Which rules apply
Two sets of rules work together:
- Electronic marketing rules decide whether you can send a marketing text. In the UK that's PECR; in the EU it's each country's version of the ePrivacy rules.
- Data protection law (UK GDPR and EU GDPR) decides how you handle the personal data involved, such as phone numbers, names and consent records.
Is your text marketing?
Marketing means promoting products, services, offers or your organisation's aims. Service messages are different: they're about something the customer already has or asked for.
| Usually service | Usually marketing |
|---|---|
| Order and delivery updates | Sales, discounts and offers |
| Appointment reminders | New product launches |
| Account and security alerts | Event invitations to promote your brand |
| Payment confirmations | “We miss you” win-back messages |
Adding an offer to a service message turns it into marketing. Keep them separate.
What valid consent looks like
For marketing texts to individuals, you generally need consent before you send. Under GDPR, valid consent is:
- Freely given: not a condition of buying something unless it's genuinely needed
- Specific: it mentions text messages, not just “marketing”
- Informed: people know who you are and what you'll send
- Unambiguous: an active step, such as ticking an empty box or texting a keyword. Pre-ticked boxes and silence don't count.
The soft opt-in
Both the UK and many EU countries allow an exception for existing customers. You can send marketing texts without fresh consent if all of these are true:
- You got the number during a sale, or negotiations for a sale, of a product or service
- You only promote your own similar products or services
- You gave a simple chance to refuse when you collected the number
- You give a simple way to opt out in every message
The soft opt-in isn't applied the same way in every EU country, and some interpret it narrowly. Check each market, or let Textezy apply each country's rules for you.
Keeping records
If a customer complains or a regulator asks, you need to show that consent was given. For each contact, keep:
- Who consented: the phone number and any linked name
- When: the date and time
- How: the form, keyword, QR code or checkout where it happened
- What they saw: the exact wording at that moment
- Whether and when they withdrew
Opt-outs
People must be able to stop marketing texts as easily as they signed up, for free. Include a clear way out, such as “Reply STOP to opt out”, in every marketing text, and act on it promptly. Every message should also make clear who it's from.
Consent checklist
- Marketing and service messages kept separate
- Opt-in wording mentions texts, your brand and frequency
- No pre-ticked boxes
- Soft opt-in only for existing customers and similar products
- Consent records stored with time, source and wording
- Sender identity and opt-out in every marketing text
- Opt-outs honoured promptly across every list
Signup forms, keywords and QR codes collect consent with the right wording. Every opt-in goes to your consent ledger, soft opt-in contacts are tagged, and marketing sends are blocked for anyone without permission.
This guide is general information, not legal advice. Guidance from the ICO and EU regulators changes; check the latest guidance for your situation.