---
title: "Bulk SMS in the UK: PECR Consent, Sender ID and Ofcom Rules"
description: "Bulk SMS UK guide: PECR regulation 22 and the soft opt-in, UK GDPR, Ofcom's 2027 sender ID verification rules, MEF registry, EE, Vodafone, O2 and Three routes."
canonical: "https://omnichannels.ai/blog/bulk-sms-united-kingdom-guide/"
language: "en"
updated: "2026-11-06"
publisher: "BroadNet Technologies"
brand: "OmniChannels.ai"
category: "sms"
primaryQuery: "bulk sms uk"
keywords: ["bulk sms uk", "bulk sms united kingdom", "pecr sms marketing", "soft opt-in sms", "sms sender id uk", "ofcom sender id verification", "mef sender id protection registry", "otp sms uk"]
published: "2026-11-06"
author: "OmniChannels.ai Editorial Team"
reviewer: "BroadNet Messaging Solutions Team"
readingMinutes: 9
answer: "To send bulk SMS in the UK, use a provider with direct routes to EE, Vodafone, O2 and Three, get consent for marketing texts under PECR regulation 22 (or meet the three soft opt-in conditions), and include a simple free opt-out. Alphanumeric sender IDs of up to 11 characters need no registry today, but from 15 July 2027 Ofcom's rules require providers to verify business sender IDs."
takeaways: ["PECR regulation 22 bars unsolicited direct marketing by electronic mail to individuals unless they consented or the soft opt-in applies; the soft opt-in has three conditions and the UK GDPR sets the standard for valid consent.", "Our regulation data shows no formal sender ID registry in the UK today, but Ofcom's final rules (15 July 2026) require providers handling business messages to verify alphanumeric sender IDs from 15 July 2027.", "The MEF SMS SenderID Protection Registry is an industry scheme that lets brands protect their sender IDs against impersonation; it is separate from Ofcom's rules.", "Four mobile networks appear in our coverage data, all with direct routes: EE (234-30), Vodafone UK (234-15), O2 (234-10) and Three UK (234-20).", "The pound sign is in the GSM 7-bit alphabet, so UK copy fits 160 characters; the euro sign counts as two, and curly quotes and emoji force Unicode at 70."]
faq: 
  - q: "Is bulk SMS legal in the UK?"
    a: "Yes, for OTPs, service messages and marketing that follows the rules. Marketing texts to individuals fall under PECR regulation 22 and the UK GDPR, supervised by the ICO, while Ofcom regulates telecom providers. There is no single bulk SMS law, so the rules sit across several instruments."
  - q: "What is the soft opt-in for SMS?"
    a: "It is an exception in PECR regulation 22(3). You may text a person without prior consent if you obtained their details during a sale or negotiations for a sale, the marketing covers only your similar products or services, and they were given a simple, free way to refuse when the details were collected and in every message."
  - q: "Do I need to register a sender ID in the UK?"
    a: "Not with a formal registry today, according to our regulation data. From 15 July 2027, Ofcom's rules require providers handling business messages to verify alphanumeric sender IDs, so expect more checks from your provider. Brands can also protect names through the MEF SenderID Protection Registry. Confirm the current position during onboarding."
  - q: "What is the MEF SenderID Protection Registry?"
    a: "It is a registry run by the Mobile Ecosystem Forum that checks whether a sender using a brand's sender ID is authorised by that brand, to reduce impersonation in message headers. Aggregators can register and protect sender IDs on behalf of brands. If your name is protected, expect a letter of authorisation from the brand when a provider registers it."
  - q: "Does the pound sign fit in GSM-7?"
    a: "Yes. The pound sign is in the GSM 7-bit default alphabet, so a plain English message with prices in pounds fits 160 characters. The euro sign is in the extension table and counts as two. Curly quotation marks, the en dash and emoji are not in GSM-7 and switch the message to Unicode with 70 characters."
  - q: "Is there a legal sending time window for promotional SMS in the UK?"
    a: "We found no regulator-published time-of-day window for promotional SMS in the UK, and our regulation data records none. Send promotions in local daytime, avoid late evenings and early mornings, and keep OTPs and alerts on a transactional route that can run at any hour."
sources: 
  - title: "Privacy and Electronic Communications Regulations 2003, regulation 22, legislation.gov.uk"
    url: "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22"
  - title: "ICO: direct marketing and PECR"
    url: "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/"
  - title: "Ofcom: new rules to thwart text message scammers"
    url: "https://www.ofcom.org.uk/phones-and-broadband/scam-calls-and-messages/new-rules-to-thwart-text-message-scammers-and-protect-consumers-and-businesses"
  - title: "Mobile Ecosystem Forum: SMS SenderID Protection Registry"
    url: "https://mobileecosystemforum.com/sms-senderid-protection-registry/"
  - title: "3GPP TS 23.038: Alphabets and language-specific information"
    url: "https://www.3gpp.org/dynareport/23038.htm"
---

# Bulk SMS in the UK: PECR Consent, Sender ID and Ofcom Rules

Canonical: https://omnichannels.ai/blog/bulk-sms-united-kingdom-guide/
Language: en
Publisher: OmniChannels.ai by BroadNet Technologies

This guide is for marketing, e-commerce, banking and operations teams that want to send business SMS to UK mobile numbers: OTPs, delivery alerts, reminders and promotions. It explains who regulates what, how consent and the soft opt-in work, what is changing for sender IDs, which networks carry traffic and how UK text affects message length. It is a practical overview, not legal advice. Confirm your set-up with UK counsel before launch.

