Updated on 12 November 2026 by Nicolas Finet, CEO of Sortlist. We have rewritten this guide for UK businesses: how to collect mobile numbers for SMS marketing legally and effectively, with practical tactics and the PECR and UK GDPR rules that apply. The earlier version suggested collecting numbers "in bulk" and used US terms such as "cell phone numbers"; in the UK, consent rules and enforcement make how you collect numbers as important as how many you collect.
To collect phone numbers for SMS marketing in the UK, you need clear, specific consent from each person, collected through a transparent opt-in such as a sign-up form, keyword text, in-store form or checkout box. SMS marketing falls under the Privacy and Electronic Communications Regulations (PECR), which treat marketing texts as electronic mail. Holding a phone number is not consent, and consent given for email or "marketing in general" does not cover SMS.
Key takeaways
- Collect numbers only with specific, informed, unticked opt-in consent for SMS, or rely on the narrow "soft opt-in" for existing customers where its conditions are met.
- Offer separate SMS and email opt-ins; do not use pre-ticked boxes or bundle consent with terms and conditions.
- Do not buy lists: the ICO has said it is very difficult to use bought-in lists for text, email or automated call campaigns.
- Enforcement is real: the ICO fined firms £225,000 in January 2026 for nuisance marketing messages, and has fined companies tens of thousands of pounds for SMS breaches.
- Give clear value (offers, updates, early access) and make unsubscribing easy.
The rules in brief
| Question | UK position (summary; check ICO guidance) |
|---|---|
| Do I need consent to send marketing texts? | Generally yes, unless you meet all the conditions of the soft opt-in for existing customers |
| What counts as consent? | A clear affirmative action, specific to SMS, informed and freely given; consent follows the UK GDPR standard |
| Can I use pre-ticked boxes? | No |
| Can I rely on general "marketing" consent? | No; consent should be specific to SMS, with separate options for email and SMS |
| Can I buy phone numbers? | Very difficult to do lawfully; indirect consent is generally not enough for texts |
| Must I let people opt out? | Yes: every message needs an easy way to stop, and you must identify yourself |
The Data (Use and Access) Act 2025 came into force on 19 June 2025, raised PECR fines to UK GDPR levels and prompted a review of the ICO's electronic mail marketing guidance, so check the ICO's current direct marketing guidance before launching.
Eight ways to collect numbers lawfully
- Website sign-up form. A short form with a separate, unticked SMS consent box, clear wording ("Text me offers and updates from [Brand]; reply STOP to opt out") and a link to your privacy notice.
- Checkout opt-in. Add an optional SMS box at checkout; do not make it a condition of purchase.
- Keyword opt-in. Customers text a keyword to a number or short code and receive a confirmation message. Include terms in the call to action and confirm consent in the first reply.
- In-store and event forms. Tablets or paper forms with clear consent wording, and staff trained to explain it.
- Existing customers (soft opt-in). You may text existing customers about similar products if you collected their details during a sale or negotiation, gave a clear chance to opt out at collection and in every message, and meet the other conditions. Take advice if unsure.
- Newsletter subscribers. Invite email subscribers to add SMS as a separate choice; do not assume they agree.
- Competitions and giveaways. Make SMS opt-in optional and separate from entry; follow promotion rules in the CAP Code.
- Website pop-ups and QR codes. Offer a clear benefit such as a first-order discount, with the same consent wording, and test on mobile.
Sortlist editorial note: a smaller list of people who asked for your texts will outperform a larger list that did not, and it will not put your business at risk of a six-figure fine.
Sortlist editorial team
How to make opt-in more attractive
- State what people get and how often: "Two texts a month: early access and offers."
- Offer a relevant incentive, such as a discount or early access, and describe terms clearly.
- Repeat the call to action in several places: website, packaging, till, receipts, social media and events.
- Make the keyword easy to remember and the instructions short.
- Test wording, placement and incentives.
Managing your list
- Record when, where and how each person consented, with the wording shown.
- Honour opt-outs immediately and keep a suppression list.
- Segment by interest and send relevant messages at sensible times.
- Review your data regularly and remove inactive numbers.
- Choose an SMS provider that supports compliant opt-in and opt-out handling.
See also email marketing cost for related consent rules.
Frequently asked questions
Can I text customers who bought from me?
Possibly under the soft opt-in, if its conditions are met and you gave them a chance to opt out. Otherwise you need consent.
Can I buy a list of mobile numbers?
It is very risky. The ICO has said that bought-in lists are very difficult to use lawfully for texts.
Do I need double opt-in?
PECR does not require it for all cases, but confirming consent with a reply message is good practice and helps prove consent.
What happens if I breach PECR?
The ICO can issue fines and enforcement notices; recent penalties include £225,000 in fines announced in January 2026.
Need help with SMS and CRM marketing? Post your project on Sortlist and compare UK marketing agencies for free.
Sources: ICO, fines of £225,000 for nuisance marketing messages, DMA, direct marketing requires specific consent, RPC, ICO issues fines over electronic marketing breaches, LegalVision, SMS marketing consent. General information, not legal advice; check the ICO's current direct marketing guidance.
