Understanding how GDPR affects SMS in Europe

You will learn

Learn about best practices for SMS marketing in the European Union (EU).

SMS in Europe is currently available in the UK, Ireland, Germany, France, Austria, Spain, Switzerland, Denmark, Sweden, Norway, Finland, Italy, Portugal, Belgium, Poland, Hungary, the Netherlands, and Luxembourg.

For SMS marketing in the EU, key laws include:

• EU General Data Protection Regulation (GDPR)
• EU ePrivacy Directive and national laws implementing it

Please note, certain countries may have country-specific laws and regulations that apply to SMS marketing and are not included in this guidance.

SMS compliance in the EU

There are a number of compliance dos and don’ts for SMS marketing in the EU:

• Do:
  • Obtain explicit consent from recipients before messaging them.
  • Allow recipients to easily opt out.
  • Only send during daytime hours (i.e., not during quiet hours).
  • Support HELP and STOP keywords, as well as supported equivalents in the recipient’s local language, when using a sending number that can receive replies.
  • Clearly identify your brand or organization in your messages.
• Do not:
  • Send to recipients on do-not-call or do-not-disturb registries.
  • Include prohibited content in your messages.

The following sections explain these practices in more detail.

Obtain explicit consent

When collecting consent in the EU, you must provide a clear and detailed explanation of how you plan to use the subscriber’s information. Under GDPR, consent needs to be “freely given, specific, informed, and unambiguous.”

When asking for consent:

• Make it easy for recipients to opt out (e.g., via an opt-out keyword or unsubscribe link).
• Provide links to your privacy policy and terms of service.
• Be clear about what information you are collecting and how you are going to use it.
• Be clear about what subscribers are subscribing to.
• Ask for consent for each specific purpose (e.g., if you collect consent for both SMS and email, use separate fields for each channel so that someone has the option to subscribe to one and not the other).
• Make sure the subscriber has to take an active step (e.g., checking an unchecked box) to relay their consent.
• Make sure consent is not conditional on receiving a good or service.
• Do not accept consent from children under 16 unless you have permission from the holder of parental responsibility over the child.
• Keep accurate records of when, where, how, and for what purpose a subscriber gave you their consent.

Under GDPR, there are other bases (like “legitimate interest”) that may be relied on instead of explicit consent. However, when using Klaviyo SMS, you need to obtain explicit consent from recipients using the guidelines mentioned above.

Only send during daytime hours

In most countries in the EU, SMS messages should not be sent too late or too early in the day.

In general, send in your recipient’s local time and avoid sending:

• Before 9 a.m.
• After 8 p.m.

* For the US, most of the country is covered by the TCPA, which allows sending from 8 a.m. to 9 p.m. However, several states (such as Florida) have enacted mini-TCPAs for their state and limit sending to between 8 a.m. and 8 p.m.

** Quiet hours in France are enforced by wireless carriers. This means that you may legally be allowed to send Sundays, but your messages won’t be delivered. The carriers may also decide to filter your other messages if you continue to send outside of the quiet hours.

Check your Klaviyo quiet-hour settings as well as the guidance above. Your account’s configured hours can be more restrictive. Learn more about quiet hours in flows.

Identify your brand/organization

As a best practice, each text message you send to recipients in the EU should identify you as the sender. Many companies do this by either:

• Customizing their sender ID (when using branded sender IDs)
• Including their organization name at the start of each message (when using long or short codes)

You can manage your branded sender ID under Settings > Text message > Sender information. See how to set up your branded sender ID for setup and registration requirements.

To add your organization’s name to the start of an SMS, open Compliance in the message editor and make sure Organization prefix is on. This option is on by default. The countries where it applies are listed beneath the option.

Do not include prohibited content

Wireless carriers may refuse to deliver SMS messages that reference or otherwise contain content relating to certain topics, including:

• Illegal substances
• SHAFT
  • Sex
  • Hate
  • *Alcohol
  • *Firearms
  • Tobacco (including CBD)
• Fireworks
• Gambling
• Debt collection/forgiveness
• High-risk financial services (e.g., cryptocurrency)
• Multi-level marketing

* Alcohol and firearms may be permitted in certain countries when age-gating is enabled.

While not all of these topics are prohibited in every country, carriers periodically reassess what content they will allow and don't always make this information public in a timely or formal manner. It's best to avoid content related to these topics in any country you're sending to.

Anything related to these prohibited topics in either your messages or website may result in those messages getting filtered by the carrier or the carrier completely blocking the sending number. For more information, read our article on prohibited SMS content.

Allow people to opt out easily

Each text message you send to recipients in the EU must also include an opt-out mechanism. Many companies do this by:

• When using branded sender IDs: including an unsubscribe link in their messages, since recipients cannot reply to these sender IDs.
• When using long or short codes: adding an opt-out keyword at the end of the text messages.

In Klaviyo’s message editor, open Compliance and use Unsubscribe instructions for sending numbers that support replies or Unsubscribe link for branded sender IDs. These options are on by default, and the countries where each applies are listed beneath it.

Support HELP and STOP keywords

When using a sending number that can receive replies, support HELP and STOP commands and supported equivalents in the recipient’s local language. Branded sender IDs cannot receive replies, so use an unsubscribe link instead.

For sending numbers that support replies, Klaviyo automatically handles English keywords such as:

• YES and Y
• HELP and INFO
• STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT
• START and UNSTOP

Klaviyo also supports local-language keywords, such as HILFE for help and STOPP to unsubscribe in German. Available languages depend on the recipient’s country code. See SMS compliance keywords in Klaviyo for supported languages and how keyword responses work.

Do not contact users on do-not-call or do-not-disturb registries

As a guideline, don’t contact anyone on do-not-call or do-not-disturb registries. Many EU countries have their own registries.

Additional resources