Skip to content
OmniChannels.ai
Menu

Bulk SMS in South Africa: POPIA, WASPA Code and Sender IDs

Bulk SMS in South Africa: POPIA section 69 consent, CPA opt-out, WASPA Code of Conduct hours, ICASA, Vodacom, MTN, Cell C and Telkom, sender IDs and OTP vs promo.

Updated 9 min read

By OmniChannels.ai Editorial Team · Reviewed by BroadNet Messaging Solutions Team

SMS & OTP

Short answer

To send bulk SMS in South Africa, get consent before marketing under POPIA section 69 (or rely on the narrow existing-customer exception), include your identity and an opt-out in every message, and follow the WASPA Code of Conduct on sending hours and STOP requests. Alphanumeric sender IDs need no pre-registration, but the name must identify your business. Deliver through Vodacom, MTN, Cell C and Telkom Mobile.

On this page
  1. Which laws and codes apply to bulk SMS in South Africa?
  2. What does POPIA section 69 say about marketing SMS?
  3. What does the CPA add?
  4. What does the WASPA Code of Conduct require?
  5. When can you send marketing SMS?
  6. How do sender IDs work in South Africa?
  7. Which networks carry SMS in South Africa?
  8. How should you separate OTP and promotional SMS?
  9. How should you handle STOP, opt-outs and the Do Not Contact list?
  10. Can customers reply to your SMS?
  11. A worked example: a Johannesburg gym chain
  12. What are the common mistakes?
  13. How OmniChannels.ai helps

Key takeaways

  • POPIA section 69 bars direct marketing by electronic communication, including SMS, unless the person consented or is your customer under narrow conditions, and you may ask for consent only once.
  • Every direct marketing message must carry the sender's identity and contact details where the person can ask you to stop.
  • The WASPA Code of Conduct bars direct marketing on Sundays and public holidays, on Saturdays before 09:00 or after 13:00, and on other days from 20:00 to 08:00; OTPs and alerts are transactional.
  • Our regulation data says South African alphanumeric sender IDs, up to 11 characters, are not pre-registered, but the ID must identify the business.
  • Four networks carry SMS: Vodacom, MTN South Africa, Cell C and Telkom Mobile; we have direct routes to all four.

This guide is for marketing, e-commerce, banking and operations teams that want to send business SMS to South African mobile numbers: OTPs, account alerts, reminders and promotions. It explains the consent rules in POPIA, the sending hours in the WASPA Code, how sender IDs work without a registry, and how to separate OTPs from marketing. It is a practical overview, not legal advice; confirm requirements with South African counsel.

Which laws and codes apply to bulk SMS in South Africa?

Several instruments apply at once. There is no single SMS statute, so the rules come from a privacy law, a consumer law and an industry code.

Source What it covers for SMS
POPIA (Protection of Personal Information Act), enforced by the Information Regulator Consent for direct marketing, identity and opt-out in every message
Consumer Protection Act (CPA) Consumers' right to restrict unwanted direct marketing; prohibited marketing times
WASPA Code of Conduct Marketing rules binding WASPA members and their clients: STOP handling, sending hours, the Do Not Contact list
ICASA Regulates electronic communications licensing; no SMS sender ID registry

Our regulation data lists ICASA as the regulator and the Information Regulator and the WASPA Code as sources. The WASPA Code is an industry code, so its restrictions apply through membership and through provider contracts rather than a statute. WASPA says its current Code is version 17.15, so check the live version before large campaigns.

What does POPIA section 69 say about marketing SMS?

Section 69 prohibits processing personal information for direct marketing by electronic communication, including SMS, unless the person has consented or is your customer under narrow conditions.

  1. Consent route. You may approach a person whose consent is required, if they have not previously refused, and only once to ask for consent. The request must follow the prescribed form.
  2. Existing customer route. You may market to a customer without new consent only if you obtained their details in the sale of a product or service, the marketing is for your own similar products or services, and they were given a reasonable, free and easy chance to object when you collected the details and with each message.
  3. Identity and contact. Every direct marketing communication must contain the sender's identity, or that of the party on whose behalf it is sent, and an address or number where the person can ask for it to stop.

Practical consequences: do not buy lists and blast them, do not send a second "please opt in" message after a refusal, and do not treat a business card as consent for promotions. Rely on the existing-customer route only when all three conditions are clearly met.

