# A2P SMS consent and opt-in compliance: a global guide to GDPR, TCPA, and PDPL

> A2P SMS is only lawful with real consent. This guide maps opt-in rules across GDPR, the US TCPA, and Gulf PDPL regimes, plus STOP handling and sender-ID duties.

- Canonical URL: https://www.broadnet.me/blog/a2p-sms-consent-optin-compliance-guide
- Language: en
- Last updated: 2026-10-10
- Publisher: BroadNet (https://www.broadnet.me)

- Published: 2026-08-03
- Author: BroadNet Regulatory Affairs

Yes — sending A2P SMS lawfully requires documented consent, and the standard depends on where the recipient is. The EU and UK demand freely given, specific, informed, and unambiguous opt-in under GDPR; the US requires prior express written consent for marketing texts under the TCPA; and Gulf regimes such as Saudi Arabia's and the UAE's PDPL add their own consent and sender-ID rules.

> Prefer the operational version? Our [compliance](https://www.broadnet.me/compliance) hub and the country [regulations](https://www.broadnet.me/regulations) guides translate these rules into the sender-ID, consent, and opt-out controls you actually configure. This article is the legal context behind them.

## Why consent is the foundation of A2P deliverability and legality

Consent is not a legal footnote bolted onto a campaign — it is what makes A2P SMS both lawful and deliverable. On the legal side, data-protection and telecom regulators can fine senders and, in some regimes, expose them to private lawsuits for messaging people who never opted in. On the technical side, operator SMS firewalls and sender-ID registries increasingly require proof of opt-in before traffic is allowed to flow, and complaint rates from unwanted messages get sender IDs suspended. Consent, in other words, protects your delivery rate as much as your legal position. See our [A2P SMS](https://www.broadnet.me/products/a2p-sms) product page for how registration and consent enforcement fit together.

## Express vs implied consent

Every regime distinguishes two kinds of permission. Express consent is an affirmative, recorded opt-in: the recipient deliberately agreed to receive messages of a described type — ticking an unchecked box, submitting a keyword, or confirming a double opt-in. Implied consent is inferred from a relationship, for example a customer who bought a product and gave their number for that transaction. Where implied consent is recognised at all it is narrow: it typically covers service and transactional messages to existing customers about similar products, and rarely stretches to open-ended marketing. When in doubt, marketing traffic needs express opt-in.

## European Union and United Kingdom: GDPR and ePrivacy

In the EU, the General Data Protection Regulation (Regulation (EU) 2016/679) sets the bar for consent: it must be freely given, specific, informed, and unambiguous, given by a clear affirmative action — pre-ticked boxes and bundled consents do not qualify. Marketing by SMS is further governed by the ePrivacy Directive, which generally requires prior consent for unsolicited electronic marketing, with a narrow 'soft opt-in' for a sender's own existing customers. Crucially, the controller must be able to demonstrate that consent was given, so records of consent are mandatory, not optional. The UK mirrors this through the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). Non-compliance is expensive: GDPR fines reach up to €20 million or 4% of total worldwide annual turnover, whichever is higher, under Article 83. For campaign design, see our [SMS marketing](https://www.broadnet.me/solutions/sms-marketing) solution.

## United States: the TCPA, CTIA guidelines, and 10DLC

US SMS marketing is governed primarily by the Telephone Consumer Protection Act (TCPA), enforced by the FCC. Sending marketing or promotional texts with an autodialer requires prior express written consent — a signed (including electronic) agreement that clearly authorises marketing messages, not merely a phone number handed over for another purpose; purely informational or transactional texts require prior express consent at a lower bar. The statute allows private damages of $500 per message, rising to $1,500 for willful violations, which is why US class actions are a real risk. Layered on top are the CTIA Messaging Principles and Best Practices — the carrier-backed industry code — and 10DLC registration, under which brands and campaigns must be registered through The Campaign Registry before A2P traffic runs on US networks, with opt-in details declared at registration. Mandatory STOP and HELP keyword handling is non-negotiable.

## The Gulf: Saudi Arabia's PDPL, the UAE regime, and regulator rules

The GCC has moved quickly, and its rules stack data-protection law on top of telecom-regulator messaging controls — a two-layer model that catches senders who prepare for only one. In Saudi Arabia, the Personal Data Protection Law (PDPL), issued by Royal Decree and administered by the Saudi Data and AI Authority (SDAIA), requires a lawful basis such as consent to process personal data and constrains direct marketing; separately, the Communications, Space and Technology Commission (CST) governs A2P sender IDs and messaging. In the UAE, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data sits alongside the TDRA, which regulates A2P sender-ID registration and, in its refreshed October 2025 Marketing SMS policy, requires senders to hold and produce opt-in proof logged in a Consent Management System. Across the Gulf the practical rule is the same: register your sender ID with the regulator and hold provable consent, because the operator firewall enforces both. Our country [regulations](https://www.broadnet.me/regulations) hub covers KSA, the UAE, and Egypt in detail.

