# A2P SMS regulations in South Africa

> A2P SMS in South Africa is regulated by ICASA (the Independent Communications Authority of South Africa), with data protection and direct-marketing rules set by POPIA (the Protection of Personal Information Act) and enforced by the Information Regulator. Direct-marketing SMS requires opt-in consent (POPIA section 69) and a working opt-out, and every message must identify the sender.

- Canonical URL: https://www.broadnet.me/regulations/south-africa
- Language: en
- Last reviewed: 2026-10-02
- Publisher: BroadNet (https://www.broadnet.me)

## Key facts

- **POPIA §69** — Governs electronic direct marketing incl. SMS
- **R10M** — Maximum POPIA administrative fine
- **4** — Main operators (Vodacom, MTN, Cell C, Telkom)

## Who regulates A2P SMS in South Africa?

Telecommunications in South Africa are regulated by ICASA, the Independent Communications Authority of South Africa, which licenses operators and sets numbering and consumer-protection rules. The dominant instrument for SMS marketing is POPIA — the Protection of Personal Information Act (Act No. 4 of 2013) — enforced by the Information Regulator. A2P traffic is delivered through the mobile operators.

- Telecoms regulator: ICASA (icasa.org.za).
- Data / direct-marketing law: POPIA (Act No. 4 of 2013).
- Enforcer: the Information Regulator (inforegulator.org.za).
- Traffic delivered through the licensed operators.

## POPIA and section 69: consent for direct marketing

POPIA governs the processing of personal information, and section 69 specifically restricts direct marketing by electronic communication (including SMS). Direct marketing to a person who is not an existing customer generally requires their prior consent, which can be requested only once, and the message must show the sender's identity and a means to opt out. There is a limited exception for marketing similar products to existing customers.

- POPIA §69 restricts electronic direct marketing incl. SMS.
- Prior opt-in consent generally required (consent asked once).
- Message must show sender identity + opt-out.
- Limited existing-customer / similar-products exception.

## Sender identification and opt-out

Every direct-marketing SMS must identify the sender and provide a working, free opt-out; South Africa also has the wider Consumer Protection Act (CPA) opt-out/"do-not-contact" concepts alongside POPIA. Commercial traffic is sent under a sender ID (alphanumeric or short code) through the operators; the sender ID should identify the business, and grey-route traffic is liable to be filtered or blocked. The WASPA Code of Conduct sets no sender-ID pre-registration, but WASPA members must give WASPA their alphanumeric IDs on request, and under section 16.8 they may not send direct marketing on Sundays or public holidays, on Saturdays before 09:00 or after 13:00, or on other days between 20:00 and 08:00.

- Identify the sender in every marketing message.
- Free, working opt-out required (honour promptly).
- CPA opt-out concepts apply alongside POPIA.
- WASPA Code 16.8: no direct marketing on Sundays or public holidays, Saturdays outside 09:00–13:00, or 20:00–08:00 on other days.

## Promotional vs. transactional messages

Direct-marketing SMS is subject to POPIA section 69 consent and opt-out, while transactional/service messages — OTPs, banking alerts, delivery and account notifications — relate to an existing customer relationship and are not direct marketing. Both are sent under a sender ID that identifies the business; keep promotional and transactional flows separate with their own consent records, and don't fold marketing into service messages.

- Direct marketing: POPIA §69 consent + opt-out apply.
- Transactional/service (OTP, alerts): not direct marketing.
- Both sent under a sender ID that identifies the business.
- Keep marketing and transactional traffic separate.

## Consent, data-subject rights and the Information Regulator

Beyond marketing, POPIA requires a lawful basis to process personal information, with the eight conditions for lawful processing, purpose limitation, security safeguards and data-subject rights (access, correction, objection and deletion). Data subjects may object to direct marketing at any time. The Information Regulator handles complaints, issues enforcement notices and can pursue administrative fines and, for serious offences, criminal penalties.

- POPIA lawful basis + eight processing conditions.
- Data-subject rights: access, correction, objection, deletion.
- Object to direct marketing at any time.
- Information Regulator handles complaints and enforcement.

## Enforcement, penalties and operator landscape

The Information Regulator enforces POPIA and can issue enforcement notices, impose administrative fines up to R10 million, and refer serious offences for criminal prosecution (fines and/or imprisonment). ICASA and the operators act on numbering abuse and non-compliant traffic. South Africa's main operators are Vodacom, MTN, Cell C and Telkom; the WASPA Code sets no sender-ID pre-registration, but operators can apply their own checks, so confirm current requirements at onboarding.

