GDPR (General Data Protection Regulation) has permanently changed the landscape for B2C marketing in Europe. Staying compliant is vital to keep customers satisfied and avoid regulatory penalties. The rules apply equally to SMS marketing, so you need to be aware of the limitations GDPR imposes before you use this powerful engagement channel.
The rules don’t have to spell disaster for your business: by planning ahead and researching the law’s requirements, you can market your services responsibly. Besides staying legal, approaching marketing thoughtfully could end up boosting your conversion rates too. In this article, you’ll learn everything you need to know to create effective SMS marketing campaigns that are GDPR-compatible.
How GDPR Affects SMS Marketing
The GDPR regulations were introduced in 2016 and became enforceable on May 25, 2018. They define the circumstances in which organizations may collect data, the manner in which that data should be stored, and the controls that consumers must be given.
GDPR mandates that data collection can only occur where there’s a lawful basis for it. A lawful basis is automatically created if the subject of the data gives you explicit consent to use their details for a particular purpose. Otherwise, you must demonstrate you have a legitimate interest in processing the data. A legitimate interest will not normally be created in cases where SMS marketing is your intention, as evidenced by the €3 million fine levied against the Spanish bank BBVA in 2020. The bank had sent marketing messages directly to customers’ phones without first requesting consent.
GDPR stipulates that data should be stored securely using systems that have a privacy-first design. Users also have the right to own their data; requests for a copy must be honored without a charge, usually within one month of receipt. Data has to be deleted upon instruction by the subject, except for any elements you have a legal obligation to retain.
Many EU countries impose additional rules on SMS marketing in addition to GDPR. You should research these before you start your campaign, so you don’t inadvertently break local laws. As an example, France prohibits marketing messages on Sundays and between the hours of 10:00 p.m. and 8:00 a.m., while Sweden and Denmark block most messages containing URLs.
Best Practices for SMS Marketing With GDPR
GDPR compliance can seem daunting at first. However, if you follow the best practices outlined in this article, you’ll keep your campaigns legal while maximizing your chances of successful conversion. Operating a non-compliant campaign could lead to heavy regulatory fines and consumer discontent that harms your brand’s reputation. Following these practices can also help improve overall customer engagement even if you don’t operate in countries where GDPR applies. They’re strategies for maximizing SMS effectiveness without frustrating your contacts.
Focus on Opt-Ins
You should only send messages to people who’ve granted their express consent. Opt-ins need to be explicit and intentional to meet the GDPR standard. Prefilling checkboxes in a sign-up form isn’t sufficient as the user could overlook them and unintentionally subscribe themselves.
Providing a phone number as part of a sign-up process or checkout ordering flow should not be interpreted as an opt-in either. Instead, you should provide a dedicated consent process that makes it clear which marketing channels and communication methods are being subscribed to.
Besides keeping you GDPR compliant, opt-in contact acquisition improves the quality of leads in your marketing funnel. You get to build a list of recipients that have indicated an interest in hearing what you have to say. Those recipients are more likely to engage with your messages without getting annoyed each time one arrives.
Easy Opt-Outs
Consumers have a right to opt out of receiving further messages at any time. You should make this facility easy to discover and use. Not only is this a good ethical practice, but a simple opt-out flow will also create a better perception of your brand that conveys your respect for user privacy.
You can streamline opt-outs by including a link at the end of your marketing messages. Many organizations also operate an inbound opt-out feature where consumers can send a special SMS like “OPTOUT” to immediately remove their number from your marketing lists.
GDPR stipulates that unsubscribing must be as straightforward as signing up. While no specific mechanism is required, opt-out messages are one way to make delisting easier for your customers. Outside of the EU, other regions, like the UK, may advise or require similar easy opt-out options. There’s a business benefit to simple unsubscriptions, too: people could be more likely to return to a company that let them leave on their own terms in the past.
