---
title: "Bulk SMS in South Africa: POPIA, WASPA Code and Sender IDs"
description: "Bulk SMS in South Africa: POPIA section 69 consent, CPA opt-out, WASPA Code of Conduct hours, ICASA, Vodacom, MTN, Cell C and Telkom, sender IDs and OTP vs promo."
canonical: "https://omnichannels.ai/blog/bulk-sms-south-africa-guide/"
language: "en"
updated: "2026-11-03"
publisher: "BroadNet Technologies"
brand: "OmniChannels.ai"
category: "sms"
primaryQuery: "bulk sms south africa"
keywords: ["bulk sms south africa", "popia sms marketing", "waspa code of conduct", "south africa sms regulations", "sender id south africa", "sms marketing south africa", "cpa direct marketing sms", "icasa sms"]
published: "2026-11-03"
author: "OmniChannels.ai Editorial Team"
reviewer: "BroadNet Messaging Solutions Team"
readingMinutes: 9
answer: "To send bulk SMS in South Africa, get consent before marketing under POPIA section 69 (or rely on the narrow existing-customer exception), include your identity and an opt-out in every message, and follow the WASPA Code of Conduct on sending hours and STOP requests. Alphanumeric sender IDs need no pre-registration, but the name must identify your business. Deliver through Vodacom, MTN, Cell C and Telkom Mobile."
takeaways: ["POPIA section 69 bars direct marketing by electronic communication, including SMS, unless the person consented or is your customer under narrow conditions, and you may ask for consent only once.", "Every direct marketing message must carry the sender's identity and contact details where the person can ask you to stop.", "The WASPA Code of Conduct bars direct marketing on Sundays and public holidays, on Saturdays before 09:00 or after 13:00, and on other days from 20:00 to 08:00; OTPs and alerts are transactional.", "Our regulation data says South African alphanumeric sender IDs, up to 11 characters, are not pre-registered, but the ID must identify the business.", "Four networks carry SMS: Vodacom, MTN South Africa, Cell C and Telkom Mobile; we have direct routes to all four."]
faq: 
  - q: "Do I need consent to send bulk marketing SMS in South Africa?"
    a: "Generally yes. POPIA section 69 prohibits direct marketing by electronic communication, which includes SMS, unless the person has given consent, or is an existing customer whose details you obtained in a sale, for your own similar products, with a free and easy chance to object. You may ask for consent only once if the person has not refused before. Confirm your approach with counsel."
  - q: "Do I need to register a sender ID in South Africa?"
    a: "Our regulation data says no pre-registration is required under the WASPA Code of Conduct, but the sender ID must identify your business. Alphanumeric IDs can be up to 11 characters, and a numeric long code is available on select networks. Use consistent names, avoid other brands and test delivery on every network before launch."
  - q: "What are the allowed times for marketing SMS in South Africa?"
    a: "The WASPA Code of Conduct bars direct marketing on Sundays and public holidays, on Saturdays before 09:00 or after 13:00, and on other days between 20:00 and 08:00. The Consumer Protection Act regulation sets the same windows for direct marketing to consumers at home, unless the consumer agreed otherwise. Transactional messages such as OTPs are not promotions."
  - q: "What happens when someone replies STOP?"
    a: "Honour it for marketing messages across your campaigns. WASPA states that members must honour STOP requests for marketing, and that the STOP reply may not cost more than a normal SMS. Our regulation data also requires opt-out wording in every promotion. Keep a suppression list and apply it before each send."
  - q: "Who regulates SMS in South Africa?"
    a: "Several bodies: ICASA regulates electronic communications, the Information Regulator enforces POPIA, and WASPA is the industry body whose Code of Conduct binds its members and their clients. The Consumer Protection Act also restricts unwanted direct marketing. In practice your provider applies WASPA rules to the traffic it carries."
  - q: "How long should I keep consent records?"
    a: "Our regulation data says to keep timestamped consent records for at least 12 months and produce them on regulator request. Store the source, timestamp, channel and exact wording for each number. Longer retention may suit your own risk policy, so agree a period with your legal team."
sources: 
  - title: "Protection of Personal Information Act, section 69: direct marketing by means of unsolicited electronic communications"
    url: "https://popia.co.za/section-69-direct-marketing-by-means-of-unsolicited-electronic-communications/"
  - title: "WASPA Code of Conduct, version 17.15"
    url: "https://waspa.org.za/wp-content/uploads/2026/09/WASPA-Code-of-Conduct-17.15-clean.pdf"
  - title: "Consumer Protection Act regulations: prohibited time for contacting consumers"
    url: "https://www.acts.co.za/consumer-protection/r293_prohibited_time_for_contacting_consumers"
  - title: "Information Regulator, South Africa"
    url: "https://inforegulator.org.za/"
  - title: "Independent Communications Authority of South Africa (ICASA)"
    url: "https://www.icasa.org.za/"
---

# Bulk SMS in South Africa: POPIA, WASPA Code and Sender IDs

Canonical: https://omnichannels.ai/blog/bulk-sms-south-africa-guide/
Language: en
Publisher: OmniChannels.ai by BroadNet Technologies

This guide is for marketing, e-commerce, banking and operations teams that want to send business SMS to South African mobile numbers: OTPs, account alerts, reminders and promotions. It explains the consent rules in POPIA, the sending hours in the WASPA Code, how sender IDs work without a registry, and how to separate OTPs from marketing. It is a practical overview, not legal advice; confirm requirements with South African counsel.