- POPIA administrative fines up to R10 million.
- Serious offences: criminal prosecution (fines/imprisonment).
- Main operators: Vodacom, MTN, Cell C, Telkom.
- Confirm current operator requirements at onboarding.

## South Africa rules: direct marketing vs. transactional SMS

|  | Direct marketing | Transactional / service (OTP, alerts) |
|---|---|---|
| POPIA §69 consent (opt-in) required | Yes | No |
| Free opt-out required | Yes | No |
| Sender must be identified | Yes | Recommended |
| Sender ID identifies the business | Yes | Yes |
| POPIA lawful basis for data | Yes | Yes |
| Existing customer relationship expected | No | Yes |

## Frequently asked questions

### Do I need consent to send marketing SMS in South Africa?

Yes. POPIA section 69 restricts direct marketing by electronic communication, including SMS. Marketing to a person who is not an existing customer generally requires their prior consent — which may be requested only once — and every message must show the sender's identity and a way to opt out. There is a limited exception for marketing similar products to existing customers. Transactional messages such as OTPs are not direct marketing.

### What is POPIA and who enforces it?

POPIA is the Protection of Personal Information Act (Act No. 4 of 2013), South Africa's data-protection law, enforced by the Information Regulator. It governs the lawful processing of personal information, sets eight processing conditions, gives data subjects rights including objection to direct marketing, and specifically restricts electronic direct marketing under section 69.

### What's the difference between promotional and transactional SMS?

Direct-marketing SMS is subject to POPIA section 69 consent and opt-out, while transactional/service messages — OTPs, banking alerts, delivery and account notifications — relate to an existing customer relationship and are not direct marketing. Both are sent under a sender ID that identifies the business; keep the two flows separate with their own consent records, and don't fold marketing into service messages.

### What are the penalties for non-compliant SMS marketing?

The Information Regulator enforces POPIA and can issue enforcement notices, impose administrative fines of up to R10 million, and refer serious offences for criminal prosecution, which can carry fines and/or imprisonment. ICASA and the operators act on numbering abuse and non-compliant traffic. Keeping provable consent and honouring opt-outs is the practical safeguard.

### Do I need to register a sender ID in South Africa?

The WASPA Code of Conduct sets no sender-ID pre-registration. Commercial A2P messages are sent under a sender ID (alphanumeric or short code) that should identify your business, WASPA members must give WASPA their alphanumeric IDs on request, and grey-route traffic is liable to be filtered or blocked. Operators can apply their own checks, which BroadNet confirms during onboarding.

### Which operators do I need to reach?

South Africa's main mobile operators are Vodacom, MTN, Cell C and Telkom. To reach the full subscriber base you route through licensed local channels to each network rather than grey routes. A provider with direct connections handles compliant termination and confirms each operator's current sender-ID requirements.

## Related

- [South Africa coverage](https://www.broadnet.me/coverage/south-africa)
- [All regulations](https://www.broadnet.me/regulations)

## Technical facts for South Africa

Network codes, message lengths and sender-ID rules in one table. Segment lengths are the GSM standard values (3GPP TS 23.038).

| Technical facts | |
|---|---|
| Mobile country code (MCC) | 655 |
| Dialling code | +27 |
| Operators (MCC-MNC) | Vodacom · 655-01; MTN South Africa · 655-10; Cell C · 655-07; Telkom Mobile · 655-02 |
| SMS length, GSM-7 (Latin alphabet) | 160 characters in a single SMS; 153 per part when concatenated |
| SMS length, UCS-2 (Arabic, Cyrillic and other scripts) | 70 characters in a single SMS; 67 per part when concatenated |
| Regulator | ICASA (Independent Communications Authority of South Africa) |
| Sender-ID rules | The WASPA Code of Conduct sets no sender-ID pre-registration; alphanumeric sender IDs must identify the business, and WASPA members must give WASPA their alphanumeric IDs on request. |
| Sender-ID lead time | Free-form (no pre-registration) |

## Sources

- [ICASA — Independent Communications Authority of South Africa](https://www.icasa.org.za/)
- [Information Regulator — Information Regulator (South Africa)](https://inforegulator.org.za/)
- [WASPA Code of Conduct — WASPA Code of Conduct 17.15 (direct-marketing hours, section 16.8)](https://waspa.org.za/wp-content/uploads/2026/09/WASPA-Code-of-Conduct-17.15-clean.pdf)