Maintain a Robust Privacy Policy
A regularly updated privacy policy is essential to GDPR compliance. This publicly accessible document needs to accurately set out how you collect, process, and store data in accordance with the GDPR regulations.
You should provide a copy of your policy when people subscribe to your SMS marketing campaigns. This ensures they’ve been informed of how their data will be used. The text should be accessible from your website too, and you might want to include a link at the end of individual messages.
GDPR sets out specific standards for a privacy policy’s content and its presentation. It needs to include the contact details of your data-protection officer, the justification for collecting data, the length of time that data will be retained, and how deletion instructions should be submitted. This information needs to be presented simply, “in clear and plain language,” using a widely accessible format.
You must revise your privacy policy each time you change how data is used or stored. This includes if you start contracting another data processor to manage records on your behalf. Consumers must always be informed of how their data is processed and where it resides. Your privacy policy should be the definitive source of these details.
Outdated, missing, and factually incorrect privacy policies have been the source of some of the biggest GDPR fines to date. WhatsApp was issued with a €225 million penalty for inadequately explaining its data-collection practices in versions of its privacy policy used until 2021.
Be Conscientious about Message Distribution
Standard ethical marketing practices apply to SMS channels too. Be considerate in what you send and when it’s delivered to maximize your open rate and maintain good engagement.
Most consumers won’t want to receive too many messages in quick succession. You should also avoid sending content late in the evening, over weekends, or on public holidays in your target markets. Untimely messages are discourteous and actually forbidden in some jurisdictions, as mentioned above.
Restricting what you send encourages you to focus on crafting quality content that’s more likely to engage. Remember that messages shouldn’t be hard sales pitches every time. Offering the recipient relevant information, like alerts for new industry-specific case studies, is more likely to create a positive brand impression. This will also reinforce that data’s being used for a genuine purpose in compliance with GDPR.
Let Customers Know Why They’re Receiving Messages
Marketing SMS recipients can be confused or frustrated when it’s unclear why they’ve received a particular message. This could be because they signed up a long time ago or don’t recognize your sender identity. Both of these scenarios carry a risk of the consumer mistakenly suspecting a breach of GDPR.
Ensuring messages are relevant to each recipient is a good way to maximize engagement and prevent erroneous spam reports. You can facilitate this by adjusting your opt-in mechanism so consumers can subscribe to specific channels. For example, people might want to receive discount alerts without seeing new product announcements. If you need to send a broadcast to everyone on your list, make the reason for the message very clear and remind them how to opt out.
Adhering to this best practice will keep recipients clearly informed of how their details are being processed. This is another way to stay on the correct side of GDPR, supporting your privacy policy and opt-out procedures.
Make Your Identity Clear
It’s important to ensure recipients can easily find your identity. Some senders use short names that don’t always directly relate to their usual branding. These messages could be mistaken as spam. If your name’s too long to fit into the sender field, try to provide it within the body of the message.
Messages should include a link to verify their authenticity if you’re sending from a highly regulated industry or as a major institution. Users could block or report your content if they incorrectly believe they’re sent by an impersonator. This is important for GDPR purposes, too: consumers need to know where to go if they want to opt-out or check your privacy policy.
Conclusion
GDPR is the biggest change to European data-protection laws in a generation. It empowers individuals to take control of how their data is processed and stored. As an SMS marketer, you need to understand how the law functions and the ways in which it can be enforced. GDPR doesn’t spell the end of marketing, but it has made many organizations reassess how they capture and interact with their contacts.
The best practices discussed in this article will help you maintain your GDPR compliance and continue to deliver quality content via SMS. You shouldn’t run into problems if you send only relevant messages, maintain a robust privacy policy, and provide a simple opt-out option.
Many different GDPR-compliant SMS gateways are available, but they can be challenging to set up and integrate with your service. Courier’s API makes it simpler to send SMS marketing communications using platforms such as Twilio, helping you rapidly configure effective campaigns.
Author: James Walker
