Mobile Messaging and GDPR: SMS, WhatsApp and Push Consent

Mobile Messaging and GDPR: SMS, WhatsApp and Push Consent

Under GDPR, you can send marketing by SMS, WhatsApp or push notification only if you have a lawful basis and also meet the ePrivacy rules for electronic marketing. In practice that usually means clear, opt-in consent, with a narrow exception for existing customers, plus an easy opt-out in every message.

This guide is for marketers, CRM owners and IT teams in organizations that message people in the EU or UK and want a working compliance setup, not just a policy.

This article is general information, not legal advice.

Key takeaways

  • GDPR asks why you may process a phone number at all (lawful basis), while ePrivacy rules decide whether you may send electronic marketing to it.
  • In the UK, the ICO says you must not send marketing texts to individuals without specific consent, unless the "soft opt-in" for existing customers applies.
  • Valid consent is freely given, specific, informed and unambiguous, and the EDPB says pre-ticked boxes are invalid.
  • Apple's App Store rules require explicit opt-in through in-app consent language before you send promotional push notifications.
  • GDPR fines can reach up to 20 million euros or 4% of a company's global annual turnover, according to the EDPB.

How do GDPR and ePrivacy rules fit together for mobile messaging?

Two layers apply at once. GDPR governs your use of personal data, such as a phone number or app user ID. The ePrivacy rules, set by the EU ePrivacy Directive (2002/58/EC) and national laws that implement it, govern electronic marketing and access to people's devices.

The European Commission makes the connection explicit: if you use electronic communication tools for direct marketing, you must also comply with the ePrivacy Directive, particularly Article 13, on top of GDPR (European Commission guidance on marketing data). The UK runs the same structure through UK GDPR and the Privacy and Electronic Communications Regulations, known as PECR.

The ICO explains the practical effect. PECR has no lawful bases of its own, but where it requires consent for a channel, consent is the likely lawful basis under data protection law too. Where PECR allows the soft opt-in, legitimate interests can work (ICO, choosing your lawful basis).

Two definitions worth fixing in your head:

  • Lawful basis: one of the six legal grounds GDPR allows for processing personal data: consent, contract, legal obligation, public interest, vital interests and legitimate interests (EDPB SME guide).
  • Direct marketing: promotional messages aimed at a particular person. A delivery update isn't marketing; a discount code is.

If you also process employee phone numbers for internal alerts, the employee side has its own rules, which we cover in GDPR and HRMS employee data privacy.

Do you need consent to send marketing SMS?

Usually yes. For texts to individuals, consent is the default, and the only common exception is the soft opt-in for your own existing customers.

The ICO's electronic mail marketing guidance treats texts, picture and video messages and social media direct messages as "electronic mail." You must not send marketing to individuals by these channels without specific consent, such as an opt-in box they've ticked. The soft opt-in lets you skip fresh consent only when all of these are true:

  • The person bought, or negotiated to buy, a product or service from you.
  • You're marketing your own similar products or services.
  • You gave a simple way to opt out when you collected the number, and you give one in every message.

It doesn't cover prospects, bought-in lists or charity and political campaigns. The ICO notes this guidance is under review after the Data (Use and Access) Act, so check for updates. EU member states have their own national versions of these rules, and they don't all read the soft opt-in the same way.

Messages also need to identify you, give a valid contact address and offer an opt-out by reply or link that you honor promptly.

If you text job applicants in the US, the rules differ again; see our guide to SMS consent for text-to-apply hiring.

What makes consent valid under GDPR?

Valid consent is freely given, specific, informed and unambiguous, and you must be able to prove it. If any one of those is missing, the consent doesn't count.

The EDPB's Guidelines 05/2020 on consent spell out what that means for sign-up flows:

  • No pre-ticked boxes. The EDPB says the use of pre-ticked opt-in boxes is invalid under GDPR.
  • No bundling. Consent tucked into general terms and conditions is presumed not to be freely given.
  • Separate purposes. If you want to text offers and also share numbers with group companies, ask for each separately.
  • Easy withdrawal. Withdrawing must be as easy as giving consent. The guidelines cite a festival that only accepted withdrawals by phone during business hours as non-compliant.
  • Don't make it a condition. Tying a service to consent for processing it doesn't need is presumed not to be freely given.

Right to object matters too. The European Commission says people can object to direct marketing at any time, after which you may no longer process their data for that purpose, and you must tell them about this right, free of charge, at the latest at your first communication (European Commission on objections).

How do the rules apply to WhatsApp and push notifications?

