Guides
Log InSign Up

SMS Regulatory Compliance

A guide to SMS Regulatory Compliance Guide

Suggest Edits

In today’s global marketplace, ensuring compliance with SMS marketing regulations is critical for businesses to avoid hefty fines and maintain customer trust. This guide will help businesses using OneSignal, marketers, and developers navigate the complex landscape of SMS regulatory compliance across various regions, including Europe, APAC, and the Americas.

Global Regulatory Overview

Overview of SMS Regulations

Regulations governing SMS marketing vary significantly across regions. Below is a high-level overview of key regulations that you must comply with in Europe, the Americas, and APAC:

  • Europe: General Data Protection Regulation (GDPR) and the ePrivacy Directive.
  • Americas: Telephone Consumer Protection Act (TCPA), CTIA, and CAN-SPAM Act.
  • APAC: Australia’s Spam Act and Singapore’s Personal Data Protection Act (PDPA).

Key Differences Across Regions

While there are common themes, such as the necessity of obtaining consent and providing opt-out mechanisms, each region has unique requirements. It’s important to understand these differences to ensure your SMS campaigns are fully compliant.

Detailed Regulatory Compliance by Region

Europe

GDPR Compliance

The GDPR is a comprehensive data protection regulation that applies to all businesses that process personal data of individuals within the European Union (EU).

  • Key Requirements for Obtaining Consent:

    • Consent must be freely given, specific, informed, and unambiguous.
    • Users must be clearly informed about how their data will be used.
    • Consent must be as easy to withdraw as it is to give.

  • Data Protection and User Rights:

    • Users have the right to access their data, request corrections, and demand deletion.
    • Businesses must implement robust data protection measures.

  • Building the Right Consents:

    • Drafting Compliant Consent Language: Ensure that your consent requests clearly state what users are opting into, how their data will be used, and that they can withdraw consent at any time.
    • Example Phrases for GDPR-Compliant Opt-Ins: “I consent to receive marketing communications via SMS from [Your Company] in accordance with our Privacy Policy.”
    • Ensuring Transparency and Explicit Consent: Include a link to your privacy policy and make sure the user takes an affirmative action to opt in.

ePrivacy Directive

The ePrivacy Directive complements GDPR by setting specific rules for electronic communications.

  • Rules for Electronic Communications:

    • Consent is required before sending any marketing SMS unless you have an existing customer relationship.
    • Users must be given clear information about how their data will be used.

  • Crafting Clear and Compliant Consent Statements:

    • Guidance: Ensure your consent statements include the purpose of the SMS, details about the sender, and an easy way to opt out.
    • Example Compliant Opt-In Forms: “By providing your phone number, you agree to receive SMS updates and offers from [Your Company]. You can opt out at any time.”

Americas

TCPA Compliance

The TCPA is a U.S. federal law that regulates telemarketing and SMS marketing.

  • Requirements for Consent and Opt-In:

    • Express written consent is required for sending promotional SMS messages.
    • Businesses must clearly disclose that consent is not a condition of purchase.

  • Examples of Compliant Messaging Practices:

    • Ensure your messages include the required disclosures and a clear opt-out mechanism.
    • Use language such as: “By checking this box, you agree to receive automated promotional messages from [Company Name]. This agreement is not a condition of purchase. Message frequency varies. Reply STOP to opt-out or HELP for help. Message & data rates apply. Terms and privacy policy found at company.com/terms.”

  • How to Form the Right Consents:

    • What Constitutes "Express Written Consent": Consent must be obtained through a clear and conspicuous disclosure, and the user must take an affirmative action to consent.
    • Sample Consent Language and Clauses: “I agree to receive SMS messages from [Your Company] at the number provided. Msg & data rates may apply.”
    • Methods to Collect and Document Consent: Use double opt-in methods and maintain records of all consents obtained.

