People read their texts. That is why texts work for small businesses, and it is also why the UK regulates them so tightly. A list of 800 customer mobile numbers can bring in real revenue from a well-timed text. Get the rules wrong, though, and you collect complaints and carrier blocks, and since February 2026 you also face much bigger possible fines.
This guide covers the rules as they stand in October 2026: what PECR requires, how the soft opt-in works, what changed under the Data (Use and Access) Act 2025, and a practical checklist you can apply this week.
Which law governs SMS marketing in the UK?
The ICO's guidance on electronic mail marketing explicitly covers texts as well as email. If you already run compliant email marketing, the same consent logic carries across. In practice, texts are more intrusive, people complain about them faster, and mobile networks act on spam reports.
The ICO is reviewing its PECR guidance to reflect the Data (Use and Access) Act. The core rules below still apply, but check the current page before you plan a large campaign.
Do I need consent before sending a marketing text?
"Specifically consented" means a clear, positive action. An unticked box that reads "Text me offers and news from Smith's Bakery" is fine. A pre-ticked box, or consent hidden in terms and conditions, is not.
Record the evidence for each number: when consent was given, where it was given (website form, till or booking page), and the wording shown at the time. If someone complains to the ICO, that record is your defence.
Business numbers need care. The ICO says you can text corporate bodies such as companies, LLPs and government bodies without prior consent. But a plumber trading as a sole trader is legally an individual, and you will rarely know who owns a mobile number, or their legal status, from the number alone. If you are unsure, treat them as an individual.
How does the soft opt-in work for existing customers?
Here is how that works for a hair salon. A client books online, and the form says "We may text you occasional offers. Untick to opt out." That client can later get a text about a quiet Tuesday colour offer. Someone who only asked about prices by phone and never booked is a doubtful case. Texting either of them about a partner's beauty products falls outside the rule completely.
What changed for charities under the Data (Use and Access) Act 2025?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and its provisions are being brought into force in stages. The charity exemption has its own conditions, so if you run a charity or a charity shop, check the current ICO guidance to confirm the provision is in force and how it applies to you before relying on it.
How big are the fines for SMS marketing breaches now?
Mishcon de Reya's analysis says the increase came from bringing section 115 and Schedule 1 of the Act into force. Even under the old £500,000 cap, the ICO handed out meaningful penalties for spam texts.
A clear recent example is the ICO's £200,000 fine against ESL Consultancy Services Ltd, announced on 22 January 2025. The ICO found the company used a third party to send marketing texts without making sure valid consent was in place, and tried to hide the sender's identity with unregistered SIM cards. The regulator received 37,977 complaints.
Fines at that level against small businesses are rare. The lesson is that outsourcing the sending does not outsource the liability.
What must every marketing text include?
A compliant text from a small business could look like this:
"Harbour Cafe: 2-for-1 cakes this Thursday only, show this text at the till. Reply STOP to opt out."
That covers four things: a recognisable sender, a specific and relevant offer, a short message, and an opt-out that takes the customer almost no effort. Most SMS platforms process STOP replies automatically. Test it on your own phone before your first send.
Are appointment reminders and order updates marketing?
This is where small businesses slip up most often. A dentist's reminder that says "See you at 10am Tuesday" is a service message. Add "and book your hygienist visit for 20% off" and it becomes a marketing text that needs consent or the soft opt-in.
Keep the two streams separate in your tools. If you are setting up automated reminders, this guide to AI appointment reminders for UK businesses covers the build. Run promotions as a distinct campaign sent only to opted-in numbers.
How should I collect and store mobile numbers properly?
Practical steps that hold up:
- Separate SMS from email consent. A customer may happily take emails but not want texts. Use two boxes.
- Capture at natural moments. Checkout, online booking and loyalty sign-up all work. If you already capture consent for email, the same flow works for texts and for abandoned cart emails.
- Keep one source of truth. When the same list is copied across a till system, a booking tool and an SMS app, opted-out numbers usually get texted again.
- Clean regularly. Remove numbers that have not bought in a long time from soft opt-in sends, because the link to the original purchase weakens over time.