The same consent logic applies, with platform rules layered on top. WhatsApp and the app stores add their own opt-in requirements, and breaking them can get your account limited even if a regulator never looks.

ChannelLegal layerPlatform layerPractical default
SMS / MMSElectronic mail rules: consent or soft opt-in for individualsCarrier and sender ID rules vary by countryOpt-in checkbox, STOP keyword in every message
WhatsApp BusinessGDPR lawful basis; messaging is likely treated like electronic mail where it's sent to individualsMeta requires opt-in naming your business before you messageSeparate opt-ins for service updates and promotions
App pushGDPR lawful basis; ePrivacy device access rules for identifiers and SDKsApple requires explicit in-app consent for promotional pushes and an in-app opt-outOS permission plus a separate marketing toggle
Social media DMsTreated as electronic mail by the ICOEach platform's messaging policyDon't send unsolicited promotional DMs

WhatsApp

Meta's WhatsApp opt-in documentation says businesses must get opt-in before messaging people. The person must be told they're agreeing to receive messages and which business will send them, and you must follow applicable law. Meta recommends separate opt-ins by category, such as order updates versus promotions, and warns that low quality ratings from blocks and reports can lead to rate limits.

Push notifications

A push permission from the operating system isn't marketing consent. Apple's App Review Guidelines (4.5.4) say push notifications shouldn't be used for promotions or direct marketing unless customers have explicitly opted in through consent language in your app's UI, and you provide an in-app way to opt out.

Push also touches device access. The EDPB's Guidelines 2/2023 on Article 5(3) of the ePrivacy Directive say storing or reading information on a user's device needs consent unless an exemption applies, and that this covers device identifiers and SDKs that send stored data off the device, and tracking pixels in messages. Your analytics SDKs need the same scrutiny as your marketing copy. Our explainer on how mobile apps track users shows what that looks like from the user's side.

What is a practical GDPR checklist for mobile messaging?

A workable program comes down to collecting consent properly, storing proof, honoring opt-outs everywhere, and auditing what your tools do. Work through these steps in order:

  1. Map every channel and message type. List SMS, WhatsApp, push, in-app and DMs, and tag each message as service or marketing.
  2. Pick a lawful basis per message type. Service messages often rest on contract; marketing to individuals usually needs consent or a valid soft opt-in.
  3. Redesign the opt-in. Unticked boxes, one per channel and purpose, with your business name and what people will receive.
  4. Record proof. Store who consented, when, where, to what wording and on which channel. Your CRM's consent and audit features should hold this, not a spreadsheet.
  5. Sync opt-outs across systems. A STOP reply on SMS should suppress WhatsApp promotions too if that's what the person expects.
  6. Vet vendors. Sign data processing agreements with SMS gateways and messaging providers and check where they store data.
  7. Audit SDKs and tracking. Confirm which identifiers your app and links collect and whether consent covers them.
  8. Write the privacy notice for mobile. Short, layered, and including the right to object to direct marketing.
  9. Review quarterly. Check opt-out handling times, complaint rates and platform quality ratings.

Common mistakes with SMS, WhatsApp and push consent

  • Treating a checkout number as marketing consent. A number given for delivery updates isn't permission for promotions, unless the soft opt-in conditions were met at collection.
  • Buying or renting lists. The Commission says you must be able to show third-party data was collected lawfully and may be used for advertising. Most purchased mobile lists fail that test.
  • Sneaking promotions into service messages. A shipping text with a discount code is a marketing message.
  • Relying on the OS push prompt. Accepting notifications isn't agreeing to marketing.
  • Forgetting B2B nuance. The ICO says corporate subscribers aren't covered by the same consent rule, but sole traders are treated as individuals, and GDPR still applies to named employees.

Good consent practice also helps engagement. People who chose a channel complain less and churn less, which ties into reducing churn by listening to customers.

FAQ

Can I use legitimate interests for marketing texts?

Only in narrow cases. The ICO says legitimate interests can work for texts to individuals where the soft opt-in applies, meaning existing customers, similar products and an opt-out offered at collection and in every message. For prospects or bought-in numbers, PECR requires consent, so consent becomes your lawful basis under data protection law as well.

Does GDPR apply to transactional messages like delivery updates?

Yes. GDPR covers any processing of a phone number or app ID, so you still need a lawful basis, often contract, and a privacy notice. The extra ePrivacy consent rules target marketing, though, so a pure service message doesn't need marketing consent. Once you add promotional content, it becomes marketing and the stricter rules apply.

Is a WhatsApp opt-in collected on my website valid?

