# A2P SMS regulations in Germany

> Germany runs one of the strictest marketing-SMS regimes in the EU. The Bundesnetzagentur (BNetzA) is the telecoms regulator, data protection follows the GDPR and the Federal Data Protection Act (BDSG), and unsolicited advertising is governed by the UWG (Act Against Unfair Competition). Marketing SMS requires prior express opt-in — double opt-in is the market standard — with a clear opt-out on every message; sender-ID spoofing is actively enforced.

- Canonical URL: https://www.broadnet.me/regulations/germany
- Language: en
- Last reviewed: 2026-09-29
- Publisher: BroadNet (https://www.broadnet.me)

## Key facts

- **Opt-in** — Prior express consent required (double opt-in standard)
- **UWG §7** — Governs unsolicited SMS advertising
- **€20M** — Maximum GDPR fine (or 4% of global turnover)

## Who regulates A2P SMS in Germany?

Germany's telecoms sector is supervised by the Bundesnetzagentur (BNetzA), the Federal Network Agency, which oversees numbering, network conduct and consumer protection. Data-protection oversight is decentralised across the federal and state (Länder) data-protection authorities under the GDPR and the Bundesdatenschutzgesetz (BDSG). Unsolicited advertising is policed under the UWG, largely through the courts and competitor/consumer-association action.

- Telecoms regulator: Bundesnetzagentur (BNetzA, bundesnetzagentur.de).
- Data protection: GDPR + Federal Data Protection Act (BDSG).
- Unsolicited advertising: UWG (Act Against Unfair Competition).
- Data enforcement is spread across federal and state authorities.

## The legal framework: GDPR, BDSG and UWG

Three instruments interlock. The GDPR and the BDSG govern the lawful basis, transparency and rights attaching to personal data. The UWG (Gesetz gegen den unlauteren Wettbewerb) treats unsolicited advertising by SMS as an "unreasonable nuisance" unless the recipient gave prior express consent (§7 UWG). Together they make consent the non-negotiable foundation of any German marketing-SMS programme.

- GDPR + BDSG: lawful basis and data-subject rights.
- UWG §7: unsolicited SMS advertising needs prior express consent.
- Unsolicited marketing is treated as an unreasonable nuisance.
- The three regimes apply together, not in the alternative.

## Consent: prior express opt-in and double opt-in

Germany requires prior express opt-in for marketing SMS — among the strictest positions in the EU. In practice the market standard is double opt-in: the recipient requests messages and then confirms via a second step, giving the sender auditable proof of consent. Pre-ticked boxes, bundled consent and "opt-out" models do not satisfy the UWG or GDPR. The burden of proving consent rests firmly on the sender.

- Prior express opt-in is mandatory for marketing SMS.
- Double opt-in is the practical market standard.
- Pre-ticked / bundled consent is not valid.
- The sender must be able to prove consent on request.

## Promotional vs. transactional messages

The consent rules target advertising. Transactional/service messages — one-time passwords, delivery and order notifications, appointment reminders and account alerts — are not advertising and fall outside the UWG marketing-consent requirement, provided they are genuinely service-related. Mixing promotional content into a service message forfeits the exemption and turns the whole message into regulated advertising.

- Marketing: prior express opt-in + opt-out required.
- Transactional/service (OTP, alerts): outside UWG marketing consent.
- Any promotional content in a service text removes the exemption.
- GDPR/BDSG still govern the data behind both categories.

## Sender IDs, opt-out and anti-spoofing

Germany uses alphanumeric sender IDs (and codes) rather than a mandatory government registry; the sender ID should identify the brand. Every marketing message must offer a simple, free opt-out and identify who is sending it. Sender-ID spoofing and smishing are actively tackled, and operators filter fraudulent or non-compliant traffic. Keep marketing and transactional flows — and their consent records — clearly separated.

- Alphanumeric sender IDs identifying the brand (no gov registry).
- Free, clear opt-out on every marketing message.
- Sender-ID spoofing enforcement; operators filter fraud.
- Separate marketing and transactional sender IDs/consent.

