Costa Rica is often summarised as “you need opt-in”. The actual framework is layered across a data-protection law, a telecom law, a consumer decree and the current user-protection regulation, and the nuance decides whether a campaign is lawful.
Law / regulation
June 2026 anti-smishing change: on 24 June 2026 SUTEL announced new anti-smishing requirements for operators providing SMS. Operators must build the capability to distinguish P2P from A2P traffic, filter malicious messages and provide end-to-end traceability. Implementation is phased and culminates over an 18-month period.
Flowstates recommendation
That is primarily an operator-level regulatory change, not a basis for inventing a public customer-registration requirement. Operationally it makes accurate traffic classification, a recognisable brand and purpose, branded link domains, consistent templates and end-to-end route testing more important, and link or content filtering may tighten as implementation progresses.
Law / regulation
Law 8968, Article 5: when personal data is collected, the holder must be informed expressly, precisely and unequivocally about the existence of the database, the purposes, the intended recipients, the mandatory or optional nature of the answers, the treatment of the data, the consequences of providing it, the rights available and the identity and address of the controller. Express consent is required unless a statutory exception applies.
Law / regulation
Law 8968 and the PRODHAB framework govern personal-data processing as a whole. Do not reduce that to an SMS keyword rule: it covers the lawful basis, purpose, disclosures and data-subject rights behind the list you are sending to.
Law / regulation
Law 8642, Article 44: direct-sale communications sent through automatic calling systems, fax, email or other devices require the prior consent of the recipient, the recipient must be able to request suspension clearly and free of charge, the identity of the sender must not be hidden and a valid channel to stop the communications must exist.
Law / regulation
Executive Decree 37899, current Article 200: merchants must refrain from sending electronic communications that were not previously requested. Opt-in and opt-out procedures must be effective and easy to use, and a decision not to receive further communications must be honoured immediately. Automated messages without prior consent, messages with a hidden or false origin and messages with no way to terminate them are treated as unsolicited.
Law / regulation
The current RPUF user-protection regulation contains direct-sale communication rules addressed to telecommunications operators and providers. Read its scope carefully rather than treating every operator-specific duty as a universal merchant obligation.
Law / regulation
The 2012 “Procedimiento de comunicaciones no solicitadas” was revoked in 2024 on the basis that the later RPUF contains the relevant provisions. The RPUF contemplates a future SUTEL opposition tool whose implementation still has to be separately defined.
Flowstates recommendation
Because that opposition tool is not a currently universal automatic network block, we maintain and enforce our own suppression controls and require customers to do the same.
Flowstates recommendation
No particular stop keyword is presented here as mandated by Costa Rican statute, and there is no fixed statutory marketing-hours window in this guide. Support Spanish-language requests such as BAJA, SALIR or CANCELAR because recipients use them.
Carrier or route policy
Individual routes may impose stricter consent evidence, content review or category restrictions than the legal minimum, and some routes change generic or numeric senders. Those are provider rules, not Costa Rican statute.
Carrier or route policy
M2M delivery may be best effort on some provider routes. Confirm expectations before you build a machine-to-machine flow on a Costa Rican A2P path.