It can be. Meta lets businesses collect opt-in through a website, SMS, phone flow or paper form, as long as the person is told they're agreeing to messages and from which business. For GDPR, the same form must meet the consent standard: unticked, specific to the purpose, and easy to withdraw.

How big are the fines for getting messaging consent wrong?

Under GDPR, the EDPB says fines can reach up to 20 million euros or 4% of a company's global annual turnover. ePrivacy breaches are enforced under national laws with their own penalty regimes. Regulators also order companies to stop processing, which can halt a campaign channel entirely.

What to do next

  1. Pull a sample of 20 recent mobile messages and label each as service or marketing, with the lawful basis you rely on.
  2. Screenshot every opt-in point in your app, site and checkout and compare it with the EDPB consent criteria above.
  3. Test a STOP reply and an in-app opt-out end to end and time how long suppression takes.
  4. If you use generative AI to draft or personalize messages, review the privacy points in our guide to generative AI and data privacy under GDPR and CCPA.

Sources

Last reviewed: October 2026.

Comments

Post a Comment

Popular Posts

Why Workday Onboarding Breaks Down for Frontline Employees

Image
Workday onboarding breaks down for frontline employees because its default setup assumes every new hire has an email address, a personal device, time at a desk and comfort with a web portal. Warehouse, retail, food service and healthcare aide roles often have none of those. The fix is mostly configuration and process, not a new system. This guide is for HR, HRIS and operations leaders who run Workday and keep seeing incomplete onboarding records, late I-9s and new hires who quit before their first paycheck. Key takeaways Default Workday onboarding is built around desk workers. Frontline failures are predictable and mostly fixable through configuration. The five usual breakpoints are email-based logins, no reliable device, digital comfort, shift timing and language. Split compliance-critical tasks (I-9, tax forms, direct deposit) from tasks that can wait, and handle I-9 in person. Kiosks, ID-based logins, text reminders and a supervisor checklist close most of the gap. Measure...
Read more

Interview Tips for Beginners: A Step-by-Step Prep Plan

Image
The best interview tips for beginners come down to preparation you can repeat: study the job description, research the employer, prepare four to six short stories that prove your skills, practice answering out loud, prepare your own questions and follow up within a day. Confidence comes from rehearsal, not from experience you don't have yet. This plan is for students, recent graduates and career changers facing their first few interviews, and for anyone who freezes when asked "tell me about yourself." Key takeaways Match your preparation to the job description, line by line. Use the STAR format (situation, task, action, result) for behavioral questions. School, volunteer and part-time examples count when you have little work history. Practice aloud at least twice; silent rehearsal isn't enough. Prepare two or three thoughtful questions for the interviewer. What does a one-week interview prep plan look like? If you have an interview scheduled, this plan s...
Read more

How to Improve the Customer Experience (CX)

Image
To improve customer experience, find the moments where customers struggle most, fix those first, and make good service consistent across every channel. Then close the loop on feedback, give front-line staff the time and tools to solve problems, and track a small set of metrics someone actually owns. This guide is for leaders and managers who own some part of the customer relationship, whether that's support, sales, operations or the product itself. Customer experience is the sum of every interaction someone has with your company, from the first ad they see to how a return is handled years later. Teams that struggle usually confuse a good satisfaction score with real improvement, or fix the wrong things. Key takeaways Look at behavior (drop-offs, ticket spikes, failed searches), not just surveys. Fix the biggest sources of friction before polishing what already works. Collecting feedback and doing nothing with it makes customers more frustrated. Consistency across people a...
Read more

Are Mobile Apps Tracking Your Every Move? How to Check

Image
Mobile apps can track your location and activity, but only as far as the permissions on your phone allow. Open your privacy settings, find apps with "always" location access, switch most to "while using" or off, limit your advertising identifier and delete apps that ask for more than they need. Ten minutes covers most of it. This is for anyone who has noticed ads that seem to know where they've been, or who simply hasn't looked at app permissions since setting up the phone. Key takeaways Location, contacts, photos, microphone and camera access are all controlled by per-app permissions. Background ("always") location access is the setting most worth reviewing. Advertising identifiers let companies link your activity across apps; you can limit or reset them. Turning off location doesn't stop account-based tracking inside apps you sign in to. Work phones can carry extra monitoring set by your employer, governed by company policy. How ...
Read more