What does the CPA add?

The Consumer Protection Act gives consumers a right to restrict unwanted direct marketing and sets prohibited times for contacting consumers. The regulation on prohibited times covers direct marketing to a consumer at home. It bars Sundays and public holidays, Saturdays before 09:00 and after 13:00, and other days from 20:00 until 08:00 the next day, unless the consumer expressly or implicitly requested or agreed otherwise. It also puts the burden of proving dispatch time on the marketer, so keep send logs.

What does the WASPA Code of Conduct require?

WASPA members, and the clients they carry, must follow the Code's rules on direct marketing. Three points matter for SMS senders:

  • Consent. WASPA's guidance for consumers says members and their clients may send marketing only if the person is already a customer or has given permission.
  • STOP. Members must honour STOP requests for marketing messages, and the STOP reply may not be charged above the normal price of an SMS.
  • Do Not Contact list. Consumers can add their numbers to the WASPA Do Not Contact list at dnc.org.za. Check with your provider how the list is applied to your campaigns.

Our regulation data adds a practical layer: opt-in must be verifiable, with timestamped records kept for at least 12 months and produced on regulator request; every promotion carries STOP or opt-out wording; and DND suppression is applied where the regulator runs a registry.

When can you send marketing SMS?

Under the WASPA Code, direct marketing is barred on Sundays and public holidays, on Saturdays before 09:00 or after 13:00, and on other days between 20:00 and 08:00.

Day Allowed window for promotions
Monday to Friday 08:00 to 20:00
Saturday 09:00 to 13:00
Sunday and public holidays None

Transactional messages such as OTPs, payment alerts and delivery updates are not direct marketing and can run at any hour, but keep them free of promotions. Schedule campaigns in South African Standard Time (UTC+2) and build a public holiday calendar into your scheduler. The send time planner helps, and our SMS marketing rules by country compares these windows with other markets.

How do sender IDs work in South Africa?

South Africa has no pre-registration for alphanumeric sender IDs, but the ID must identify your business. Our regulation data allows alphanumeric IDs of up to 11 characters and notes that a numeric long code is available on select networks. Our coverage data lists a free-form sender ID lead time.

That does not mean anything goes. Use a name that matches your company or brand, keep separate names for transactional and promotional traffic, and avoid names that look like banks or government bodies you do not represent. Your provider may still ask for company details under its own KYC. Our sender ID types guide compares the options, and the South Africa sender ID page summarises the current position. If you want help, see registrations; approval decisions stay with the networks and regulators.

Which networks carry SMS in South Africa?

Four networks carry mobile traffic, and our coverage data lists direct routes to all of them:

Operator MCC-MNC
Vodacom 655-01
MTN South Africa 655-10
Cell C 655-07
Telkom Mobile 655-02

Read delivery reports per network. If delivery drops on one, our guide to improving SMS delivery rates shows how to diagnose it.

How should you separate OTP and promotional SMS?

Use separate sender names and routes, so promotional traffic never delays a login code. OTPs should be short, carry a validity time and contain no offers. Promotions carry your identity and STOP wording and follow the marketing hours. Here are examples we checked against the 160-character GSM 7-bit limit:

Use Message Characters Parts
OTP Your Sunrise Bank code is 482913. Valid for 5 minutes. Never share this code. 77 1
Appointment Sunrise Fitness: Your Saturday class is confirmed for 09:00. Reply 1 to confirm or 2 to cancel. 95 1
Promotion Sunrise Fitness: Winter offer for members, new classes this month. Details: sunrise.example/w Reply STOP to opt out. 116 1

Keep an eye on message length if you add emoji or special symbols, because Unicode drops the limit to 70 characters. Our guide to character limits and the SMS character counter cover this. For OTP design see our OTP authentication messages guide.

How should you handle STOP, opt-outs and the Do Not Contact list?

Treat every STOP as final for marketing until the person opts in again, and apply it across all your campaigns, not only the one that triggered it. Process replies in real time where you can, and at the latest before the next send.

