GDPR and SMS Marketing — Compliance Guide
The General Data Protection Regulation (GDPR, Article 6) imposes strict rules on SMS marketing communications. Non-compliance can result in fines of up to 4% of annual worldwide turnover.
Legal basis for processing
The GDPR defines 6 legal bases. For marketing SMS, the main basis is explicit consent. For transactional SMS (OTP, order confirmation), the basis can be performance of a contract.
Conditions for valid consent (Article 4.11)
Consent must be freely given, specific, informed and unambiguous:
- Freely given: Access to the service cannot be made conditional on accepting marketing SMS
- Specific: Separate consent for each type of communication (marketing, transactional, promotional)
- Informed: The user must understand exactly what they are consenting to — clear language, no jargon
- Unambiguous: Box unchecked by default — silence or inaction does NOT constitute consent
Managing opt-outs
- Include in every marketing SMS:
"Reply STOP to unsubscribe" - Process unsubscribe requests within 24 hours maximum
- Keep the unsubscribe list for 3 years minimum
- Withdrawing consent must be as easy as giving it (GDPR RFC)
Recommended SMS footer
[CompanyName] | SIRET: XXXXXXXXX Reply STOP to unsubscribe Privacy policy: https://votresite.com/privacy
Retention periods
| Data type | Minimum period |
|---|---|
| Proof of consent | 3 years (recommended: 5-7 years) |
| Delivery logs | 6 to 12 months |
| Unsubscribe list | 3 years after opt-out |
| Customer data | Period necessary for the stated purpose |
SMS compliance checklist
- ☐ Double opt-in consent for marketing segments
- ☐ Box unchecked by default on all forms
- ☐ Audit trail: timestamp, IP, exact consent text
- ☐ No SMS between 21h00 and 8h00 (recipient's local time)
- ☐ Consent renewal every 24 months
- ☐ 100% first-party data — no purchased lists
- ☐ DPA (Data Processing Agreement) signed with WebTic as processor
Reference: Google was fined €50M by the French CNIL for failing to meet informed consent requirements.