## Enforcement and penalties

Enforcement is multi-track. Data-protection authorities can impose GDPR fines — up to €20 million or 4% of global annual turnover for the most serious breaches. Under the UWG, competitors, consumer associations and qualified bodies can obtain injunctions and cease-and-desist orders (Abmahnungen) against unsolicited SMS advertising, with cost and contractual-penalty exposure. BNetzA acts on numbering and fraud abuse.

- GDPR fines up to €20M or 4% of global turnover.
- UWG: injunctions and cease-and-desist (Abmahnung) exposure.
- Competitors and consumer bodies can enforce directly.
- Confirm current figures — GDPR ceilings are EU-wide.

## Germany rules: promotional vs. transactional SMS

|  | Promotional / marketing | Transactional / service (OTP, alerts) |
|---|---|---|
| Prior express opt-in required | Yes | No |
| Double opt-in expected in practice | Yes | No |
| Free opt-out required | Yes | No |
| GDPR / BDSG lawful basis for data | Yes | Yes |
| Subject to UWG unsolicited-advertising rules | Yes | No |
| Sender identifies the brand | Yes | Recommended |

## Frequently asked questions

### How strict is consent for marketing SMS in Germany?

Very. Germany requires prior express opt-in for marketing SMS — one of the strictest positions in the EU — and in practice the market standard is double opt-in, where the recipient confirms their request in a second step. Pre-ticked boxes, bundled consent and opt-out models do not qualify under the UWG or GDPR, and the sender must be able to prove consent.

### What is double opt-in and do I need it?

Double opt-in means the recipient first requests messages and then confirms via a second action (for example, replying to or clicking a confirmation), giving the sender auditable proof of genuine consent. While the law requires "express" consent rather than double opt-in by name, double opt-in is the established German standard for demonstrably valid consent and is strongly recommended.

### Do transactional and OTP messages need consent?

Generally no. One-time passwords, delivery and order notifications, appointment reminders and account alerts are service messages, not advertising, so they fall outside the UWG marketing-consent requirement — provided they are genuinely service-related. Adding promotional content to a service message removes that exemption. The GDPR still governs the underlying data.

### Who enforces the rules and what are the penalties?

Data-protection authorities enforce the GDPR and BDSG, with fines up to €20 million or 4% of global annual turnover for the most serious breaches. Under the UWG, competitors and consumer associations can obtain injunctions and cease-and-desist orders (Abmahnungen) against unsolicited SMS advertising. The Bundesnetzagentur acts on numbering and fraud abuse.

### Is there a sender-ID registry in Germany?

No mandatory government sender-ID registry. Germany uses alphanumeric sender IDs (and codes) that should identify the brand, and the framework is consent-and-conduct based. Sender-ID spoofing and smishing are actively tackled, and operators filter fraudulent or non-compliant traffic. Use a brand sender ID and keep marketing and transactional flows separate.

### What is the UWG and how does it affect SMS?

The UWG (Gesetz gegen den unlauteren Wettbewerb — Act Against Unfair Competition) treats unsolicited advertising by SMS as an unreasonable nuisance unless the recipient gave prior express consent (§7 UWG). It is enforced not only by regulators but directly by competitors and consumer associations through injunctions and cease-and-desist actions, making compliance commercially as well as legally important.

## Related

- [Germany coverage](https://www.broadnet.me/coverage/germany)
- [All regulations](https://www.broadnet.me/regulations)

## Technical facts for Germany

Network codes, message lengths and sender-ID rules in one table. Segment lengths are the GSM standard values (3GPP TS 23.038).

| Technical facts | |
|---|---|
| Mobile country code (MCC) | 262 |
| Dialling code | +49 |
| Operators (MCC-MNC) | Telekom Deutschland · 262-01; Vodafone Germany · 262-02; Telefónica O2 · 262-07 |
| SMS length, GSM-7 (Latin alphabet) | 160 characters in a single SMS; 153 per part when concatenated |
| SMS length, UCS-2 (Arabic, Cyrillic and other scripts) | 70 characters in a single SMS; 67 per part when concatenated |
| Regulator | BNetzA (Bundesnetzagentur) |
| Sender-ID rules | Alphanumeric sender IDs allowed but numeric preferred for transactional. GDPR opt-in mandatory for marketing. |
| Sender-ID lead time | Free-form (numeric preferred) |

## Sources

- [BNetzA — Bundesnetzagentur](https://www.bundesnetzagentur.de/)