United Kingdom SMS guide

At a glance

A quick operational read on the United Kingdom. Permission, identification and opt-out duties come from PECR and the UK GDPR as supervised by the ICO; sender behaviour, filtering and provisioning come from the provider and operator layer; and Ofcom's A2P anti-scam obligations are a dated future change, not a rule that binds traffic today.

Direct-marketing rules

Law / regulation

SMS is “electronic mail” for PECR direct-marketing purposes, and whether a message is marketing is decided by its content, not by the label attached to the template

Individual subscribers

Law / regulation

Unsolicited direct-marketing texts to individual subscribers need consent or a valid soft opt-in, and sole traders and ordinary partnerships count as individual subscribers

A public number is not consent

Law / regulation

A mobile number being publicly available is not consent, and a bought or third-party list cannot inherit another organisation’s soft opt-in

Charitable soft opt-in

Law / regulation

Available since 5 February 2026 to charities only, on its own statutory conditions, and only for details obtained directly on or after commencement — it does not legitimise older databases

Sender identity and opt-out

Law / regulation

A marketing message must not conceal or disguise the sender’s identity and must give a valid address or contact route for opting out

ICO enforcement ceiling

Law / regulation

From 5 February 2026 the PECR maximum is aligned to UK GDPR levels — up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. That is a statutory maximum, not an expected penalty

Two-way SMS

Carrier or route policy

Available in the UK overall, but the sender type you choose decides whether replies are possible

Alphanumeric sender ID

Carrier or route policy

Supported and generally preserved on Twilio's current UK route, but one-way

Domestic long number

Carrier or route policy

Supported, preserved and reply-capable on Twilio's current UK route

International long number

Carrier or route policy

Not supported as a sender on Twilio's current UK route

UK short code

Carrier or route policy

Supported on Twilio's current route through an approved programme; provisioning and commercial detail is confirmed privately

Protected sender IDs

Carrier or route policy

MEF and BT protected brand sender IDs must be preregistered with the provider before use, and BT blocks them by default until allowlisted

Generic sender IDs

Carrier or route policy

Generic identifiers such as SMS, TEXT, INFO, Verify and Notify are liable to be blocked by operators

Sender-ID character set

Carrier or route policy

Maximum 11 characters with at least one letter, and for UK routing keep to A–Z, a–z, 0–9, period, dash, underscore, space and ampersand

Short-code lead time

Carrier or route policy

UK short codes need carrier approval and registration, and provisioning typically runs 8–12 weeks

Short-code consent

Carrier or route policy

Express end-user consent is required before messaging on a short code; friend-to-friend invitation and lead-generation opt-in campaigns are not supported on that route

Cannabis content

Carrier or route policy

Prohibited on the cited provider route

CBD content

Carrier or route policy

Permissible in the UK on the cited provider route, but keep it under legal review rather than treating route acceptance as legal clearance

Age-restricted campaigns

Carrier or route policy

Alcohol, gambling and similar age-restricted programmes are assessed case by case by UK carriers, not universally approved

Media / MMS

Carrier or route policy

No native MMS: media is converted to an SMS carrying an embedded URL, so treat media support as partial and converted

Complaints process

Law / regulation

Since 19 June 2026 organisations handling personal data must operate a data-protection complaints process

Number format

Law / regulation

+44 followed by the national digits, with the domestic trunk 0 removed — 07... becomes +447...

Mobile-service ranges

Law / regulation

Domestic UK mobile numbers ordinarily run to 11 digits including the leading trunk 0, on mobile service ranges 071–075 and 077–079

070 and 076

Law / regulation

070 is personal numbering and 076 is radiopaging, so a validator must not treat every 07 number as an ordinary mobile

Number portability

Carrier or route policy

Supported in the UK, so a prefix does not identify the subscriber's current mobile network

Line-type intelligence

Flowstates recommendation

Validate country or territory, line type and live carrier before routing instead of inferring from 07 syntax or the original prefix

Concatenation

Carrier or route policy

Supported, subject to sender type and encoding, and each added part changes the payload and the cost

Message length

Carrier or route policy

GSM-7 160 characters or Unicode 70 characters in a single inbound or outbound message