## Which laws and codes apply to bulk SMS in South Africa?

Several instruments apply at once. There is no single SMS statute, so the rules come from a privacy law, a consumer law and an industry code.

| Source | What it covers for SMS |
|---|---|
| POPIA (Protection of Personal Information Act), enforced by the Information Regulator | Consent for direct marketing, identity and opt-out in every message |
| Consumer Protection Act (CPA) | Consumers' right to restrict unwanted direct marketing; prohibited marketing times |
| WASPA Code of Conduct | Marketing rules binding WASPA members and their clients: STOP handling, sending hours, the Do Not Contact list |
| ICASA | Regulates electronic communications licensing; no SMS sender ID registry |

Our regulation data lists ICASA as the regulator and the Information Regulator and the WASPA Code as sources. The WASPA Code is an industry code, so its restrictions apply through membership and through provider contracts rather than a statute. WASPA says its current Code is version 17.15, so check the live version before large campaigns.

## What does POPIA section 69 say about marketing SMS?

Section 69 prohibits processing personal information for direct marketing by electronic communication, including SMS, unless the person has consented or is your customer under narrow conditions.

1. **Consent route.** You may approach a person whose consent is required, if they have not previously refused, and only once to ask for consent. The request must follow the prescribed form.
2. **Existing customer route.** You may market to a customer without new consent only if you obtained their details in the sale of a product or service, the marketing is for your own similar products or services, and they were given a reasonable, free and easy chance to object when you collected the details and with each message.
3. **Identity and contact.** Every direct marketing communication must contain the sender's identity, or that of the party on whose behalf it is sent, and an address or number where the person can ask for it to stop.

Practical consequences: do not buy lists and blast them, do not send a second "please opt in" message after a refusal, and do not treat a business card as consent for promotions. Rely on the existing-customer route only when all three conditions are clearly met.

## What does the CPA add?

The Consumer Protection Act gives consumers a right to restrict unwanted direct marketing and sets prohibited times for contacting consumers. The regulation on prohibited times covers direct marketing to a consumer at home. It bars Sundays and public holidays, Saturdays before 09:00 and after 13:00, and other days from 20:00 until 08:00 the next day, unless the consumer expressly or implicitly requested or agreed otherwise. It also puts the burden of proving dispatch time on the marketer, so keep send logs.

## What does the WASPA Code of Conduct require?

WASPA members, and the clients they carry, must follow the Code's rules on direct marketing. Three points matter for SMS senders:

- **Consent.** WASPA's guidance for consumers says members and their clients may send marketing only if the person is already a customer or has given permission.
- **STOP.** Members must honour STOP requests for marketing messages, and the STOP reply may not be charged above the normal price of an SMS.
- **Do Not Contact list.** Consumers can add their numbers to the WASPA Do Not Contact list at dnc.org.za. Check with your provider how the list is applied to your campaigns.

Our regulation data adds a practical layer: opt-in must be verifiable, with timestamped records kept for at least 12 months and produced on regulator request; every promotion carries STOP or opt-out wording; and DND suppression is applied where the regulator runs a registry.

## When can you send marketing SMS?

Under the WASPA Code, direct marketing is barred on Sundays and public holidays, on Saturdays before 09:00 or after 13:00, and on other days between 20:00 and 08:00.

| Day | Allowed window for promotions |
|---|---|
| Monday to Friday | 08:00 to 20:00 |
| Saturday | 09:00 to 13:00 |
| Sunday and public holidays | None |

Transactional messages such as OTPs, payment alerts and delivery updates are not direct marketing and can run at any hour, but keep them free of promotions. Schedule campaigns in South African Standard Time (UTC+2) and build a public holiday calendar into your scheduler. The [send time planner](/tools/send-time-planner/) helps, and our [SMS marketing rules by country](/blog/sms-marketing-rules-by-country/) compares these windows with other markets.

## How do sender IDs work in South Africa?

South Africa has no pre-registration for alphanumeric sender IDs, but the ID must identify your business. Our regulation data allows alphanumeric IDs of up to 11 characters and notes that a numeric long code is available on select networks. Our coverage data lists a free-form sender ID lead time.