  1. Keyword list. Accept STOP and common variants in English and the local languages your customers use.
  2. Central suppression list. Store the number, timestamp and campaign, and check it before every scheduled send.
  3. Confirmation. Reply once to confirm the opt-out, without marketing inside the confirmation.
  4. Cross-channel rule. Decide whether an SMS opt-out also stops WhatsApp and email marketing, and apply that rule consistently.
  5. List hygiene. Check customers against the WASPA Do Not Contact list through your provider where applicable, and clean numbers that have changed hands.

Can customers reply to your SMS?

Two-way SMS needs a sender that can receive replies, such as a numeric number, rather than a one-way alphanumeric name. Use two-way for appointment confirmations, surveys and support, and always treat STOP and equivalents as an opt-out. Replies should land in a shared inbox so agents can answer. Check with your provider which sender types can receive replies on each network, and read our two-way SMS guide.

A worked example: a Johannesburg gym chain

"Sunrise Fitness" (synthetic) has branches in Gauteng and the Western Cape.

  • Members consent to promotions on the sign-up form; the record stores timestamp, channel and wording.
  • It uses one sender name for class confirmations and OTPs, and another for promotions.
  • Promotions go out on weekdays between 09:00 and 17:00 and on Saturday mornings before 13:00, never on Sundays or public holidays.
  • Every promotion carries the gym's name and a STOP instruction.
  • STOP replies update one suppression list, applied before each campaign and shared with email and WhatsApp marketing.

What are the common mistakes?

  • Sending a second consent request after a refusal. POPIA allows one approach only.
  • Promotions on a Sunday or public holiday. Build a holiday calendar into the scheduler.
  • Mixed traffic. An offer inside an OTP risks the OTP route.
  • No send logs. The marketer must show when a message was dispatched.
  • Relying on the customer exception too widely. It covers your own similar products only.

How OmniChannels.ai helps

OmniChannels.ai is powered by BroadNet, which has direct routes to Vodacom, MTN South Africa, Cell C and Telkom Mobile. We set up your sender IDs, give you per-network delivery reports and support scheduling, opt-out handling and two-way SMS, with WhatsApp and SMS fallback in one platform. For indicative list prices, see our South Africa SMS pricing page, then book a demo to plan your South Africa launch.

Frequently asked questions

Do I need consent to send bulk marketing SMS in South Africa?

Generally yes. POPIA section 69 prohibits direct marketing by electronic communication, which includes SMS, unless the person has given consent, or is an existing customer whose details you obtained in a sale, for your own similar products, with a free and easy chance to object. You may ask for consent only once if the person has not refused before. Confirm your approach with counsel.

Do I need to register a sender ID in South Africa?

Our regulation data says no pre-registration is required under the WASPA Code of Conduct, but the sender ID must identify your business. Alphanumeric IDs can be up to 11 characters, and a numeric long code is available on select networks. Use consistent names, avoid other brands and test delivery on every network before launch.

What are the allowed times for marketing SMS in South Africa?

The WASPA Code of Conduct bars direct marketing on Sundays and public holidays, on Saturdays before 09:00 or after 13:00, and on other days between 20:00 and 08:00. The Consumer Protection Act regulation sets the same windows for direct marketing to consumers at home, unless the consumer agreed otherwise. Transactional messages such as OTPs are not promotions.

What happens when someone replies STOP?

Honour it for marketing messages across your campaigns. WASPA states that members must honour STOP requests for marketing, and that the STOP reply may not cost more than a normal SMS. Our regulation data also requires opt-out wording in every promotion. Keep a suppression list and apply it before each send.

Who regulates SMS in South Africa?

Several bodies: ICASA regulates electronic communications, the Information Regulator enforces POPIA, and WASPA is the industry body whose Code of Conduct binds its members and their clients. The Consumer Protection Act also restricts unwanted direct marketing. In practice your provider applies WASPA rules to the traffic it carries.

How long should I keep consent records?

Our regulation data says to keep timestamped consent records for at least 12 months and produce them on regulator request. Store the source, timestamp, channel and exact wording for each number. Longer retention may suit your own risk policy, so agree a period with your legal team.

Sources

  1. Protection of Personal Information Act, section 69: direct marketing by means of unsolicited electronic communications
  2. WASPA Code of Conduct, version 17.15
  3. Consumer Protection Act regulations: prohibited time for contacting consumers
  4. Information Regulator, South Africa
  5. Independent Communications Authority of South Africa (ICASA)

Keep reading

More guides