SMS Marketing for Online Stores — Consent, Cost and Compliance

An SMS campaign is a batch of text messages sent to a group of recipients from one number or sender name — usually through an SMS gateway, not from the shop's own phone. An online store sends two kinds of text message, and the law treats them very differently. A transactional SMS reports on an order the customer has already placed. SMS marketing is any message with an offer, a discount or a nudge to buy — and that is the one that needs the most preparation. Before your first campaign you need two independent legal bases, one of them specific to the channel. You can work out the cost in advance, because gateways publish their prices per message — and those prices depend heavily on the country and the mobile network you are sending to. The last part of the article covers email, the other owned channel in the customer lifecycle, which comes with its own requirements from mailbox providers.

Two legal bases for SMS marketing: GDPR and the EU ePrivacy rules

To send an SMS marketing campaign legally, a store needs two independent legal bases — not one.

The first is a lawful basis under Article 6(1) of the GDPR to process the customer's phone number for a marketing purpose at all. In practice, that's usually consent (point (a)) or, for a customer who has already bought something, legitimate interest (point (f)); the article also lists performance of a contract (b) and legal obligation (c), but those two cover fulfilling the order itself, not sending offers.

The second, separate basis is consent to the channel itself, under the EU ePrivacy Directive (2002/58/EC), Article 13. Article 13(1) allows electronic mail to be used for direct marketing only to recipients who have given their prior consent, and the Directive's definition of "electronic mail" (Article 2(h)) covers any stored text message, which is why it applies to SMS as well — recital 40 names SMS explicitly. Article 13(2) adds one exception: a business that obtained a customer's contact details in the context of a sale may use them to market its own similar products or services, provided the customer was clearly given a free, easy way to object when the details were collected and is given it again in every message. Each EU member state transposes the Directive into national law, so the exact wording and enforcement vary by country. Outside that exception, an SMS marketing message sent without this second consent breaches the ePrivacy rules regardless of whether the GDPR basis was in order.

The GDPR also says what valid consent looks like: a freely given, specific, informed and unambiguous indication of the customer's wishes, by a statement or a clear affirmative action (Art. 4(11)), which you must be able to demonstrate (Art. 7(1)). The practical conclusion: unless you rely on the existing-customer exception, consent recorded only as "consent to processing of personal data", with no mention of the SMS channel, is not enough to send an SMS marketing campaign. You need a separate record of consent to this specific channel — ideally with the date, the exact wording the customer accepted, and where they gave it.

Where you collect that consent can vary: a checkbox in the order form (unticked by default, not required to complete the purchase), a separate field in account settings, or a sign-up form for a text-message list on the store's site. Any of these works, as long as the customer clearly understands they're signing up for marketing messages, not just order-status notifications.

Transactional SMS vs. SMS marketing — where the line sits

A transactional SMS reports on something already happening within an order the customer placed: an order confirmation, a shipping-status change, a pickup code for a parcel locker, a pickup-deadline reminder. A message like that follows from performing the contract — it doesn't need the ePrivacy consent, because it generally isn't "direct marketing" under that rule, only the execution of a transaction already agreed.

SMS marketing, by contrast, is any message that encourages a purchase or promotes an offer, a discount, a sale or a new product — regardless of whether it goes to an existing customer or to someone who only signed up to a list. This type always needs both legal bases described above — the ePrivacy layer being either prior consent or, for your own customers and similar products, the Article 13(2) exception with an opt-out in every message.

The line gets blurry in one place: a status update that also carries a cross-sell link ("buy the accessory for the product we just shipped") stops being purely transactional for that extra part. If you don't have marketing consent, or a valid existing-customer basis, for every recipient of your status SMS, split the two messages instead of combining them.

The mechanism for sending automatic transactional SMS on an order-status change is covered in our sales automation article — it also covers triggers for cart reminders. If you're implementing automatic transactional SMS yourself and need help integrating an SMS gateway with your order system, see our process automation offer. A legitimate SMS marketing campaign, sent under your store's own name to recipients covered by the legal bases above, is not smishing — regardless of the offer in it.

How much an SMS marketing campaign costs

SMS gateways price per message, and three things move the rate: the destination, the volume you buy, and the type of sender. In Europe the destination matters most, because the gateway pays a different termination fee to each mobile network.

ASPSMS, a gateway that publishes its prices per network, shows the spread clearly (aspsms.com/en/prices, read 2026-10-02). It sells prepaid credits — 6 euro cents per credit for up to 5,000 credits, 5.5 cents from 10,000, 4.5 cents from 50,000 and 4 cents from 100,000 — and each destination network costs a set number of credits per message. At the 10,000-credit price, one SMS costs:

• 5.5 cents (1 credit) to mobile networks in Ireland, Austria, Denmark and Portugal;
• 9.62 cents (1.75 credits) to networks in Germany and Italy;
• 15.12 cents (2.75 credits) to networks in France, Belgium, Spain and the Netherlands.

Across the EU, this price list runs from one credit per message to 3.75 credits (Slovenia).

The same 10,000-message campaign therefore costs about €550 to Irish numbers, €962 to German numbers and €1,512 to French numbers — a factor of 2.75 for an identical message. ASPSMS charges no set-up or monthly fee, its credits do not expire, and the price page states that customers outside Switzerland are billed without VAT. These are one provider's prices on one day, not a market rate, but the mechanism — price per destination network — is how SMS is priced across Europe.