That does not mean anything goes. Use a name that matches your company or brand, keep separate names for transactional and promotional traffic, and avoid names that look like banks or government bodies you do not represent. Your provider may still ask for company details under its own KYC. Our [sender ID types guide](/blog/sms-sender-id-types-explained/) compares the options, and the [South Africa sender ID page](/sender-id/south-africa/) summarises the current position. If you want help, see [registrations](/services/registrations/); approval decisions stay with the networks and regulators.

## Which networks carry SMS in South Africa?

Four networks carry mobile traffic, and our coverage data lists direct routes to all of them:

| Operator | MCC-MNC |
|---|---|
| Vodacom | 655-01 |
| MTN South Africa | 655-10 |
| Cell C | 655-07 |
| Telkom Mobile | 655-02 |

Read delivery reports per network. If delivery drops on one, our guide to [improving SMS delivery rates](/blog/sms-not-delivered-improve-delivery-rate/) shows how to diagnose it.

## How should you separate OTP and promotional SMS?

Use separate sender names and routes, so promotional traffic never delays a login code. OTPs should be short, carry a validity time and contain no offers. Promotions carry your identity and STOP wording and follow the marketing hours. Here are examples we checked against the 160-character GSM 7-bit limit:

| Use | Message | Characters | Parts |
|---|---|---|---|
| OTP | `Your Sunrise Bank code is 482913. Valid for 5 minutes. Never share this code.` | 77 | 1 |
| Appointment | `Sunrise Fitness: Your Saturday class is confirmed for 09:00. Reply 1 to confirm or 2 to cancel.` | 95 | 1 |
| Promotion | `Sunrise Fitness: Winter offer for members, new classes this month. Details: sunrise.example/w Reply STOP to opt out.` | 116 | 1 |

Keep an eye on message length if you add emoji or special symbols, because Unicode drops the limit to 70 characters. Our [guide to character limits](/blog/sms-character-limits-unicode-arabic/) and the [SMS character counter](/tools/sms-character-counter/) cover this. For OTP design see our [OTP authentication messages guide](/blog/otp-authentication-messages-guide/).

## How should you handle STOP, opt-outs and the Do Not Contact list?

Treat every STOP as final for marketing until the person opts in again, and apply it across all your campaigns, not only the one that triggered it. Process replies in real time where you can, and at the latest before the next send.

1. **Keyword list.** Accept STOP and common variants in English and the local languages your customers use.
2. **Central suppression list.** Store the number, timestamp and campaign, and check it before every scheduled send.
3. **Confirmation.** Reply once to confirm the opt-out, without marketing inside the confirmation.
4. **Cross-channel rule.** Decide whether an SMS opt-out also stops WhatsApp and email marketing, and apply that rule consistently.
5. **List hygiene.** Check customers against the WASPA Do Not Contact list through your provider where applicable, and clean numbers that have changed hands.

## Can customers reply to your SMS?

Two-way SMS needs a sender that can receive replies, such as a numeric number, rather than a one-way alphanumeric name. Use two-way for appointment confirmations, surveys and support, and always treat STOP and equivalents as an opt-out. Replies should land in a shared inbox so agents can answer. Check with your provider which sender types can receive replies on each network, and read our [two-way SMS guide](/blog/two-way-sms-guide/).

## A worked example: a Johannesburg gym chain

"Sunrise Fitness" (synthetic) has branches in Gauteng and the Western Cape.

- Members consent to promotions on the sign-up form; the record stores timestamp, channel and wording.
- It uses one sender name for class confirmations and OTPs, and another for promotions.
- Promotions go out on weekdays between 09:00 and 17:00 and on Saturday mornings before 13:00, never on Sundays or public holidays.
- Every promotion carries the gym's name and a STOP instruction.
- STOP replies update one suppression list, applied before each campaign and shared with email and WhatsApp marketing.

## What are the common mistakes?

- **Sending a second consent request after a refusal.** POPIA allows one approach only.
- **Promotions on a Sunday or public holiday.** Build a holiday calendar into the scheduler.
- **Mixed traffic.** An offer inside an OTP risks the OTP route.
- **No send logs.** The marketer must show when a message was dispatched.
- **Relying on the customer exception too widely.** It covers your own similar products only.

## How OmniChannels.ai helps

OmniChannels.ai is powered by BroadNet, which has direct routes to Vodacom, MTN South Africa, Cell C and Telkom Mobile. We set up your sender IDs, give you per-network delivery reports and support scheduling, opt-out handling and two-way SMS, with WhatsApp and SMS fallback in one platform. For indicative list prices, see our [South Africa SMS pricing page](/sms-pricing/south-africa/), then [book a demo](/demo/) to plan your South Africa launch.