Increased attention to healthcare and financial services SMS
- •New guidance on AI-generated SMS content and personalisation
- •PECR applies in full — explicit consent required for marketing
- •Soft opt-in only for your own existing customers (not leads or third-party contacts)
- •Opt-out must be in every message
- •PECR applies to individual business email addresses (e.g., [email protected])
- •For corporate emails/numbers (e.g., [email protected]), the threshold is lower
- •ICO guidance: still need to provide opt-out and avoid clear nuisance messaging
- •UK GDPR still applies to personal data even in B2B contexts
- •Cannot be spoofed by fraudsters
- •Receive priority routing on participating networks
- •Increase consumer trust in your messages
- •Processing purposes and duration
- •Types of data processed (phone numbers, message content)
- •Security measures in place
- •Sub-processor chain
- •Your right to audit
- •[ ] Review all SMS lists for valid consent evidence
- •[ ] Ensure consent was obtained with clear SMS-specific opt-in language
- •[ ] Set up automated opt-out processing (STOP keyword handling)
- •[ ] Register with ICO as a data controller (if not already)
- •[ ] Sign a DPA with your SMS provider
- •[ ] Register your sender ID with UK networks
- •[ ] Implement retention policies — delete lapsed consent after 2–3 years
- •[ ] Review T&Cs to ensure they don't bundle SMS consent with purchase acceptance
- •[ ] Train staff who handle customer data
ICO Enforcement Trends (2024–2025)
The ICO has stepped up SMS enforcement. Recent notable actions:
Key lesson: The ICO is actively monitoring and does investigate complaints. Even one valid complaint can trigger an audit.
B2C vs B2B SMS Rules
B2C (Business to Consumer)
B2B (Business to Business)
Practical advice: Treat B2B contacts with the same respect as B2C. Even if the technical bar is lower, spam complaints trigger ICO attention regardless.
Sender ID Registration
Ofcom's voluntary scheme for SMS sender ID registration launched in 2023. While not yet mandatory, registered sender IDs:
How to register: Work with your SMS provider. BulkSMSRates facilitates sender ID registration with UK networks for eligible customers.
The Data Processing Agreement (DPA) Requirement
Under UK GDPR Article 28, you must have a written DPA with any data processor who handles personal data on your behalf — including your SMS provider.
BulkSMSRates provides a standard DPA on request. This covers:
Without a DPA, you are technically non-compliant under UK GDPR — even if you have consent for the SMS itself.
Action Checklist for 2026
Getting Help
BulkSMSRates offers compliance consultation for customers who need help navigating UK SMS regulations. Our team can review your consent flow, message templates, and data handling practices. Contact us at [email protected].