Are Biometrics Better Than Passwords? What NIST Says

Image
Biometrics beat passwords in some ways and lose in others. You can't forget a fingerprint, reuse it across sites or type it into a phishing page, so logins get faster and harder to steal. But you can't change a face if its data leaks, which is why NIST says a biometric should never be used alone, only alongside a physical device. This guide is for IT, security and HR leaders deciding how far to move their workforce away from passwords. Key takeaways Biometrics fix common password problems: reuse, weak choices and forgotten credentials. NIST SP 800-63B says a biometric "is not recognized as an authenticator by itself." The strongest pattern is a biometric that activates a key stored on a device, as with passkeys and security keys. Workplace biometrics bring notice, consent and retention duties under some state laws. Always offer a non-biometric alternative. Why do passwords keep failing? Passwords depend on people choosing, remembering and guarding secret...
Read more

How to Market Your Handyman Services to Small Business Owners

Image
To market handyman services to small business owners, position yourself as the reliable, flexible vendor who can handle many small jobs with little disruption. Make your Google Business Profile and website clearly commercial, pick two or three business types to target, visit them in person, offer a simple service account, and ask every client for reviews and referrals. This is for independent handymen and small maintenance crews who rely on word of mouth and want a steadier flow of repeat commercial work. Referrals are great until they dry up for a month. Small businesses are a strong target because they have constant maintenance needs, little in-house help, and a clear preference for vendors they can call again and again. Key takeaways Business owners buy speed, reliability and minimal disruption, not just repairs. Say that in your marketing. Your Google Business Profile should clearly describe commercial work and the business types you serve. Focus on a few business types (r...
Read more

Dollar General Store Walkout: Lessons for Retail HR

Image
In March 2024, every employee at a Dollar General store in Mineral Point, Wisconsin, quit at once and taped "We quit" signs to the doors. They cited a lack of appreciation, being overworked and being underpaid, plus a dispute over a rule about which unsold items could be donated. The store reopened about three hours later. The story went viral because it was so visible, but the lesson is quieter. For HR and operations leaders who run hourly, small-team locations, this is a case study in how a minor policy can become the last straw. Key takeaways A policy change triggered the walkout, but the notes employees left pointed first to workload, pay and recognition. Rules that clash with frontline values, such as throwing away usable goods, become flashpoints when trust is already low. Explaining why a rule exists, and giving local teams a way to push back, costs far less than losing a whole store team. Treat a mass resignation as a lagging indicator. The warning signs show...
Read more

Boss Retaliation and False Accusations: Protect Yourself

Image
To protect yourself from boss retaliation and false accusations, keep a dated written record, answer accusations with facts rather than anger, use your employer's complaint channels, and learn which laws cover you. Retaliation for protected activity, like reporting discrimination or a safety hazard, is illegal under federal law, and agency filing deadlines can be very short. This guide is for employees who sense that something changed after they spoke up, and for anyone suddenly facing an accusation they know is untrue. Key takeaways Retaliation is illegal when it follows protected activity, such as reporting discrimination or safety concerns. A dated, factual record is your strongest protection. Respond to false accusations in writing, with evidence, and without counterattacking. Use internal channels first when it's safe, but know the external deadlines. An employment attorney can advise on your specific situation. This article is general information, not legal a...
Read more

How Do I Log In and Sign In to Workday HCM

Image
To log in to Workday HCM, open your organization's own Workday URL (there's no single public login page), then sign in either with your Workday username and password or through your company's single sign-on. If you're locked out, use "Forgot password" for native logins, or your corporate password reset for SSO, and contact HR or IT if neither works. This guide is for employees and managers signing in for the first time, people who've just switched employers, and anyone stuck at the login screen. Most Workday access problems come down to the wrong URL, the wrong login method, or an account that needs an admin to reset it. Key takeaways Each employer has its own Workday tenant and URL. Get it from HR, IT or your onboarding email; don't guess. If your company uses SSO, your Workday password is your normal work password, and resets happen through your company, not Workday. The mobile app asks for your organization's details first, then signs y...
Read more

Predictive Scheduling Laws: Where They Apply and How to Comply

Image
Predictive scheduling laws require covered employers to give hourly workers their schedules in advance, usually 14 days, and to pay a premium when the employer changes a shift after posting. Oregon has a statewide law, and cities including Seattle, New York City, Chicago, Los Angeles, San Francisco and Philadelphia have their own ordinances. This guide is for HR, operations and payroll leaders who schedule hourly staff in retail, restaurants, hospitality and similar industries across more than one location. This article is general information, not legal advice. Key takeaways The federal Fair Labor Standards Act has no rules on scheduling adult employees, so predictive scheduling (also called fair workweek or secure scheduling) duties come from state and city law. Oregon, Seattle, Los Angeles, Philadelphia and New York City fast food all require schedules at least 14 days in advance for covered workers. Coverage usually depends on industry plus a size threshold, such as 500 emp...
Read more