Sending SMS messages to international customers involves more than choosing a messaging provider and connecting an API. Businesses must also understand the legal requirements, customer consent rules, and carrier registration procedures that apply in different countries.
When preparing an international SMS service, you may encounter terms such as TCPA, A2P 10DLC, GDPR, and ePrivacy. Although these frameworks are often discussed together, they serve different purposes.
Understanding these differences is essential for businesses sending authentication codes (OTP), transactional notifications, delivery updates, or promotional messages to customers overseas.
In this first article, SureM explains the major SMS compliance requirements in the United States and Europe, along with practical steps businesses should consider before launching international messaging campaigns.
1. Understanding the Four Key SMS Compliance Frameworks
Before launching an international SMS service, businesses should answer three important questions:
Can we legally collect and process this customer's phone number for the intended purpose?
Are we permitted to send this particular message to the recipient?
Is our sender number properly registered and ready for business messaging?
These questions involve different legal and operational requirements.
EU GDPR – Personal Data Protection
The General Data Protection Regulation (GDPR) governs how personal data, including phone numbers, is collected, processed, stored, and shared.
Businesses should review their legal basis for processing personal data, the purpose of collection, data retention policies, and relationships with service providers.
European ePrivacy Rules – Marketing Permission
European ePrivacy requirements address electronic marketing communications, including promotional SMS messages.
Businesses must review the applicable national rules concerning marketing permission, customer consent, exceptions, and opt-out procedures.
US TCPA and FCC Rules – Messaging Consent and Restrictions
The Telephone Consumer Protection Act (TCPA) and related Federal Communications Commission (FCC) rules regulate certain types of calls and text messages in the United States.
The applicable requirements depend on factors such as the sending technology, message content, and type of communication.
US A2P 10DLC – Business Messaging Registration
Application-to-Person 10-Digit Long Code (A2P 10DLC) is a carrier registration framework for business messaging using US ten-digit long code numbers.
Businesses generally need to register their brands and messaging campaigns and associate their sending numbers with the appropriate campaigns.
Key takeaway: These four frameworks serve different purposes. GDPR addresses personal data processing, ePrivacy governs electronic marketing requirements, TCPA and FCC rules address applicable messaging restrictions, and A2P 10DLC concerns carrier registration.
Meeting one requirement does not automatically satisfy the others.
2. TCPA: Understanding SMS Consent Requirements in the United States
The TCPA is an important US consumer protection law covering certain calls and text messages.
For businesses sending SMS messages, understanding the applicable consent requirements is essential.
Under the TCPA and FCC rules, certain advertising or telemarketing communications involving regulated automated systems may require prior express written consent.
However, not every message sent through an SMS API is automatically subject to identical consent requirements.
The appropriate assessment depends on the actual technology used, the message's purpose, and the applicable federal and state regulations.
Businesses should also consider relevant do-not-call requirements and customer opt-out requests.
Practical Steps for Businesses
Before launching an SMS campaign in the United States, businesses should:
Clearly identify whether messages are transactional, informational, or promotional.
Review the consent requirements applicable to the sending method and message.
Maintain appropriate customer consent records.
Explain what types of messages customers are agreeing to receive.
Establish a reliable process for handling opt-out requests.
Where written consent is required, properly obtained electronic signatures may be relevant.
Businesses should review their actual message templates and customer registration processes together rather than treating consent as a separate administrative task.
3. A2P 10DLC: Carrier Registration for Business Messaging
A2P stands for Application-to-Person messaging, meaning messages sent from a business application to an individual.
A 10DLC is a standard US ten-digit telephone number used for messaging.
The A2P 10DLC registration framework helps US mobile carriers identify legitimate business senders and understand their messaging use cases.
How Does A2P 10DLC Registration Work?
Businesses typically need to complete several steps:
Step 1: Brand Registration
Register the business information associated with the messaging service.
Step 2: Campaign Registration
Describe the purpose of the messages, such as authentication, customer notifications, or marketing.
Step 3: Phone Number Association
Connect the relevant US long code numbers to the registered messaging campaigns.
Step 4: Compliance Review
Confirm that the actual messages and sending practices match the registered campaign information.
It is important to understand that A2P 10DLC does not apply to every type of US business messaging number.
Toll-free numbers and short codes have separate verification or application processes.
Additionally, completing carrier registration does not replace the need for appropriate customer permission.
A registered sender does not automatically mean that every message is permitted or guaranteed to be delivered.
4. GDPR: Protecting Customer Phone Number Data in Europe
The GDPR establishes requirements for processing personal data, including information used in international messaging services.
For SMS providers and businesses, customer phone numbers are particularly relevant because they can identify individuals.
GDPR considerations may include:
The purpose of collecting customer phone numbers.
The legal basis for processing personal data.
How long customer information is retained.
Whether customer data is shared with external service providers.
How personal data is protected.
Whether applicable international data transfer requirements are satisfied.
