Skip to content 
SMS and WhatsApp marketing can be powerful for UK businesses. Messages land straight in someone’s hand, and people tend to read them fast. That is great for sales, but it also means regulators pay close attention when consent and unsubscribe rules are ignored under PECR and UK GDPR.
In this guide, we walk through how PECR applies to SMS and WhatsApp, how consent and soft opt-in really work, and how to build simple unsubscribe tools that keep you on the right side of the law. We also look at how your email marketing opt-in and opt-out approach can help you build safer mobile campaigns that people actually trust.
How PECR Applies to SMS and WhatsApp
PECR sits alongside UK GDPR and the Data Protection Act. While UK GDPR deals with personal data in general, PECR focuses on electronic direct marketing, including:
- SMS and text messages
- Messages sent through apps like WhatsApp, Facebook Messenger, and similar tools
A message counts as direct marketing when it promotes or nudges someone to buy. That covers things like:
- Discount codes and sales alerts
- Abandoned basket nudges
- Loyalty offers and referral prompts
- Seasonal pushes for events, travel or local services
By contrast, purely service or transactional messages are different. These are things like:
- Order confirmations and receipts
- Delivery updates
- Password resets and security alerts
Once you add any upsell, cross-sell or promo wording inside those messages, PECR marketing rules kick in again.
The rules apply no matter how small your list is and no matter where you are in the UK, whether you are a solo trader in a home office or part of a bigger team. B2B contacts also need care because sole traders and some partnerships are treated like individual consumers, not corporate subscribers. As spring rolls into summer and campaigns ramp up around festivals, travel and retail offers, SMS and WhatsApp campaigns often increase, and that is when mistakes are most likely.
Getting Lawful Consent for SMS and WhatsApp
For many SMS and WhatsApp campaigns, your lawful basis will be consent. Under UK GDPR, valid consent must be:
- Freely given, without pressure
- Specific, not bundled together for all channels
- Informed, with clear wording
- Unambiguous, with a clear positive action
That means no pre-ticked boxes, no hiding consent in long terms, and no forcing people to accept all channels at once.
Good sign-up flows usually:
- Offer separate choices for email, SMS and WhatsApp
- Explain who is sending the messages
- Describe the type of content, such as offers, tips or reminders
- Set expectations about how often you will message
Lawful consent can be captured in different places, for example:
- Ticks at online checkout, clearly labelled per channel
- Pop-ups on a mobile site that list SMS and WhatsApp separately
- QR codes at an event that lead to a clear consent page
- In-store tablets where staff help people choose their preferences
- WhatsApp click-to-chat flows, where consent text appears just before someone agrees to receive messages
Record-keeping is easy to forget but very important. You need to log:
- Date and time of consent
- Source of consent, like checkout or event QR code
- The exact consent wording at that time
- Any technical details you rely on, such as form ID or device data
These records help you respond if someone complains or if the ICO asks questions. Keep them as long as you rely on that consent.
Using Soft Opt-in Safely for SMS and WhatsApp
Soft opt-in under PECR is a limited rule that sometimes lets you send marketing messages without fresh explicit consent. It can apply to SMS and, with care, to WhatsApp. To rely on soft opt-in, you must meet all of these conditions:
- You got the contact details during a sale or clear talks about a sale
- You are promoting your own similar products or services
- You gave the person a clear chance to refuse marketing at the point of data collection
- You give an easy opt-out every time you send a message
Edge cases need care. Some examples that might count as sale negotiations:
- A free trial where card details or serious sign-up data are taken
- A quote request that shows real intent to buy
- A detailed contact form where someone asks about prices or packages
On the other hand, simple contact forms, support tickets or general questions usually do not count as sale negotiations. Buying third-party lists is not soft opt-in. Using support or complaint phone numbers for promo SMS is also risky.
A local gym might use soft opt-in to send class offers to current members who joined online and were given a clear opt-out at sign-up. An online retailer might text existing buyers about similar items or early access to sales. But pushing unrelated services or using data that came from job applications or support chats would not fit the rule.
Designing Clear and Reliable Unsubscribe Mechanics
PECR requires that every marketing message includes a simple way to opt out. For SMS and WhatsApp this usually means:
- For SMS: short text like “Reply STOP to opt out”
- For WhatsApp: a clear line such as “Reply STOP to stop marketing messages”
You can also link to a preference centre where people can change their email marketing opt-in and opt-out status and set SMS or WhatsApp choices. Just make sure they do not have to fight through a long sign-up or log-in process first.
Behind the scenes, teams need to:
- Process opt-outs as soon as possible
- Sync preferences across CRM, email tools, SMS platforms and WhatsApp Business tools
- Respect requests for service-only messages, where someone still wants delivery updates but not offers
Avoid common mistakes like:
- Charging people to unsubscribe, for example by using premium-rate short codes
- Ignoring reply words like “STOP ALL” or “NO MORE” that clearly show someone wants out
- Re-adding people to lists without a fresh, lawful reason
Practical Checklist, Key Takeaways and FAQs
Here is a simple checklist for summer and Q3 campaigns using SMS and WhatsApp:
- Confirm which contacts rely on consent and which rely on soft opt-in
- Review consent wording, including any links from QR codes or in-store forms
- Check how and where you log consent details
- Test unsubscribe flows regularly using real phones and real journeys
- Align your email marketing opt-in and opt-out setup with your mobile messaging
Key points to remember:
- PECR always applies to promotional SMS and WhatsApp messages
- Consent must be clear, separate and based on a real choice
- Soft opt-in is narrow and only for your own similar products or services
- Opt-out tools must be easy, obvious, free and fast
Frequently asked questions:
Q1: Can I rely on existing email consent for SMS and WhatsApp marketing?
A: Usually no. Each channel should have its own clear consent unless your original wording plainly listed SMS and WhatsApp and the person had a real choice to say yes or no.
Q2: Do PECR rules apply to B2B SMS and WhatsApp messages?
A: Yes in many cases. Corporate subscribers are treated differently from individuals, but sole traders and some partnerships are protected like consumers, and UK GDPR still applies to all personal data.
Q3: Are service updates and order notifications treated as marketing?
A: Pure service messages, such as delivery times or password resets, are not marketing. But if you add a promo code, link to a sale or invite to buy more, the message becomes direct marketing.
Q4: How quickly must I act on an unsubscribe request?
A: As soon as you reasonably can. In practice, near real-time processing is expected, and keeping someone on a list after they have opted out increases the risk of complaints and regulatory action.
Q5: Can I use WhatsApp groups or broadcasts for promotions?
A: Groups raise extra privacy problems because members can see each other’s phone numbers. Broadcast lists, used only with proper consent and clear opt-out wording, are usually a safer way to send ongoing marketing messages.
Protect Your Email List With Compliant Opt-In And Opt-Out Strategies
If you are unsure whether your current practices meet legal standards, we can review your systems and help you put robust, user-friendly controls in place. At Stay Legal, we focus on practical guidance that keeps your marketing effective while respecting subscriber rights. Book a consultation today to discuss your email marketing opt-in and opt-out approach and reduce your regulatory risk. We will help you create clear processes that build trust with your audience and support long-term business growth.
