# SMS marketing in South Africa in 2026: POPIA section 69 consent, opt-outs and sender IDs > In South Africa, direct-marketing SMS falls under section 69 of POPIA: prior consent for non-customers (asked only once), the sender's identity and a free opt-out in every message, and fines of up to R10 million. One-time passcodes and account alerts are not direct marketing. Here is what applies and how to launch. - Canonical URL: https://www.broadnet.me/blog/south-africa-sms-marketing-popia-guide-2026 - Language: en - Last updated: 2026-09-28 - Publisher: BroadNet (https://www.broadnet.me) - Published: 2026-09-28 - Author: BroadNet Editorial Team Marketing SMS in South Africa is governed by section 69 of the Protection of Personal Information Act (POPIA, Act No. 4 of 2013): you need the recipient's prior consent unless they are an existing customer receiving offers for similar products, you may ask for that consent only once, and every message must identify the sender and give a free way to opt out. The Information Regulator enforces POPIA and can impose administrative fines of up to R10 million. Transactional messages, such as one-time passcodes and account alerts, are not direct marketing. BroadNet delivers over direct connections to Vodacom, MTN, Cell C and Telkom. > This guide summarises public rules as of 28 September 2026. It is general information, not legal advice — confirm your obligations with the regulator or your counsel before a campaign. ## Key takeaways - Telecoms regulator: ICASA, the Independent Communications Authority of South Africa. - Marketing law: POPIA section 69, enforced by the Information Regulator. - Consent: prior opt-in for non-customers, requested only once; limited exception for similar products to existing customers. - Every marketing SMS: identify the sender and include a free, working opt-out. - Penalties: administrative fines up to R10 million; serious offences can be prosecuted. - Operators: Vodacom, MTN, Cell C and Telkom. ## Who regulates SMS in South Africa? ICASA, the Independent Communications Authority of South Africa, regulates telecommunications: it licenses operators and sets numbering and consumer-protection rules. For SMS marketing the dominant instrument is POPIA, enforced by the Information Regulator. The Consumer Protection Act (CPA) adds opt-out and do-not-contact concepts alongside POPIA. Our [South Africa SMS regulations](https://www.broadnet.me/regulations/south-africa) page keeps the reference summary and sources. ## What does POPIA section 69 require for marketing SMS? Section 69 restricts direct marketing by electronic communication, which includes SMS. It sets four practical rules: 1. Marketing to a person who is not an existing customer generally requires their prior consent. 2. You may request that consent only once; a person who has refused cannot be asked again. 3. There is a limited exception for marketing similar products or services to existing customers, who must be able to opt out. 4. Every message must show the sender's identity and a way to opt out. Beyond marketing, POPIA requires a lawful basis for processing personal information under its eight conditions for lawful processing, purpose limitation and security safeguards. Data subjects have rights of access, correction, objection and deletion, and can object to direct marketing at any time. ## Is an OTP or account alert direct marketing? No. Transactional and service messages (one-time passcodes, banking alerts, delivery and account notifications) relate to an existing customer relationship and are not direct marketing. They still go out under a sender ID and still need a lawful basis for the data. Keep marketing and transactional traffic separate, with their own consent records, and do not fold offers into service messages. | Requirement | Direct marketing | Transactional / service (OTP, alerts) | |---|---|---| | POPIA section 69 opt-in consent | Yes | No | | Free opt-out | Yes | No | | Sender identified | Yes | Recommended | | Sender ID provisioned through the operators | Yes | Yes | | POPIA lawful basis for the data | Yes | Yes | ## Do you need to register a sender ID in South Africa? Commercial A2P messages are sent under a sender ID (alphanumeric or short code) provisioned through the mobile operators. The sender ID should identify your business, and content is mapped to the declared use case. Unregistered or grey-route traffic is liable to be filtered or blocked, so route through a licensed local channel and confirm each operator's current registration steps at onboarding. Our [sender-ID best practices](https://www.broadnet.me/answers/sms-sender-id-best-practices) apply here too. ## What are the penalties? The Information Regulator handles complaints and enforces POPIA. It can issue enforcement notices, impose administrative fines of up to R10 million, and refer serious offences for criminal prosecution, which can carry fines or imprisonment. ICASA and the operators act on numbering abuse and non-compliant traffic. Provable consent and fast opt-out handling are the practical safeguards. ## How do you write a compliant marketing SMS? - Put your brand in the sender ID and, if the ID is short or generic, in the first words of the text. - State the offer plainly and include a free opt-out instruction, for example "Reply STOP to opt out". - Send only to numbers with a recorded opt-in, or existing customers for similar products. - Reconcile your suppression list before every campaign. More on wording in [how to write SMS marketing messages](https://www.broadnet.me/blog/how-to-write-sms-marketing-messages), and on consent in [SMS opt-in best practices](https://www.broadnet.me/answers/sms-opt-in-best-practices). ## Launch checklist for South Africa 1. Separate marketing from transactional use cases and sender IDs. 2. Audit your marketing list: every non-customer number needs recorded prior consent. 3. Add sender identification and a free opt-out to every marketing template. 4. Provision sender IDs through the operators for Vodacom, MTN, Cell C and Telkom. 5. Test on each network and check the delivery receipts before the first campaign. ## How long does it take to go live with BroadNet? Request test access and an engineer replies within one business day with test credentials; the first test SMS usually goes out about five minutes after you have them. Integration typically takes 2–5 business days and sender-ID and compliance approval 3–10 business days, in parallel, so most markets reach production in 5–15 business days. See the [South Africa coverage page](https://www.broadnet.me/coverage/south-africa), [SMS pricing](https://www.broadnet.me/pricing/sms) and [SMS marketing](https://www.broadnet.me/solutions/sms-marketing). ## Frequently asked questions ### Do I need consent to send marketing SMS in South Africa? Yes, for anyone who is not an existing customer. POPIA section 69 requires prior consent, which may be requested only once. Existing customers can receive marketing for similar products if they can opt out. ### What must every marketing SMS include? The sender's identity and a free, working way to opt out. ### Who enforces POPIA? The Information Regulator. It handles complaints, issues enforcement notices and can impose administrative fines of up to R10 million. ### Are OTP messages covered by section 69? No. One-time passcodes, banking alerts and account notifications are not direct marketing, although POPIA's general data-processing rules still apply. ### Which operators do I need to reach? Vodacom, MTN, Cell C and Telkom. Register your sender ID with each network you need to reach. ### Who regulates telecoms in South Africa? ICASA, the Independent Communications Authority of South Africa, which licenses operators and sets numbering and consumer-protection rules. Reviewed 28 September 2026 against our [South Africa SMS regulations](https://www.broadnet.me/regulations/south-africa) reference and its official sources (ICASA and the Information Regulator). See our [editorial standards](https://www.broadnet.me/about/editorial-standards).