Two more factors change the bill. Many providers sell monthly plans with a subscription on top of the per-message rate, which matters more at low volume: a prepaid model without a subscription can be cheaper for occasional, small campaigns, and the other way round for frequent, large ones. And messages are billed per segment, not per text: "a long message or some character sets can produce multiple segments, so a single message can incur more than one segment charge" (Bird SMS pricing, read 2026-10-02). A campaign written with special characters or running over one segment can double its cost without anyone noticing.

The calculation before you choose a provider is simple: number of recipients × price per message for each destination × number of segments, plus any subscription. Run it on your actual list, split by country, rather than on a single headline rate.

Consent records and opt-outs

The two legal bases above are only as good as your ability to show them. GDPR's information duties (Article 13) mean a customer needs to know who's processing their number, for what purpose and for how long — and the whole accountability of the consent process rests on Article 6: you need to be able to point to the specific consent (date, wording, channel) that authorises sending to a given number. In practice, that means storing a consent record per phone number, not just a ticked checkbox with no date or wording attached.

Every SMS marketing campaign also needs an opt-out mechanism. GDPR Article 7(3) requires withdrawing consent to be as easy as giving it, and once consent is withdrawn it is no longer a basis under Article 6 — further messages to that number have no legal basis at all, however well the consent was originally collected. Under the existing-customer exception, the ePrivacy Directive requires the opt-out to be offered in every message. How a recipient opts out (a reply to the sending number, a link in the message) depends on what your gateway supports; check this in its control panel before your first campaign. Once an opt-out comes in, remove that number from your marketing lists immediately.

Keep the consent record and the opt-out history in one, easily searchable place — your shop system, your CRM or the SMS gateway itself, whichever one you already run as your main contact register. Spreading this data across a spreadsheet, the gateway's panel and your customer database makes it harder to prove consent in an audit and increases the risk of messaging someone who has already opted out.

Email in the customer lifecycle

Email works alongside SMS in the customer lifecycle. Newsletter strategy has its own article on email marketing; here there is only one thing you need to know whatever your strategy: Google, Yahoo and Microsoft introduced hard technical requirements for bulk senders in 2024 and 2025, and without meeting them your campaigns can land in spam or be rejected outright.

Gmail set requirements from 1 February 2024. Every sender needs SPF or DKIM, correct DNS records (including a reverse record), TLS encryption in transit and RFC 5322-compliant formatting, and a spam rate in Postmaster Tools that stays below 0.3% (Google recommends keeping it under 0.1%). Senders of more than 5,000 messages a day additionally need SPF, DKIM (at least a 1024-bit key, 2048 recommended) and DMARC together, with a "From" domain aligned to the SPF or DKIM domain, and marketing/subscription email must support one-click unsubscribe (the List-Unsubscribe and List-Unsubscribe-Post headers) plus a visible unsubscribe link in the body.

Yahoo enforces equivalent requirements from February 2024. Bulk senders need SPF and DKIM, a public DMARC policy (at minimum "p=none"), a "From" domain aligned to the SPF or DKIM domain, a working one-click unsubscribe header (the recommended method is a POST request per RFC 8058; mailto is also acceptable) — opt-outs must be honoured within 2 days — and a spam rate below 0.3%, measured against mail that was actually delivered to the inbox, not against everything sent.

Microsoft added its own requirements from 5 May 2025 for domains sending more than 5,000 messages a day to Outlook.com consumer addresses (hotmail.com, live.com and outlook.com): SPF and DKIM must pass, and DMARC must carry a policy of at least "p=none" aligned with SPF or DKIM. Since that date, non-compliant mail from such senders has been routed to the Junk folder; the announcement's 29 April 2025 update says it will later be rejected outright (Microsoft has not given a date) with the code "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." Microsoft lists a functional unsubscribe link and list hygiene as recommendations rather than requirements, and doesn't publish a numeric spam-rate threshold.

The practical conclusion is the same as in the consent section above: technical compliance with a provider's rules (SPF/DKIM/DMARC for email) and legal compliance (two legal bases for SMS and email) are both a condition of sending, not an extra. Without them a campaign either won't reach the recipient or shouldn't go out at all. Abandoned-cart reminders, sent by email or SMS, have their own logic and triggers — covered in our cart-abandonment article.

How to measure an SMS marketing campaign

An SMS itself doesn't report clicks — whether you can count them depends on the link. Some gateways have their own link shorteners, but traffic only arrives in Google Analytics 4 with the right source if the link to your offer carries UTM parameters — add them and shorten the link before you send. A click from the campaign then shows up in GA4 with its own source and medium, like any other campaign traffic; without UTM parameters you can't tell SMS traffic apart from organic or any other channel.

A click, though, is only half the measurement. The other half is whether that click turned into an order. Divide the campaign cost from the section above by the number of orders it actually produced, to get a cost per order for that specific channel — the same metric we cover generally, across all channels, in our e-commerce KPI article. Don't compare an SMS campaign to an email campaign on click-through rate alone — the two channels differ in cost per recipient, so what actually decides which one performs is cost per order, not raw traffic.