GDPR and SMS Marketing: What You Need to Know

The General Data Protection Regulation applies to any organization that processes the personal data of EU residents, regardless of where that organization is headquartered. A US business using Twilio to send SMS marketing messages to customers in Germany, France, or any other EU member state is subject to GDPR requirements for that processing activity. Unlike the TCPA, GDPR penalties are not per-message fines; they are percentage-based, with maximum penalties of 20 million euros or 4% of global annual turnover for the most serious violations, whichever is higher.

The GDPR Lawful Basis for SMS Marketing

Under GDPR Article 6, every data processing activity must have a valid lawful basis. For SMS marketing, the most commonly used and most defensible lawful basis is consent under Article 6(1)(a). Legitimate interest under Article 6(1)(f) is sometimes argued for SMS marketing to existing customers, but data protection authorities in multiple EU jurisdictions have expressed skepticism about using legitimate interest as a basis for direct marketing via electronic channels, and the ePrivacy Directive in most EU countries requires specific opt-in consent for electronic direct marketing independently of GDPR. Using consent as your lawful basis means you must be able to demonstrate that the consent was freely given, specific, informed, and unambiguous, which requires documentation practices similar to but more stringent than TCPA requirements.

GDPR Consent Requirements Are Stricter Than TCPA

GDPR Article 7 sets specific conditions for valid consent that go beyond what US law requires. Consent requests must be presented in a manner clearly distinguishable from other matters, in plain language, and in a way that is easily understandable. The subscriber must have a genuine free choice and must be able to refuse or withdraw consent without detriment. Pre-ticked boxes are explicitly prohibited under GDPR for consent, a requirement that aligns with TCPA best practices but is a legal obligation rather than a recommendation under EU law. You must also be able to demonstrate that consent was obtained if challenged, which requires retaining records indefinitely or until you have a confirmed basis for deletion. Consent obtained for one purpose cannot be repurposed for a different use without obtaining fresh consent.

The Right to Erasure and What It Means for SMS

GDPR Article 17 gives EU residents the right to request deletion of their personal data, including their phone number and the records of their SMS marketing consent. When a subscriber exercises their right to erasure, you must delete their phone number from your active sending list, delete their consent records, and delete any message history you have retained, subject to legitimate retention exceptions such as legal claims or regulatory obligations. This creates a practical tension: TCPA compliance requires retaining consent records for up to four years to defend against litigation, while GDPR right to erasure requests may require deleting those same records. Legal advice for your specific situation is essential, but a common approach is to retain a minimal record of the erasure request itself while deleting all other personal data, which allows you to demonstrate that you honored the erasure request without retaining the full consent record.

Data Transfer and Twilio as a Data Processor

When you use Twilio to send SMS messages to EU residents, Twilio acts as a data processor on your behalf, and your use of Twilio must comply with GDPR Chapter V restrictions on international data transfers. Twilio provides a Data Processing Agreement that incorporates Standard Contractual Clauses approved by the European Commission, which provides the legal mechanism for transferring EU personal data to Twilio's US-based infrastructure. You must execute this DPA with Twilio before processing any EU resident phone numbers through the platform. Additionally, your own privacy policy must disclose that you use Twilio as a data processor for SMS communications, the categories of data processed, and the legal basis for any international transfer. Failure to have a current DPA in place with your messaging service provider is a GDPR violation independently of how well your opt-in process is designed.

Conclusion

GDPR compliance for SMS marketing requires combining technical consent capture, documented lawful basis, a functioning erasure workflow, and a signed Data Processing Agreement with every messaging provider you use. Speak with our compliance team and we will audit your Twilio setup for GDPR gaps and implement the necessary controls.