# A2P SMS regulations in the United Kingdom

> A2P SMS in the UK sits under two regulators: Ofcom for telecoms and the ICO (Information Commissioner's Office) for data protection. Marketing texts are governed by PECR (the Privacy and Electronic Communications Regulations 2003) and UK GDPR / the Data Protection Act 2018, which require opt-in consent and a clear opt-out. There is no government sender-ID registry; alphanumeric sender IDs are used, and the industry combats spoofing through the MEF SMS Sender ID Protection Registry and an operator code of conduct.

- Canonical URL: https://www.broadnet.me/regulations/united-kingdom
- Language: en
- Last reviewed: 2026-10-02
- Publisher: BroadNet (https://www.broadnet.me)

## Key facts

- **PECR** — Privacy and Electronic Communications Regulations 2003
- **2** — Regulators — Ofcom (telecoms) and the ICO (data)
- **£500k** — Indicative maximum PECR monetary penalty

## Who regulates A2P SMS in the UK?

The UK splits oversight between two bodies. Ofcom is the communications regulator, responsible for the networks, numbering and tackling scam texts. The Information Commissioner's Office (ICO) enforces the marketing and data-protection rules that apply to SMS. There is no single government A2P registration portal — the framework is consent-and-conduct based rather than registry-based.

- Telecoms regulator: Ofcom (ofcom.org.uk).
- Data / marketing regulator: ICO (ico.org.uk).
- No government sender-ID registry — rules are consent-based.
- Operators enforce industry anti-spoofing measures at network level.

## PECR and UK GDPR: the legal framework

Direct-marketing SMS is governed primarily by the Privacy and Electronic Communications Regulations 2003 (PECR), which sit alongside the UK GDPR and the Data Protection Act 2018. PECR requires prior consent for marketing texts, with a limited "soft opt-in" for existing customers where an easy opt-out was offered at the point of data collection. UK GDPR governs the lawful basis, transparency and rights attaching to the personal data behind every campaign.

- PECR 2003 governs electronic direct marketing (incl. SMS).
- UK GDPR + Data Protection Act 2018 govern the underlying data.
- Marketing generally needs prior opt-in consent.
- A limited "soft opt-in" can apply to existing customers.

## Sender IDs and anti-spoofing

The UK uses alphanumeric sender IDs and long/short codes rather than a mandatory government registry. To fight sender-ID spoofing and smishing, the industry runs the MEF SMS Sender ID Protection Registry — a protected list of legitimate brand sender IDs that operators block impersonators from using — alongside an operator code of conduct. Registering a brand sender ID in the protection registry helps prevent fraudulent misuse. Ofcom's rules finalised in July 2026 add a further layer: from 15 July 2027, operators and aggregators must carry out know-your-customer checks on business senders and confirm that each sender ID matches the business and its declared purpose.

- Alphanumeric sender IDs supported (no government registry).
- MEF SMS Sender ID Protection Registry blocks spoofed brand IDs.
- From 15 July 2027, providers must verify business senders and their sender IDs (Ofcom).
- Register your brand sender ID to guard against impersonation.

## Promotional vs. transactional messages

PECR bites on direct marketing — promotional, sales and campaign texts — which require consent and an opt-out. Transactional/service messages such as one-time passwords, delivery updates, appointment reminders and account alerts are not direct marketing and fall outside the PECR consent rule, provided they are genuinely service-related and not used to slip in promotional content.

- Marketing: PECR consent + easy opt-out required.
- Transactional/service (OTP, alerts): outside PECR marketing consent.
- Folding promotion into a service text removes the exemption.
- UK GDPR still applies to the data behind both categories.

## Consent, opt-out and unsolicited messages

Marketing consent must be freely given, specific, informed and provable — pre-ticked boxes and bundled consent do not qualify. Every marketing message must identify the sender and offer a simple, free opt-out (typically reply STOP), which must be honoured promptly. Recipients can complain to the ICO, and unsolicited marketing texts are a frequent enforcement target.

- Consent must be specific, informed and recorded.
- Identify the sender in every marketing message.
- Free opt-out (reply STOP), honoured promptly.
- Recipients report unsolicited texts to the ICO.

## Enforcement and penalties

The ICO enforces PECR and UK GDPR and has repeatedly fined organisations for sending unsolicited marketing texts without valid consent; PECR monetary penalties can reach up to £500,000, while serious UK GDPR breaches carry much higher maximums. Ofcom and the operators tackle scam and spoofed traffic at network level. Keep auditable consent records and honour opt-outs to stay clear of enforcement.

- ICO fines for unsolicited marketing under PECR (up to £500,000).
- Serious UK GDPR breaches carry far higher maximum fines.
- Ofcom + operators block scam/spoofed traffic.
- Confirm current penalty levels — figures are periodically updated.

## UK rules: promotional vs. transactional SMS

|  | Promotional / marketing | Transactional / service (OTP, alerts) |
|---|---|---|
| PECR consent (opt-in) required | Yes | No |
| Free opt-out (STOP) required | Yes | No |
| Sender must be identified | Yes | Recommended |
| UK GDPR lawful basis for data | Yes | Yes |
| Government sender-ID registry required | No | No |
| Sender-ID spoofing protection available | Yes | Yes |

## Frequently asked questions

### Do I need consent to send marketing SMS in the UK?

Yes. Under PECR (the Privacy and Electronic Communications Regulations 2003), marketing texts require the recipient's prior consent, which must be freely given, specific, informed and provable. A limited "soft opt-in" can apply where you are marketing similar products to an existing customer who was offered an easy opt-out when you collected their number. Transactional messages such as OTPs are not marketing and fall outside this rule.