CTIA Compliance

The Cellular Telecommunications Industry Association (CTIA) is a group of wireless carriers and other industry businesses that maintains guidelines for SMS marketing to protect consumers from receiving unsolicited text messages.

The CTIA provides Marketers with rules such as:

  • Displaying a clear call to action to ensure customers understand what they're signing up for relating to text marketing communications
  • Having a clear opt-out process
  • All texts to customers must include your brand's name

CAN-SPAM Act

While originally designed for email [link to email regulatory compliance], the CAN-SPAM Act also applies to commercial SMS messages.

  • Requirements for Commercial Messages:

    • Clearly identify the message as an advertisement.
    • Include the sender’s physical address and a clear opt-out mechanism.

  • Creating Effective Consent Mechanisms:

    • Best Practices for Obtaining and Recording Consent: Always provide an opt-out option in every message and honor opt-out requests promptly.
    • Examples of Opt-In and Opt-Out Procedures: Use language like, “Text STOP to unsubscribe” in all messages.

APAC

Australia’s Spam Act

Australia’s Spam Act regulates the sending of commercial electronic messages, including SMS.

  • Consent and Identification Requirements:

    • Explicit or inferred consent is required before sending any commercial SMS.
    • Messages must clearly identify the sender and provide contact information.

  • Formulating Compliant Consent Requests:

    • Key Components for Legal Consent: Make sure users are informed about what they are consenting to and that consent is specific to the type of messages they will receive.
    • Examples of Language to Use in SMS Consent Requests: “By entering your phone number, you consent to receive promotional messages from [Your Company].”

Singapore’s PDPA

The PDPA governs the collection, use, and disclosure of personal data in Singapore.

  • Obligations for SMS Marketing:

    • Consent must be obtained before collecting and using personal data.
    • Users must be informed of the purpose for which their data will be used.

  • Drafting PDPA-Compliant Consent Forms:

    • Guidance on Consent Wording and Record-Keeping: Ensure that your consent requests are clear and specific, and maintain detailed records of all consents obtained.
    • Example Consent Forms: “I consent to receive SMS updates from [Your Company] in accordance with the Personal Data Protection Act.”

Compliance Best Practices

General Best Practices for Compliance

  • Regularly Review and Update Compliance Policies: Stay informed about changes in regulations and update your practices accordingly.
  • Maintain Clear and Accessible Records of User Consent: Keep detailed records of when, how, and for what purpose consent was obtained.
  • Ensure Opt-Out Mechanisms Are Easy to Use and Effective: Provide clear instructions on how users can opt out of receiving messages, and honor opt-out requests promptly.

Compliant Opt-In Forms

  • How to Structure Opt-In Forms to Meet Regulatory Requirements: Include all necessary information, such as the purpose of the SMS, how the data will be used, and a link to your privacy policy.
  • Key Elements to Include:
    • Purpose of the SMS campaign
    • Terms of service and privacy policy links
    • Clear opt-in language (e.g., “By signing up, you agree to receive promotional SMS messages from [Your Company].”)
- Example Opt-In Forms with Explanations

Example Opt-In Form with Explanations

Text Messaging Terms & Conditions

In order to be compliant with TCPA and CTIA guidelines, you’ll need to have a set of terms and conditions for your text messaging program. This is what the TCPA refers to as the “written agreement” between you and the consumer. These rules state that the link to your terms and conditions must be clearly visible and easy-to-find, and also state what content they must include.

This information includes:

  • Business name
  • Text Program name
  • The number used for the program
  • Opt-in instructions
  • Opt-out instructions
  • Help instructions
  • A list of supported wireless carriers
  • Messaging frequency
  • Message and data rates disclosure
  • Link to privacy policy

For GDPR, you will be required to have a privacy policy too.

General Disclaimer: The content on this page is for informational purposes only and does not constitute legal advice. We recommend consulting with a legal professional to ensure full compliance with all applicable regulations.

Updated 18 days ago

What’s Next

Start collecting phone numbers