## What rules apply to bulk SMS in the UK?

Three layers apply: PECR and the UK GDPR for marketing consent (supervised by the ICO), Ofcom's conditions for telecom providers, and operator policy. Our regulation data lists the ICO and Ofcom as the bodies.

| Layer | What it covers | Where to check |
|---|---|---|
| PECR regulation 22 and UK GDPR | Consent and the soft opt-in for marketing texts | [legislation.gov.uk](https://www.legislation.gov.uk/uksi/2003/2426/regulation/22), [ico.org.uk](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/) |
| Ofcom | Duties on providers, including scam-message and sender ID rules | [ofcom.org.uk](https://www.ofcom.org.uk/phones-and-broadband/scam-calls-and-messages/new-rules-to-thwart-text-message-scammers-and-protect-consumers-and-businesses) |
| Operators (EE, Vodafone, O2, Three) | Routes, filtering | Onboarding with your provider |

## Do you need consent to send marketing SMS in the UK?

Yes, unless the soft opt-in applies. Regulation 22(2) says a person must not send, or instigate, unsolicited direct marketing by electronic mail to an individual unless the recipient has previously notified the sender that they consent. The ICO treats marketing texts as electronic mail for these purposes, and consent must meet the UK GDPR standard: freely given, specific, informed and unambiguous.

Regulation 22(3) sets the soft opt-in, which applies only if all three conditions are met:

1. you obtained the contact details in the course of a sale, or negotiations for a sale, of a product or service;
2. the marketing is for your own similar products and services only; and
3. the recipient was given a simple means of refusing, free of charge except for transmission costs, when the details were collected and in each later message.

Do not use the soft opt-in for bought or third-party lists, and keep it away from people who have already opted out. Our regulation data adds that double opt-in is the operator-preferred standard for marketing and that the STOP keyword is honoured network-wide as a one-step opt-out. See our [opt-in consent generator](/tools/opt-in-consent-generator/), [opt-in consent across channels](/blog/opt-in-consent-multichannel-campaigns/) and the definitions of [opt-in](/glossary/opt-in/) and [opt-out](/glossary/opt-out/).

## What is changing for sender IDs: Ofcom's 2026 rules and the MEF registry?

There is no formal sender ID registry in the UK today, but Ofcom has finalised rules that make providers verify business sender IDs. According to Ofcom's statement of 15 July 2026, rules for business-to-person (A2P) messaging apply from 15 July 2027, and rules for person-to-person messaging from 18 January 2027. Our regulation data records the same 15 July 2027 date for sender ID verification by providers.

For you, as a sender, that means:

- **Expect more checks from your provider:** know-your-customer information, proof that you may use the sender name, and monitoring of your traffic.
- **Protected and generic names:** providers must keep a policy on protected brand names and generic names such as "customer service", so a name that imitates a bank, public body or generic term may be refused.
- **Plan your names now:** register or document each alphanumeric ID, one per brand and purpose.

Separately, the **MEF SMS SenderID Protection Registry** is an industry scheme run by the Mobile Ecosystem Forum. It checks whether the sender using a sender ID is authorised by the brand, to reduce impersonation, and aggregators can register IDs for brands. If your name is protected, a provider will need your letter of authorisation. Draft one with the [sender ID letter generator](/tools/sender-id-letter-generator/), check rules with the [sender ID checker](/tools/sender-id-checker/) or the [UK sender ID page](/sender-id/united-kingdom/), and read [sender ID types explained](/blog/sms-sender-id-types-explained/). If you want us to prepare and file the registration with you, see [registrations](/services/registrations/); decisions stay with the registry, operators and regulators.

## Which operators carry SMS in the UK?

Four mobile networks appear in our coverage data, each with a direct route:

| Operator | MCC-MNC |
|---|---|
| EE (BT) | 234-30 |
| Vodafone UK | 234-15 |
| O2 (VMO2) | 234-10 |
| Three UK | 234-20 |

Our data lists alphanumeric sender IDs of up to 11 characters, with numeric long codes also supported, and records no lead time for a formal registry. Read delivery reports per operator, not just a blended rate. Our guide to [improving SMS delivery rates](/blog/sms-not-delivered-improve-delivery-rate/) explains how to diagnose gaps.