Special characters

Carrier or route policy

Diaeresis and other accented characters may not arrive intact and can be substituted for delivery, so test templates

SMS to landlines

Carrier or route policy

Not pre-rejected by Twilio: it may be passed to the carrier and converted into a text-to-speech voice call, and Twilio notes Virgin Mobile no longer supports SMS to UK landlines, so it is not a dependable SMS experience

MMS

Carrier or route policy

Converted on Twilio's UK route to an SMS containing an embedded media URL

M2M destinations

Carrier or route policy

Delivery to M2M numbers is best effort only on Twilio's route

Content categories

Carrier or route policy

Category acceptance is supplier- and route-specific and is confirmed privately rather than published here

Corporate subscribers

Law / regulation

Corporate subscribers can generally receive unsolicited electronic-mail marketing without PECR consent or the soft opt-in, but the sender must still identify itself, give a valid opt-out contact, honour objections and comply with the UK GDPR — corporate B2B SMS is not unregulated

Soft opt-in

Law / regulation

The customer soft opt-in is narrow: details obtained directly in a sale or negotiations for a sale, the sender's own similar products, and a simple opt-out at collection and in every message

Charity soft opt-in

Law / regulation

The Data (Use and Access) Act 2025 charitable-purpose soft opt-in took effect on 5 February 2026 for qualifying charities, subject to its own conditions

Right to object

Law / regulation

The UK GDPR right to object to direct marketing is absolute, and processing for that purpose must stop

No SMS preference service

Law / regulation

There is no text-message equivalent of TPS or CTPS, so suppression is your own control to build and run

Ofcom A2P anti-scam rules

Law / regulation

Finalised but not yet in force: the A2P General Condition changes take effect on 15 July 2027, and mobile providers and aggregators will pass the controls through the supply chain

Sender-ID registration

Carrier or route policy

There is no universal statutory UK sender-ID registration mandate; protected-brand allowlisting and generic-ID filtering are provider and operator controls

2027 readiness

Flowstates recommendation

Start supply-chain readiness now for the Ofcom A2P due-diligence, sender-corroboration and Know Your Traffic controls: legal-entity evidence, brand and domain authority, sender-purpose records, traffic profile and escalation contacts

Branded links

Flowstates recommendation

Use a controlled branded domain rather than a public or shared shortener

Sending window

Flowstates recommendation

Default promotional sending 09:00–20:00 recipient local time. This is a Flowstates operating standard, not a UK statutory quiet-hours rule

Last reviewed

Flowstates recommendation

17 August 2026

Numbering and networks

The basics your validation layer and templates need to get right before the first send.

• Law / regulationNumbering plan

  The UK uses ITU country code +44 and mobile country codes 234 and 235. Ofcom's National Telephone Numbering Plan allocates the ranges, and a UK mobile number is normally stored internationally as +44 followed by the national digits.

• Law / regulationDomestic trunk zero

  A domestic UK number written 07... carries a national trunk 0 that is not part of the international number. Normalising 07xxx xxxxxx to E.164 means removing that 0 and prefixing +44.

• Law / regulationOrdinary mobile ranges

  Ordinary UK mobile-service ranges are 071 to 075 and 077 to 079. Those are the ranges an ordinary consumer handset number sits in.

• Law / regulation070 is not a mobile

  The 070 range is personal numbering — a follow-me service that can forward anywhere and is charged differently. It is not an ordinary mobile range, and treating it as one is a common and expensive validation bug.

• Law / regulation076 is radiopaging

  The 076 range is radiopaging, apart from the 07624 sub-range used for Isle of Man mobile service. A validator that accepts any 07 number as an ordinary mobile will accept paging destinations.

• Flowstates recommendationExclude 070 and 076

  Exclude 070 and 076 from ordinary-mobile assumptions in validation, pricing and routing logic, and handle them explicitly rather than letting them fall through a generic 07 rule.

• Carrier or route policyPortability breaks prefix inference

  UK number portability is available, so the prefix range a number was originally issued in does not tell you which mobile network holds the subscriber today.

