SMS marketing for ecommerce in the EU: consent first, then copy

The relevant EU rule is Article 13 of the ePrivacy Directive (2002/58/EC). Article 13(1) sets the starting point: electronic mail for direct marketing needs the recipient's prior consent¹. Article 13(2) is the exception for existing customers, covered below.

A directive is written into each country's own law. Wording and enforcement differ, so a rule that holds in one market may not hold in the next. France's regulator, the CNIL, applies the consent rule to email, SMS-MMS and automated calls alike².

Our view: treat email and SMS as the same consent question until your counsel tells you otherwise for a specific country.

Regulators publish their own guidance. Two are worth comparing, because they show how much it differs.

France (CNIL). For consumers, the CNIL says marketing by email, SMS-MMS or automated call needs prior consent². Professionals can be prospected without prior consent when the message relates to their profession, as long as they are informed and can object². On consent itself, the CNIL describes it as free, specific, informed and unambiguous. It recommends a checkbox, prohibits pre-ticked boxes, and says that accepting terms and conditions is not consent⁴.

UK (ICO). The UK is outside the EU, and its rules are the Privacy and Electronic Communications Regulations (PECR). We use the ICO as a second example only. Its guidance says you must have consent, or meet all the soft opt-in requirements, to send electronic mail marketing to individual subscribers, while corporate subscribers can be sent it without either⁵. The guidance applies to text messages as well as email⁵.

The differences are the point. Do not copy one regulator's checklist across your markets.

The soft opt-in is the exception in Article 13(2). It covers a business emailing its own customers about its own similar products or services, where it obtained their details in the context of a sale and offered a simple, free way to object both when collecting the details and in every message¹.

What the two regulators add:

• France. The CNIL says the exception cannot be used when no sale took place, including when the person only created an online account².
• UK. The ICO lists the conditions: you obtained the details yourself, during a sale or negotiation for a sale, you market only your own similar products and services, and you offered an opt-out at collection and in every later message⁵.

Cases to take to your counsel, rather than decide yourself:

• Account holders who never bought.
• Newsletter sign-ups who never bought.
• Numbers or addresses that came from a third party.
• Business contacts, which the two regulators treat differently from consumers.

Your counsel decides where each of these lands in your markets.

Treat consent as something people do, not something you assume. Based on the CNIL's description⁴, a workable pattern is:

1. A dedicated checkbox. The person ticks it. It is never pre-ticked.
2. A specific statement. Say plainly that it is for marketing SMS. Do not bury it in the terms and conditions.
3. Kept apart from the terms. Accepting the terms is not consent⁴.
4. An easy way to withdraw. The CNIL says the person can withdraw consent at any time².
5. A record. Store who consented, when, and to what wording.

On Shopify, the platform's help pages describe an SMS sign-up checkbox at checkout and say the merchant is responsible for making sure automated consent settings comply with applicable laws⁶. That is a vendor's documentation of its own tool. It does not tell you whether your wording meets your country's rules. Your counsel approves the text.

First-party data, meaning data you collect directly from your customers, is the asset here. A phone number gathered with clean consent is worth more than a larger list you cannot defend.

An abandoned cart flow is an automated series of messages to people who started checkout and did not buy. It is one of the standard email automation flows, and the obvious candidate for SMS.

The consent question is whether a reminder counts as marketing, and whether the person agreed to receive it. We do not give a general answer: your counsel decides. One practical detail from a platform: Shopify's help pages say its default checkbox text tells customers they are signing up for news and offers, and that you must change that text if you send abandoned cart reminders⁶.

Practical steps that do not depend on the legal answer:

• Show the consent wording at the point where you collect the number.
• Send only the types of message the person agreed to.
• Make opt-out as easy as opt-in.

Consent is the legal side. The business side is whether SMS earns its place. Texts cost money per message, and the price varies by provider, so we give no figure here. Judge SMS the way you judge any channel:

• Does it add orders you would not get anyway? Compare against a holdout. People who opt in to SMS may be your most engaged customers already.
• Does it pay on margin? Count the message cost, any discount and the effort against contribution margin.
• Does it hurt other channels? Check email unsubscribes and complaints after an SMS push.

For the choice between channels, see email vs SMS marketing for ecommerce.