## How should you separate OTP and promotional traffic?

Keep OTPs, order updates and reminders on their own sender and route, with no promotion inside. A mixed message counts as marketing, which brings the consent rules, and it puts login codes at risk if marketing traffic is filtered.

| Traffic | Example | Practice |
|---|---|---|
| Transactional | OTP, delivery alert, appointment reminder | No offers inside; own sender; any hour |
| Promotional | Sale, loyalty offer | Consent or soft opt-in; opt-out in the message; daytime schedule |
| Mixed | "Your parcel has shipped. Get 10% off your next order" | Avoid; the offer makes it promotional |

For OTP wording and security see the [OTP authentication messages guide](/blog/otp-authentication-messages-guide/) and our [OTP service](/solutions/otp-notifications/) page. If you also use WhatsApp, read our [UK WhatsApp provider guide](/blog/best-whatsapp-business-api-provider-uk/).

## How does UK English affect SMS length?

Plain English with prices in pounds fits the GSM 7-bit alphabet, so one message holds 160 characters (153 per part when split). The pound sign is in the alphabet; the euro sign is an extension character counted as two. Curly quotation marks, the en dash and emoji are not in GSM-7 and move the whole message to Unicode with 70 characters (67 per part). See [GSM-7](/glossary/gsm-7/) and [concatenated SMS](/glossary/concatenated-sms/).

| Encoding | Single message | Per part when concatenated |
|---|---|---|
| GSM 7-bit | 160 characters | 153 |
| Unicode (UCS-2) | 70 characters | 67 |

These examples were counted against the limits:

| Message | Encoding | Characters | Parts |
|---|---|---|---|
| `Your code is 482913. Valid for 10 minutes. Never share it. Harbour Cafe` | GSM-7 | 71 | 1 |
| `Harbour Cafe: 2 coffees for £5 this Saturday only! Details: harbour.example/s. Opt out: reply STOP` | GSM-7 | 98 | 1 |
| `Harbour Cafe: your order #1042 is ready to collect. See you soon!` | GSM-7 | 65 | 1 |
| `Harbour Cafe: 2 coffees for €5 this Saturday only! Details: harbour.example/s. Opt out: reply STOP` | GSM-7 | 99 | 1 |
| `Harbour Café: “2 coffees for £5” this Saturday only! Opt out: reply STOP` | Unicode | 72 | 2 |

Row 4 shows the euro sign costing two characters. Row 5 becomes Unicode because of the curly quotes alone: the accented é is in GSM-7. Check final copy in the [SMS character counter](/tools/sms-character-counter/), and see [SMS character limits and Unicode](/blog/sms-character-limits-unicode-arabic/) for other scripts.

## When should you send?

We found no regulator-published time-of-day window for promotional SMS in the UK, and our regulation data records none. Agree sending hours with your provider, send promotions in local daytime (UK time, GMT or BST) and avoid early mornings and late evenings. OTPs and alerts can go at any hour. The [send time planner](/tools/send-time-planner/) helps with scheduling, and [SMS marketing rules by country](/blog/sms-marketing-rules-by-country/) compares markets.

## A worked example: a Bristol coffee chain

"Harbour Cafe" (synthetic) has 35 shops, an app and a loyalty scheme.

- It sends OTPs and order alerts from a numeric sender or a dedicated alphanumeric ID, with no offers inside.
- It collects marketing consent in the app and at the till, storing wording, timestamp and number, and relies on the soft opt-in only for customers who bought in the past and were offered a free opt-out.
- The weekly offer uses straight quotes, a pound sign and no emoji, so each message stays at one part.
- It documents who owns each sender name now, ahead of the July 2027 verification rules.
- Opt-outs feed one suppression list shared with email and WhatsApp.

## What is a launch checklist for the UK?

A short checklist keeps the first campaign clean. Work through it in order and keep the evidence for each step.

1. **Classify traffic** into transactional (OTP, alerts) and promotional.
2. **Decide the lawful route** for each promotional number: consent, or all three soft opt-in conditions.
3. **Document sender name ownership** and prepare an authorisation letter, ahead of provider verification in 2027.
4. **Write copy in GSM-7** and count it before approval.
5. **Test on all four networks:** EE, Vodafone, O2 and Three, including the opt-out.
6. **Schedule for local daytime** and watch delivery reports during the first sends.
7. **Review results by operator** and remove opted-out numbers from every list.

## What are the common mistakes?

- **Stretching the soft opt-in** to bought lists or to people who never bought.
- **No simple opt-out** in each marketing message.
- **Look-alike or generic sender names** that providers may refuse after July 2027.
- **Mixing OTP and promotion.**
- **Curly quotes and emoji** that double the part count.
- **Ignoring per-operator reports.**

## How OmniChannels.ai helps

OmniChannels.ai is powered by BroadNet, which has direct routes to EE, Vodafone, O2 and Three in our coverage data. We support consent-aware campaigns with suppression handling, per-operator delivery reports and SMPP 3.4 for high volume, and we prepare and file sender registration and authorisation with you. For indicative list prices see the [UK SMS pricing page](/sms-pricing/united-kingdom/), then [book a demo](/demo/). Comparing providers? Read our vendor-neutral [bulk SMS provider checklist](/blog/choose-bulk-sms-provider/).