• Flowstates recommendationLine-type and carrier intelligence

  Where routing, eligibility, cost or fraud controls depend on the network or the line type, use current line-type and carrier intelligence at send time instead of a cached prefix mapping.

• Flowstates recommendationKeep the checks separate

  Syntax validation, line-type validation, consent evidence and deliverability are four different checks. A number that parses is not necessarily a mobile, a mobile is not necessarily permissioned, and a permissioned mobile is not necessarily reachable on the route you bought.

• Flowstates recommendationNormalisation

  Normalise at capture rather than at send time and store +44 plus the national digits, so the same contact cannot exist in two formats across systems and vendors.

• Carrier or route policyNetworks to plan for

  Representative operational paths include EE, O2 (VMO2), Vodafone and Three, plus the MVNOs riding on them. Not every supplier holds the same behaviour on every path, and BT-side protected-brand filtering applies to its own subscriber base.

• Carrier or route policyLandline destinations

  Twilio does not check whether a UK destination is a landline and will attempt delivery. Some carriers convert the SMS into a text-to-speech voice call rather than rejecting it, and at least one operator no longer supports SMS to UK landlines.

• Flowstates recommendationLandline handling

  Identify line type before sending anything sensitive or time-critical. A one-time passcode read aloud by text-to-speech to a shared office phone is a security and support incident, not a delivery success.

• Carrier or route policyM2M destinations

  Message delivery to M2M numbers is on a best-effort basis only on Twilio's route.

• Flowstates recommendationM2M handling

  Do not build a customer-facing or authentication flow on an M2M destination. Identify those numbers during validation and handle them on a separate, tested path.

Sender options

The UK supports a wide sender set, and the practical choice is decided by whether you need brand identity, reply handling or a high-volume interactive programme. Sender choice, not the country, is what determines whether a recipient can answer you.

Route policy: on Twilio's documented UK route, dynamic alphanumeric senders are supported and generally preserved, and general preregistration is not required — but MEF-protected and BT-protected brand sender IDs must be preregistered and allowlisted with the provider before use. Use a brand-related sender ID: generic identifiers such as SMS, TEXT, INFO, VERIFY, NOTIFY and OTP are blocked or heavily filtered by operators. Keep to a maximum of 11 characters with at least one alphabetic character, and for UK routing use only A–Z, a–z, 0–9, period, dash, underscore, space and ampersand. Domestic long codes are supported, preserved and reply-capable with no general pre-registration; UK short codes are supported and country-specific, need carrier approval and registration with a typical 8–12 week provisioning window, and require express end-user consent — friend-to-friend invitation and lead-generation opt-in campaigns are not supported on that route. UK toll-free numbers are not an SMS substitute, and international long codes are not supported. None of that is UK legislation, there is no universal statutory UK sender-ID registration scheme, and protected-sender registration on a provider route is not the same thing as Ofcom's future A2P due-diligence regime.

UK PECR, UK GDPR and direct-marketing rules

Three separate bodies of rule are involved and supplier documentation routinely merges them: PECR, the UK GDPR as supervised by the ICO, and Ofcom's numbering and anti-scam regime. Route policy is a fourth layer that is not law at all, and Ofcom's A2P duties are dated for 2027 rather than live today.

• Law / regulation

  SMS is treated as “electronic mail” for PECR direct-marketing purposes, so PECR governs unsolicited direct marketing by text, and the UK GDPR governs the underlying processing of personal data. Whether a message is direct marketing is decided by its content and purpose, not by the label attached to the template.

• Law / regulation

  A purely administrative or service message is not direct marketing. Adding promotional material to it can make the whole message direct marketing.

• Law / regulation

  A mobile number being publicly available is not consent, and a bought, rented or third-party list cannot inherit another organisation's soft opt-in.

• Law / regulation

  PECR consent uses the UK GDPR standard: freely given, specific, informed and unambiguous, given by a clear affirmative action, with the organisation, the purpose and the SMS channel clear to the person at the time.

• Law / regulation

  Messages a person specifically requested are solicited and are not caught by the unsolicited-marketing consent rule.

