A guide to global SMS compliance laws

Did you know that any SMS sent to a Russian mobile that contains a URL is automatically blocked? Or that in France businesses can’t send any SMS messages on a Sunday? In Malaysia, the SMS message header has to make it clear that the recipient isn’t getting charged for receiving it.

When it comes to SMS, any global company that wants to keep its customers informed on the channel with the highest open rate needs to be on top of SMS compliance laws across all its markets.

It is a complex subject – there can be both country level and state regulations, and then rules set by individual mobile carriers that are not necessarily consistent within each territory. Add to the mix the intricacies of roaming agreements, and you might decide that it is impossible to be 100% compliant 100% of the time.

You might be right, but the risks are too great to not make every effort. If your messages get blocked by mobile carriers your customers may miss out on critical messages that could impact them financially or cause them actual harm. Your reputation will be impacted, you risk losing business, and you could be fined by authorities.

With this in mind, we have put together an overview of the key rules and regulations that you need to be aware of when sending commercial SMS across borders.

Compliance for text messages is nothing new, but the scope has certainly expanded over the past decade with technological advances and legislative changes.

Following are some of the common areas where compliance legislation is applied. For specific information on individual countries please have a look at our connectivity and compliance guide that includes detail on just about every country in the world.

In most countries you can only send SMS messages to customers that have opted-in to receiving them. Beware that that the definition of ‘opt-in’ has matured and usually has to be explicit. Implied opt-in because a customer bought a product or service and forgot to uncheck a tick-box is no longer acceptable. In addition, you will in most cases need to include a free unsubscribe link to allow people to opt out of receiving SMS from you.

A Sender-ID allows businesses to send SMS to their customers from a recognizable brand name rather than a number that they don’t know. This option is not available in all countries, and in some cases organizations have to pre-register their Sender-IDs to prevent duplication and fraudulent use. These include major markets like Brazil, Indonesia, Mexico and the Philippines.

Most countries differentiate between transactional and marketing messages and apply different restrictions. A delivery notification, overdraft warning, or any alert that it is in the customer’s interest to see would be classed as transactional, while any promotional or sales message would come under marketing. Even in regions where marketing messages are allowed, there are usually additional restrictions on content related to gambling, drugs and alcohol, adult-themed products, and both political and religious topics.

It is commonly accepted that 160 characters is the limit for SMS messages, but this can be less in some countries. For example it is 157 in Brazil, and you may end up paying for two messages if you go slightly over 157 and truncation is applied. Speaking of truncation, it is up to individual carriers in each country whether to support truncation. Be warned that some carriers will only send the first 160 characters, with the rest being discarded.

In many countries, businesses are only allowed to send messages between certain hours, for example 8am and 8pm, and sometimes not at all on certain days, for example Sundays in France as we have mentioned already.

In many countries consumers can opt out of receiving business communications by signing up to do-not-contact or do-not-disturb registries. These need to be respected by businesses or they run the risk of service suspensions or fines.

Both marketing and transactional messaging is allowed in the US, but only to subscribers that have opted in to receiving them.

In addition to the usual restrictions on the promotion of gambling, drugs, alcohol, firearms and adult content, there are also rules preventing the promotion of some financial products, for example loans, debt relief and credit repair. Also banned are any lead generation campaigns that involve the sharing of collected information with third parties.

It is required for all commercial text messages to be two-way, specifically to enable customers to opt out of receiving further messages.

Most businesses in the US lease a short code for their commercial messaging. Although it is still possible to use a ten-digit long number to both send and receive SMS, the limitations on throughput mean that it is not a widely used method for sending A2P traffic.

The key legislation in North America that covers SMS messaging is the Telephone Consumer Protection Act (TCPA), although if a business is messaging customers over the border in Canada, then their own anti-spam legislation has to be adhered to.

There are 27 countries in the European Union and a further 3 countries in the European Economic Area (EEA) that are also covered by European rules that apply to privacy and electronic communication (the 3 countries are Norway, Lichtenstein, and Iceland just in case it ever comes up in a trivia quiz).

GDPR is the mostly widely recognized Europe-wide legislation, but there are others like the E-privacy Directive, as well as specific regulations in individual countries. For example, some EU countries allow one-way commercial SMS messages to be sent and others do not.

On the whole however, SMS regulations in Europe are some of the tightest and strictly enforced in the world, especially when it comes to opt-in and crucially opt-out.

GDPR is definitely not toothless legislation. Just ask British Airways who were fined £22 million after the personal data of over 400,000 customers was stolen by hackers. Hotel chain Marriott International took an even bigger hit of nearly £100 million when it had to pay compensation to millions of people whose private data was stolen from the organization.

While fines for not complying with SMS regulations are nowhere as high, they are still significant enough that businesses have to be very careful to not break any rules.

When it comes to SMS, APAC is the biggest market in the world and MENA is one of the fastest growing. On the list of countries with the most active mobile phone users, the top three places are in APAC – China, India and Indonesia. However, the challenge for companies doing business in these regions are the sheer diversity of cultures, languages and social norms when it comes to marketing and mobile phone usage.

Typical of high growth economies, the rules and regulations are also very dynamic – for example a number of businesses were caught out when Singapore recently introduced more stringent regulations around Sender ID to combat a spate of SMS phishing scams.

There is little doubt that to succeed in these regions, and indeed globally, businesses need the help of an enterprise SMS API provider to ensure that all their messaging is compliant.

We would love to help. We have years of hard-won experience in global SMS delivery and compliance capability is actually built into our platform.

And we certainly know our rules – we have staff on the ground on every continent keeping on top of local legislation and maintaining relationships with the biggest network of providers of any SMS supplier.

The end result? Our customers remain compliant in every territory and get the best possible delivery rates.

Please note that this content is provided for information purposes only and should not be relied on as legal or compliance advice.