n the UK, marketing texts need the recipient's prior consent under the Privacy and Electronic Communications Regulations 2003 (PECR), or the "soft opt-in" for existing customers who were offered an easy opt-out, and every message must identify the sender and offer a simple, free opt-out such as reply STOP. The Information Commissioner's Office (ICO) enforces PECR and UK GDPR; Ofcom regulates networks and tackles scam texts. There is no government sender-ID registry: brands protect their alphanumeric IDs through the MEF SMS Sender ID Protection Registry. BroadNet delivers direct to EE, Vodafone UK, O2 and Three.
This guide summarises public rules as of 28 September 2026. It is general information, not legal advice — confirm your obligations with the regulator or your counsel before a campaign.
Key takeaways
- Two regulators: Ofcom for networks, numbering and scam texts; the ICO for marketing and data protection.
- PECR requires prior consent for marketing texts; a limited soft opt-in covers existing customers.
- Consent must be freely given, specific, informed and provable; pre-ticked boxes do not count.
- Every marketing text identifies the sender and offers a free opt-out, honoured promptly.
- No government sender-ID registry; the MEF SMS Sender ID Protection Registry blocks impersonation of protected brand IDs.
- The Data (Use and Access) Act 2025 amended PECR; its data-protection provisions were phased in between June 2025 and June 2026.
Who regulates SMS marketing in the UK?
Oversight is split. Ofcom is the communications regulator, responsible for networks, numbering and tackling scam texts. The ICO enforces the marketing and data-protection rules that apply to SMS: PECR, the UK GDPR and the Data Protection Act 2018. The framework is consent-and-conduct based rather than registry-based. Our UK SMS regulations page keeps the reference summary and sources.
What does PECR require for marketing texts?
PECR requires prior consent before you send a marketing text. Consent must be freely given, specific, informed and provable: pre-ticked boxes and consent bundled into terms and conditions do not qualify. The UK GDPR and the Data Protection Act 2018 govern the personal data behind the campaign, including your lawful basis, transparency and data-subject rights.
What is the soft opt-in?
The soft opt-in lets you text marketing about similar products or services to an existing customer whose number you collected during a sale or negotiation, provided you offered an easy way to opt out when you collected the number and in every message since. It does not cover bought-in lists or prospects. The Data (Use and Access) Act 2025 also introduced a soft opt-in for charities for people who support or express an interest in their work, unless they object.
Do transactional texts need consent?
No. Service messages such as one-time passcodes, delivery updates, appointment reminders and account alerts are not direct marketing and fall outside the PECR consent rule, as long as they are genuinely service-related. Adding a promotion to a service text removes the exemption. The UK GDPR still applies to the data behind both.
| Requirement | Promotional / marketing | Transactional / service (OTP, alerts) |
|---|---|---|
| PECR consent or soft opt-in | Yes | No |
| Free opt-out (for example reply STOP) | Yes | No |
| Sender identified | Yes | Recommended |
| UK GDPR lawful basis for the data | Yes | Yes |
| Government sender-ID registration | No | No |
Do you need to register a sender ID in the UK?
No government registration is required. UK senders use alphanumeric sender IDs (up to 11 characters) and long or short codes; the ID should be consistent and identify the brand. To fight spoofing and smishing, the industry runs the MEF SMS Sender ID Protection Registry: a protected list of legitimate brand sender IDs that participating operators block impersonators from using, backed by an operator code of conduct. Registering your brand ID there is strongly recommended. Read what sender-ID spoofing is and our smishing defence guide.
How fast must you act on STOP?
Opt-out requests must be honoured promptly, after which no further marketing may go to that number. Keep a suppression list, reconcile it before every campaign and make the opt-out free, typically by replying STOP. Recipients can report unwanted texts to the ICO, and unsolicited marketing texts are a frequent enforcement target. See how to handle SMS opt-outs.
What are the penalties?
The ICO enforces PECR and the UK GDPR and has repeatedly fined organisations for sending marketing texts without valid consent. The Data (Use and Access) Act 2025 amended PECR, and the ICO notes that its PECR guidance is under review as a result, so check the ICO's current guidance for penalty levels rather than older figures. Ofcom and the operators block scam and spoofed traffic at network level.
Launch checklist for the UK
- Separate marketing and service messages, and do not add offers to service texts.
- Check every marketing number has provable consent or qualifies for the soft opt-in.
- Identify the sender and include a free STOP opt-out in every marketing text.
- Choose a consistent alphanumeric sender ID and register it in the MEF SMS Sender ID Protection Registry.
- Reconcile the suppression list before each send.
- Test on EE, Vodafone UK, O2 and Three and review the delivery receipts.
How long does it take to start sending with BroadNet?
Request test access and an engineer replies within one business day with test credentials; the first test SMS usually goes out about five minutes after you have them. Integration typically takes 2–5 business days and sender-ID and compliance approval 3–10 business days, in parallel, so most markets reach production in 5–15 business days. The UK has no formal sender-ID registration, so the standard window applies. Because many UK numbers are ported, BroadNet runs a per-message HLR lookup to route each text to the subscriber's current network; read what mobile number portability is. See the UK coverage page and SMS pricing.
Frequently asked questions
Do I need consent to send marketing texts in the UK?
Yes. PECR requires prior consent that is freely given, specific, informed and provable. The soft opt-in is a limited exception for existing customers and similar products.
What is the soft opt-in for SMS?
It lets you text marketing about similar products to existing customers whose number you collected during a sale or negotiation, if you offered an easy opt-out then and in every message.
Is there a sender-ID registration requirement in the UK?
There is no mandatory government registry. Brands are advised to protect their alphanumeric IDs through the MEF SMS Sender ID Protection Registry, which operators use to block impersonators.
Do OTP and delivery texts need marketing consent?
No. Genuine service messages fall outside PECR's marketing consent rule, but the UK GDPR still applies to the data.
Who enforces SMS marketing rules in the UK?
The ICO enforces PECR and the UK GDPR. Ofcom regulates networks and numbering and works with operators against scam texts.
Did the Data (Use and Access) Act 2025 change SMS marketing rules?
Yes, it amended PECR, including a new soft opt-in for charities. The ICO says its data-protection provisions were phased in between June 2025 and June 2026.
Reviewed 28 September 2026 against our UK SMS regulations reference and the ICO's guidance on PECR and the Data (Use and Access) Act 2025 (ico.org.uk). See our editorial standards.