• Law / regulation

  Unsolicited direct-marketing texts to individual subscribers generally require consent, and that consent must be specific enough to cover text messages rather than a generic permission for electronic mail.

• Law / regulation

  The alternative to consent for individual subscribers is the soft opt-in, which requires that the details were obtained directly from the person in the course of a sale or negotiations for a sale, that the marketing is for the sender's own similar products or services, and that a simple means of refusing was offered both when the details were collected and in every subsequent message.

• Flowstates recommendation

  Treat the soft opt-in as narrow and evidence-based. It is not available for bought-in lists, unrelated prospects or third-party marketing, and the analysis should be owned by qualified UK counsel rather than by the campaign team.

• Law / regulation

  PECR generally does not require prior consent for unsolicited direct-marketing texts to corporate subscribers, but the sender must not conceal its identity and must provide a valid address or contact route for opting out.

• Law / regulation

  Sole traders and some partnerships are treated as individual subscribers under PECR, so classifying a list as “B2B” does not by itself put it outside the consent rules.

• Law / regulation

  The charitable-purpose soft opt-in introduced by the Data (Use and Access) Act 2025 took effect on 5 February 2026. It applies where a qualifying charity obtained the details directly from the person while they were expressing interest in or support for its purposes, the message solely furthers that charity's own charitable purposes, and simple opt-out opportunities were provided at collection and in every message.

• Law / regulation

  The charitable-purposes soft opt-in sits in PECR regulation 22(3A) and cannot be applied retrospectively: it covers only details the charity obtained itself on or after 5 February 2026, unless another lawful route such as valid consent exists. It does not cover third-party-collected details, connected trading-subsidiary lists, or promotion of another organisation.

• Flowstates recommendation

  Where both the products-and-services and charitable soft opt-ins are in use, track the permission basis and the opt-out state separately per contact. One combined “marketing consent” flag cannot evidence either route.

• Law / regulation

  Since 19 June 2026 organisations handling personal data must have a data-protection complaints process, including a route for the person to complain and a duty to respond. It is not an SMS-specific rule, but a UK SMS programme needs to feed into it.

• Law / regulation

  No fixed statutory UK quiet-hours window for marketing SMS was identified. Daytime sending is provider and carrier best practice, not an 8am–8pm legal rule, and genuinely urgent service messaging is treated separately.

• Law / regulation

  The UK GDPR still applies alongside PECR: the sender needs an appropriate lawful basis for the processing, must be transparent about it, and must honour the absolute right to object to direct marketing.

• Law / regulation

  From 5 February 2026 the ICO's PECR enforcement ceiling is aligned to UK GDPR levels, at up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. That is a statutory maximum for the regulator to apply proportionately, not an expected penalty.

• Law / regulation

  There is no central UK preference service for text messages equivalent to the TPS for live calls, and TPS or CTPS screening is not a UK SMS requirement. Screening against a central preference service is not available for SMS, so suppression is the organisation's own control.

• Flowstates recommendation

  Keep a suppression record that is sufficient to prevent accidental re-contact: retain the identifier needed to suppress, the objection or opt-out timestamp, the source, and the systems it was propagated to, and sync it across every platform and vendor rather than per campaign.

• Flowstates recommendation

  Retain attributable evidence for each permission: the source, the timestamp, the purpose, the channel wording shown, the notice version, and any soft opt-in analysis relied on.

• Flowstates recommendation

  An alphanumeric sender cannot receive a STOP reply. If a campaign uses one, publish a clear non-reply opt-out route in the message — a managed link, a keyword to a numeric sender, or an account setting — or choose a reply-capable sender. This is practical implementation guidance rather than a statutory instruction about wording.

• Law / regulation

  Ofcom published its final decision on tackling scam calls and texts on 15 July 2026. The new A2P obligations take effect on 15 July 2027, and the separate P2P measures carry an 18 January 2027 date.

• Law / regulation

  The General Conditions bind mobile providers, and the A2P duties fall principally on those providers and on A2P aggregators rather than directly on every end business. Expect the controls to be passed down the supply chain contractually. They include customer due diligence at onboarding, corroborating new alphanumeric sender IDs against the business profile and stated purpose, policies for protected, generic and special-character sender IDs, ongoing Know Your Traffic monitoring, incident handling, and blocking identified scam content, URLs or numbers.