For the wider UK GDPR side (retention, access requests and processor contracts with your SMS provider), work through this data protection checklist for UK small businesses.
How often should a small business send marketing texts?
A cafe texting a same-day offer once a fortnight will usually keep its list. If the same cafe texts every day it will lose people fast, and some will report the number as spam rather than reply STOP. Complaints are what bring the ICO's attention, so frequency is a compliance issue as well as a marketing one.
Test before you scale. Send two versions of the same offer to small segments and compare redemptions and opt-outs. This guide to A/B testing for UK small businesses sets out the method.
What is a sensible compliance checklist before the first send?
- Split your list into three groups: explicit SMS consent, soft opt-in customers, and everyone else. Never text the third group.
- Check the soft opt-in group only gets offers on your own similar products.
- Set a recognisable sender name and put the business name in the message.
- Add "Reply STOP to opt out" and test that it suppresses the number.
- Confirm your SMS provider has a data processing agreement with you.
- Send to a small batch, read the replies, then send to the rest.
A well-built email and CRM setup keeps your SMS consent, email lists and customer records in one system, with opt-outs that apply everywhere.
SMS Marketing UK Rules for Small Business 2026 — FAQ
Do I need consent to send marketing texts to customers in the UK?
Usually, yes. Under PECR you must not send marketing texts to individuals unless they have specifically consented to texts from you. For most small businesses the one exception is the soft opt-in. It covers people who bought from you, or negotiated to buy, and were given a clear chance to opt out when you collected their number. It only covers your own similar products and services, and every message has to include a way to opt out. Sole traders and some partnerships get the same protection as individuals. Bought-in lists and new prospects are never covered by the soft opt-in. For anyone outside your existing customer base, you need clear, recorded consent before you send the first text.
What is the maximum fine for breaking SMS marketing rules in 2026?
According to Mishcon de Reya, the Data (Use and Access) Act 2025 raised the maximum penalty for PECR breaches from £500,000 to £17.5 million or 4% of global annual turnover, whichever is higher, and those powers came into force on 5 February 2026. PECR is the law that covers marketing texts, so the higher ceiling applies to them. Real penalties for small firms are much lower than the maximum, but they can still be large. In January 2025, before the cap went up, the ICO fined ESL Consultancy Services Ltd £200,000 over nuisance texts that led to 37,977 complaints. For a small business the bigger day-to-day risk is usually complaints, carrier blocks and losing the list, not the headline maximum.
Can I text a list of numbers I bought from a data supplier?
Treat bought-in lists as a no for SMS marketing. The ICO's guidance says the soft opt-in does not apply to prospective customers or new contacts such as bought-in lists. You would have to rely on consent the supplier says it collected, and that consent has to name you specifically or clearly describe your type of business. In practice most purchased lists cannot prove that. In the ICO's £200,000 fine against ESL Consultancy Services in January 2025, the company had used a third party to send texts without making sure valid consent existed. Using a supplier does not move the legal responsibility off you. If you want to grow a list, collect numbers yourself with a clear opt-in at checkout, booking or sign-up.
Are appointment reminders and order updates covered by the same rules?
Purely factual service messages, such as an appointment time, a delivery slot or a payment receipt, are not marketing, so the PECR consent rules for marketing do not apply to them. The risk comes from mixing the two. Once a reminder includes an offer, a discount code or a push to book something extra, it becomes marketing and needs consent or a valid soft opt-in. Keep service texts strictly factual. If you want to promote something, send it as a separate marketing text to people who have agreed to receive them. You still need a lawful basis under UK GDPR to hold and use the phone number for service messages. For most businesses that basis is that the number is needed to deliver the booking or order.
What has to be in every marketing text I send?
The ICO's guidance sets two firm requirements. First, you must not disguise or conceal who you are, so the recipient has to be able to tell the text comes from your business. Second, you must give a valid way to opt out, and under the soft opt-in you must offer that opt-out in every single message. The usual approach is a reply keyword such as STOP that your platform processes automatically. Good practice adds a short, recognisable sender name, the business name in the body if the sender ID is a number, and a clear reason for the message. Once someone opts out, suppress their number across every tool you use, not just the one they replied to.