## How the major regimes compare

The standards converge on the same principle — recorded opt-in and an easy exit — but differ in the detail. This table summarises the essentials; verify the current text of each regime, as messaging rules are updated frequently.

| Jurisdiction | Consent standard | Opt-out requirement | Notable rule |
|---|---|---|---|
| EU / UK | Freely given, specific, informed, unambiguous (GDPR); prior consent for marketing (ePrivacy / PECR) | Every marketing message must offer a simple, free opt-out | Controller must demonstrate consent; fines up to €20m / 4% of turnover |
| United States | Prior express written consent for marketing autodialed texts (TCPA) | STOP honoured immediately; HELP keyword supported | CTIA best practices plus 10DLC brand and campaign registration |
| Saudi Arabia | Lawful basis / consent to process personal data (PDPL, SDAIA) | Recipients can withdraw consent and opt out of marketing | CST governs A2P sender-ID registration |
| UAE | Consent under Federal Decree-Law 45 of 2021; opt-in proof for marketing (TDRA) | Opt-out honoured; consent logged in the Consent Management System | TDRA sender-ID registration; 'AD-' prefix for promotional IDs |

## How to stay compliant in practice

The regimes differ, but a single operational baseline satisfies the intersection of all of them. Build to the strictest rule that applies to your audience and the rest follows.

1. Capture consent explicitly and log it. Record what the person agreed to, when, how (the exact wording and channel), and from which number or identifier — a defensible consent record is your evidence if a regulator or plaintiff asks.
2. Honour STOP and unsubscribe immediately, across every channel. An opt-out from SMS should suppress the recipient everywhere you can reach them, and it must take effect at once rather than at the next campaign cycle.
3. Support STOP and HELP keywords and confirm them. Reply to STOP with a single final confirmation and to HELP with contact and programme information, in the recipient's expected language.
4. Respect quiet hours and local time. Send marketing only within acceptable hours for the recipient's timezone — many senders align to the 8 a.m.–9 p.m. window used in US telemarketing rules and to local norms elsewhere.
5. Separate transactional and promotional streams. Keep OTPs and service alerts on transactional sender IDs and consent, and marketing on its own opt-in and, where required as in the UAE, a promotional sender-ID prefix.
6. Keep sender IDs registered and current. Unregistered or mismatched IDs are blocked at the network layer regardless of consent, so treat registration and consent as one workflow.
7. Map your obligations per market, and consult qualified local counsel before launching regulated or cross-border campaigns.

Whatever tooling you use, the consent record is the artefact regulators and courts actually ask for. At a minimum it should capture the following:

| Consent record field | Why it matters |
|---|---|
| Timestamp and timezone | Proves when opt-in occurred and supports quiet-hours logic |
| Exact opt-in wording shown | Demonstrates the consent was specific and informed |
| Channel and source | Shows where and how permission was captured (web form, keyword, point of sale) |
| Message types agreed | Distinguishes transactional consent from marketing consent |
| Opt-out events | Records STOP and unsubscribe actions so suppression is auditable |

> BroadNet has operated regulated A2P messaging since 2003 across 200+ countries and 1,000+ operator connections, holds ISO 27001, ISO 9001, and ISO 22301 certifications, and maintains SOC 2. The platform enforces consent status, STOP suppression, and sender-ID registration on every outbound message — see [A2P SMS](https://www.broadnet.me/products/a2p-sms) and the [compliance](https://www.broadnet.me/compliance) hub.

## Frequently asked questions

### Do I need consent to send A2P SMS?

For marketing A2P SMS, yes — essentially everywhere. The EU and UK require freely given, specific, informed, and unambiguous opt-in; the US TCPA requires prior express written consent for marketing texts; and Gulf regimes require consent plus a registered sender ID. Purely transactional messages, such as an OTP the user requested, rely on a narrower implied or service basis, but the safe default is documented opt-in.

### Is SMS marketing GDPR compliant?

SMS marketing can be fully GDPR-compliant when consent is freely given, specific, informed, and unambiguous through a clear affirmative action, and when you can demonstrate that consent with records. You must also honour the ePrivacy rules for electronic marketing, offer a simple opt-out in every message, and process only the data you need. Pre-ticked boxes and bundled consent do not meet the standard.

### What are TCPA SMS consent rules?

The TCPA requires prior express written consent before sending marketing or promotional texts with an autodialer — a clear, signed (including electronic) agreement to receive marketing, not merely possession of a number. Informational or transactional texts need prior express consent at a lower bar. Senders must also honour STOP and HELP keywords and follow CTIA best practices and 10DLC registration to run A2P traffic on US networks.

### How do I handle STOP/opt-out correctly?

Treat opt-out as immediate and universal. Recognise STOP and its common variants, stop sending at once rather than at the next cycle, and reply with a single confirmation. Suppress the recipient across every channel you can link to them, not only the one they used, and keep an auditable record of the opt-out. Also support the HELP keyword with programme and contact information.

## References

- EU — General Data Protection Regulation (Regulation (EU) 2016/679) and data-protection law: [europa.eu](https://commission.europa.eu/law/law-topic/data-protection_en)
- United States — FCC, Telephone Consumer Protection Act (TCPA): [fcc.gov](https://www.fcc.gov/)
- Saudi Arabia — Personal Data Protection Law, Saudi Data and AI Authority (SDAIA): [sdaia.gov.sa](https://sdaia.gov.sa/en/)
- UAE — Telecommunications and Digital Government Regulatory Authority (TDRA): [tdra.gov.ae](https://www.tdra.gov.ae/)
- BroadNet — [compliance](https://www.broadnet.me/compliance) hub and country [regulations](https://www.broadnet.me/regulations) guides.