• Law / regulation

  The final regime is not a mandatory central sender-ID registry. Providers are expected to maintain and enforce their own compliant controls, so the practical experience will differ between suppliers.

• Flowstates recommendation

  Prepare in advance rather than at the deadline: retain legal-entity evidence, domain and brand ownership or written authorisation, records of what each sender ID is for, an expected traffic profile, and named escalation contacts. This is our recommendation for staying easy to onboard and hard to mistake for scam traffic, not a duty PECR or Ofcom currently places on you as a sender.

• Carrier or route policy

  Alphanumeric support and preservation, MEF and BT protected-brand preregistration and default blocking, generic sender-ID filtering, special-character restrictions, short-code provisioning timelines, concatenation, UCS-2, MMS-to-URL conversion, landline text-to-speech conversion, M2M best-effort delivery and category acceptance are provider and operator route policy. They are neither PECR nor UK GDPR duties, and satisfying one does not satisfy the other.

Encoding and delivery

UK copy usually fits GSM-7, but smart punctuation, emoji and accented characters can switch a template to Unicode and change both what arrives and what you pay for.

GSM-7, single segment

160 characters

GSM-7, concatenated

153 characters per segment

Unicode / UCS-2, single segment

70 characters

Unicode / UCS-2, concatenated

67 characters per segment

• Carrier or route policy

  Twilio lists inbound and outbound UK message length as GSM 3.38 160 characters and Unicode 70 characters, with concatenation supported subject to sender type and encoding. Concatenation reduces the per-part payload and increases the number of parts you are billed for.

• Carrier or route policy

  Character substitution can occur for some non-GSM characters on Twilio's UK route: the provider recommends testing templates before launch because characters such as letters with a diaeresis may be replaced to facilitate delivery. Test the final copy rather than treating one character warning as a universal UK rule.

• Carrier or route policy

  UCS-2 is supported on Twilio's dynamic alphanumeric, domestic long-code and short-code rows for the UK. International long codes are not a supported UK sender.

• Flowstates recommendation

  Test the real encoded copy and its true segment count on the exact sender and network paths you will use, and treat the segment count as a cost decision rather than a formatting detail.

• Carrier or route policy

  MMS is converted on Twilio's UK route into an SMS containing an embedded media URL, so plan for the link to be the deliverable rather than the media itself. Concatenated GSM-7 carries 153 characters per segment and concatenated UCS-2 carries 67, so segment maths — not the single-message ceiling — decides what arrives and what you pay for.

• Carrier or route policy

  An SMS sent to a UK landline is not pre-rejected by Twilio: it may be passed to the carrier, some carriers convert it into a text-to-speech voice call, and Twilio notes Virgin Mobile no longer supports SMS to UK landlines. Treat it as an undependable SMS experience and identify line type before sending sensitive or time-critical content.

• Flowstates recommendation

  Use the schematic format +44 7XXX XXXXXX in documentation and test fixtures. Never publish or share a real subscriber number.

• Flowstates recommendation

  Keep OTP to one segment where practical. A provider maximum is a technical ceiling, not a copy target.

What we need to validate your United Kingdom route

Send us these and we will come back with the sender options that apply, the route behaviour we can confirm and the rules that govern your category.

• Company or legal entity and website
• Customer-facing brand name and evidence of your rights to it
• Traffic category and use case, split by transactional, OTP, service and marketing
• Sample templates for each distinct use case
• Expected monthly volume and peak sending rate
• Preferred sender type and whether replies are required
• Existing UK sender inventory and current provider at a high level
• Opt-in and permission journey, screenshots or evidence and the exact wording
• The PECR permission path relied on and any soft opt-in analysis
• UK GDPR lawful basis and the owner of the legal review
• Privacy-notice and terms URLs
• Internal objection, opt-out and suppression process and its owner
• Link domains you intend to use
• How numbers are collected, normalised, line-type checked and validated
• MMS, Unicode and multi-segment requirements
• Target launch date

Frequently asked questions about SMS in United Kingdom