GDPR may also apply to businesses located outside Europe in certain circumstances, such as offering goods or services to individuals in the EU or monitoring their behavior there.
Does GDPR Always Require Customer Consent?
Not necessarily.
Consent is one possible legal basis for processing personal data, but GDPR also recognizes other legal grounds where applicable.
However, having a lawful basis for processing a customer's phone number does not automatically authorize promotional SMS messages.
For example, a phone number collected for delivery notifications should not automatically be added to a marketing campaign.
Businesses must separately assess the purpose of processing and the rules governing electronic marketing.
5. ePrivacy: Understanding Marketing SMS Rules in Europe
While GDPR governs personal data processing, European ePrivacy requirements address electronic communications and marketing practices.
For international SMS campaigns, businesses should examine the national laws implementing the ePrivacy framework in each destination country.
Depending on the applicable rules, businesses may need to obtain prior marketing permission and provide recipients with an appropriate way to refuse future messages.
What About Existing Customers?
Some countries provide limited exceptions for marketing similar products or services to existing customers.
However, these exceptions are subject to conditions.
A previous purchase does not automatically authorize all future promotional messages.
Businesses should review how the phone number was obtained, whether appropriate opt-out opportunities were provided, and which national rules apply.
The United Kingdom should also be reviewed separately because it operates under its own UK GDPR and Privacy and Electronic Communications Regulations (PECR) framework.
6. OTP Messages vs. Marketing Messages: Why the Difference Matters
One common question in international messaging is whether authentication messages and marketing messages follow the same requirements.
Consider the following examples.
Example A: Authentication Message
"Your verification code is 123456."
This message is intended to authenticate a user.
Example B: Authentication Message With Promotion
"Your verification code is 123456. Get 20% off your first purchase!"
The second message includes promotional content.
Even though both messages contain an OTP, the additional marketing information can change the applicable compliance assessment.
Businesses should therefore avoid assuming that a message classified as an OTP within their messaging platform automatically qualifies as a purely transactional message.
Separating authentication and promotional message templates can simplify compliance management and reduce operational risks.
7. Frequently Asked Questions About International SMS Compliance
Q1. Does A2P 10DLC registration eliminate the need for customer consent?
No.
A2P 10DLC registration concerns carrier requirements for particular business messaging numbers.
Customer permission and applicable messaging laws must be evaluated separately.
Q2. Does obtaining customer consent automatically ensure GDPR compliance?
No.
GDPR compliance involves additional considerations, including lawful processing, transparency, retention, security, and relationships with service providers.
Marketing communications may also be subject to separate national ePrivacy requirements.
Q3. Must every international messaging provider use Standard Contractual Clauses (SCCs)?
Not necessarily.
Businesses should first identify the actual data flows and determine whether a restricted international data transfer occurs.
Standard Contractual Clauses are one possible mechanism for addressing applicable transfer requirements.
Other mechanisms, including relevant adequacy arrangements, may apply depending on the circumstances.
Q4. Is automatically processing the keyword "STOP" enough to satisfy opt-out requirements?
Not always.
STOP keyword handling can be useful, but businesses should consider all applicable opt-out requirements and customer communication channels.
Opt-out requests must be reflected in the systems used to select recipients for future campaigns.
8. Best Practices Before Launching International SMS Campaigns
Businesses preparing international SMS services should establish a compliance review process covering several essential areas.
Identify the destination country.
SMS requirements differ between jurisdictions. A process suitable for the United States may not meet European requirements.
Confirm the purpose of each message.
Separate OTP, transactional notifications, service communications, and promotional messages.
Review customer data collection and permission.
Understand how customer phone numbers were obtained and whether their intended use is permitted.
Confirm sender registration requirements.
Determine whether the selected number type requires carrier registration, verification, or other preparation.
Maintain accurate records.
Keep appropriate records of permissions, messaging campaigns, sender information, and customer opt-out requests.
Coordinate with your messaging provider.
Provide the destination country, expected traffic volume, message samples, and sender information so that relevant operational requirements can be reviewed.
Build a Reliable International SMS Compliance Strategy
International SMS compliance is not simply about registering a sender number or obtaining customer consent.
Businesses must understand how data protection laws, electronic marketing regulations, consumer protection requirements, and carrier registration procedures work together.
In the United States, TCPA and FCC requirements should be reviewed alongside the relevant A2P 10DLC registration processes.
In Europe, GDPR governs personal data processing, while national ePrivacy requirements play an important role in electronic marketing communications.
By reviewing these requirements separately and connecting them to actual messaging operations, businesses can build more reliable international SMS services.
Global Business Messaging With SureM
Founded in 2000, SureM provides business messaging services across more than 200 countries.
Whether your business needs international SMS, OTP authentication, customer notifications, or global messaging solutions, SureM helps businesses plan their international messaging operations.
For inquiries about international messaging services, please contact our team.
SureM International Sales Team
Email: intlsales@surem.com
Website: https://www.surem.net