### Is there a sender-ID registration requirement in the UK?

There is no mandatory government sender-ID registry. The UK uses alphanumeric sender IDs and codes, and the framework is consent-and-conduct based. To protect brand sender IDs from spoofing and smishing, the industry runs the MEF SMS Sender ID Protection Registry, which operators use to block impersonators. Registering your brand sender ID there is strongly recommended. From 15 July 2027, Ofcom's new rules also require operators and aggregators to verify business senders and their sender IDs.

### Which regulators oversee A2P SMS in the UK?

Two. Ofcom is the communications regulator responsible for networks, numbering and tackling scam texts, and the Information Commissioner's Office (ICO) enforces the marketing and data-protection rules under PECR and UK GDPR. The two operate together — Ofcom on the network/fraud side, the ICO on consent and data.

### What data protection law applies to SMS campaigns?

The UK GDPR and the Data Protection Act 2018 govern the personal data behind campaigns, sitting alongside PECR. You need a lawful basis to process mobile numbers, must be transparent about how data is used, and must honour data-subject rights including objection to direct marketing. The ICO enforces both regimes.

### How do recipients opt out, and how fast must I act?

Every marketing message must offer a simple, free opt-out — typically replying STOP — and identify the sender. Opt-out requests must be honoured promptly, after which no further marketing may be sent to that number. Maintain a suppression list and reconcile it before each campaign. Recipients can also report unwanted texts to the ICO.

### What are the penalties for sending unsolicited marketing texts?

The ICO enforces PECR and has repeatedly fined organisations for sending marketing texts without valid consent; PECR monetary penalties can reach up to £500,000, while serious UK GDPR breaches carry substantially higher maximums. Confirm current figures, as penalty ceilings are periodically updated. Keeping provable consent and honouring opt-outs is the practical safeguard.

## Related

- [United Kingdom coverage](https://www.broadnet.me/coverage/united-kingdom)
- [All regulations](https://www.broadnet.me/regulations)

## Technical facts for the United Kingdom

Network codes, message lengths and sender-ID rules in one table. Segment lengths are the GSM standard values (3GPP TS 23.038).

| Technical facts | |
|---|---|
| Mobile country code (MCC) | 234 |
| Dialling code | +44 |
| Operators (MCC-MNC) | EE (BT) · 234-30; Vodafone UK · 234-15; O2 (VMO2) · 234-10; Three UK · 234-20 |
| SMS length, GSM-7 (Latin alphabet) | 160 characters in a single SMS; 153 per part when concatenated |
| SMS length, UCS-2 (Arabic, Cyrillic and other scripts) | 70 characters in a single SMS; 67 per part when concatenated |
| Regulator | ICO + Ofcom (Information Commissioner's Office (ICO) and Office of Communications (Ofcom)) |
| Sender-ID rules | Alphanumeric sender IDs do not require pre-registration but must be consistent and brand-identifiable. Under Ofcom rules finalised in July 2026, providers must check business senders and their sender IDs from 15 July 2027. |
| Sender-ID lead time | Free-form (no formal registration) |

## How to register a sender ID in the United Kingdom

What to prepare, who approves it and how long it takes. Send us the documents below and BroadNet coordinates the registration with the operators, the regulator or the registry, as the market requires.

- Who approves: No central registry and no regulator approval. The operator or aggregator that carries your traffic checks the sender ID against your business; Ofcom's new rules make these checks mandatory for business (A2P) messages from 15 July 2027.
- Typical lead time: Free-form (no formal registration)

### Document checklist

- [ ] Registered company name and trading name, as shown on the Companies House register
- [ ] Registered office or trading address
- [ ] A description of your business and the purposes you will send messages for
- [ ] Your website and existing business telephone numbers
- [ ] Contact details for a senior person who authorises the messages
- [ ] Evidence that you are authorised to use the brand name in the sender ID

### Steps

1. Choose the sender ID: alphanumeric, matching a business or brand name you are authorised to use. Avoid generic IDs and the names of other organisations, especially banks, delivery companies and public bodies.
2. Send BroadNet your business details and the purposes you will send messages for. This is the know-your-customer (KYC) information that Ofcom's guidance expects providers to collect and check against public records such as Companies House.
3. BroadNet checks that the sender ID matches your business and your stated purpose, and against the terminating operators' policies on protected brand IDs and generic IDs, then enables the ID on its UK routes.
4. Send only for the purpose you declared. Tell BroadNet before you use the ID for anything new: providers must not allow a sender ID to be used for a purpose that is inconsistent with the KYC record.

### Common reasons for rejection

- A brand name the sender is not authorised to use
- A sender ID that does not match the business or the purpose recorded at onboarding
- Generic IDs that an operator prohibits because they could mislead recipients about who the sender is
- Incomplete or inaccurate business information, such as a wrong address

### Official sources

- [Ofcom — Ofcom](https://www.ofcom.org.uk/)
- [ICO — Information Commissioner's Office](https://ico.org.uk/)
- [Ofcom scam-text rules — Ofcom: New rules to thwart text message scammers (statement, 15 July 2026)](https://www.ofcom.org.uk/phones-and-broadband/scam-calls-and-messages/new-rules-to-thwart-text-message-scammers-and-protect-consumers-and-businesses)

Requirements are set by the regulator and the operators and can change. Check the official sources, or ask our team, before you file.

## Sources

- [Ofcom — Ofcom](https://www.ofcom.org.uk/)
- [ICO — Information Commissioner's Office](https://ico.org.uk/)
- [Ofcom scam-text rules — Ofcom: New rules to thwart text message scammers (statement, 15 July 2026)](https://www.ofcom.org.uk/phones-and-broadband/scam-calls-and-messages/new-rules-to-thwart-text-message-scammers-and-protect-consumers-and-businesses)