SMS, GDPR and § 7 UWG: what German businesses must observe for transactional and marketing messages

SMS is the most direct channel a business has: almost every message is opened within minutes. That is exactly why German law regulates it tightly. Two sets of rules apply at the same time: data protection law (the GDPR, in Germany usually called DSGVO, with the Federal Data Protection Act, BDSG) governs what you may do with the phone number, and competition law (the Act against Unfair Competition, UWG) governs whether you may send advertising to it at all.

Transactional or marketing? The question everything depends on

A transactional SMS is part of fulfilling something the recipient asked for: an order confirmation, a shipping notice, an appointment reminder, a verification code, a notice that an invoice is due or that a repair is finished. The recipient expects it, and it contains no promotion.

A marketing SMS promotes your goods or services: a discount, a new collection, a request for a review, a “we miss you” message. German courts read “advertising” (Werbung) broadly: anything intended to promote sales counts, a satisfaction survey or a birthday voucher included.

The dividing line matters because a transactional message with a promotional sentence attached (“Your order has shipped. Save 10 % on your next order with code …”) becomes advertising as a whole and needs the consent described below. Keep the two kinds of messages separate, in your templates and in your database.

GDPR: the legal basis for processing the number

A mobile number is personal data. Every SMS you send is a processing operation that needs a legal basis under Article 6(1) GDPR:

• Transactional messages usually rest on Art. 6(1)(b): processing necessary for the performance of a contract or for steps requested by the data subject before entering into one. A shipping notice to a customer who gave you the number at checkout needs no separate consent under data protection law.
• Security messages such as login codes can rest on Art. 6(1)(b) or on legitimate interest, Art. 6(1)(f), when the account owner benefits from the protection.
• Marketing messages in practice rest on consent, Art. 6(1)(a), because the UWG requires express consent anyway (see below).

Whatever the basis, the usual duties apply: inform people about the processing at the point of collection (Art. 13), name the purpose and the recipients, including your SMS gateway as a processor, keep the number only as long as needed (Art. 5(1)(e)), honour the right to object to direct marketing at any time (Art. 21(2)) and record the processing in your register of processing activities (Art. 30). Consent must be as easy to withdraw as it was to give (Art. 7(3)).

§ 7 UWG: express prior consent for marketing SMS

The central rule for advertising by SMS in Germany is § 7 para. 2 no. 2 UWG. Advertising “using electronic mail” without the recipient’s prior express consent is always an unreasonable nuisance. “Electronic mail” is understood in the sense of Art. 2 of the ePrivacy Directive 2002/58/EC and covers SMS as well as e-mail, messenger messages and push notifications. The rule applies to consumers and to business recipients alike.

What “express consent” means in practice:

• The person actively agrees to receive advertising by SMS from your company. A pre-ticked box, consent hidden in terms and conditions, or consent to “e-mail and other channels” is not enough.
• The consent must exist before the first message. A first SMS asking for consent is itself advertising and therefore not allowed.
• You must be able to prove it. In a dispute the burden of proof lies with the advertiser, which is why the double opt-in procedure below has become the standard.

There is one exception, § 7 para. 3 UWG, often called the existing-customer rule. Advertising by electronic mail without consent is permitted if all four conditions are met: (1) you obtained the address from the customer in connection with the sale of goods or services, (2) you use it for direct advertising of your own similar goods or services, (3) the customer has not objected, and (4) at collection and in every message you clearly inform the customer that they can object at any time at no cost beyond basic transmission charges. The exception is interpreted narrowly; treat it as a fallback, not as a plan.

Double opt-in: how consent is proven

Double opt-in means that the person first enters their number and ticks a consent box, and then confirms via the channel itself, for SMS with a one-time code or a confirmation link sent to the number. That gives you evidence that the number belongs to the person who consented. Your records should keep, for every number:

• the exact wording of the consent text shown, including the version;
• date and time of the request and of the confirmation, plus the IP address or session;
• the channel and purpose consented to (SMS, marketing by your company);
• the date and manner of any withdrawal.

Technically the confirmation step is an ordinary verification message. With TopSMS you can use the Verify API, which sends a code and checks the answer with built-in limits; the OTP guide on this blog shows the integration step by step. The code message itself is transactional.

Opt-out: free, simple and honoured

Every marketing message must give the recipient a way to stop further messages at no cost beyond the basic transmission charge; the absence of a valid address for this is itself an unreasonable nuisance under § 7 para. 2 no. 3 lit. c UWG. The classic “reply STOP” only works when you send from a phone number. If your messages carry your company name as sender, the recipient cannot reply, so include a short link to an unsubscribe page, an e-mail address or a phone number instead.

In TopSMS, opted-out numbers are kept on the account blacklist: you mark them in the contact detail or import a CSV with an optOut column, and the API rejects any message to such a number with code 400. You manage the consent; the gateway makes sure a forgotten filter in your own system does not result in a message to someone who said no.

Who is sending? Identification duties

A website needs an Impressum under § 5 of the Digital Services Act (DDG, the successor of § 5 TMG). An SMS has no room for a full Impressum, but two rules still apply to its content. Under § 6 para. 1 DDG commercial communications must be clearly recognisable as such, and the natural or legal person on whose behalf they are sent must be clearly identifiable. Under § 7 para. 2 no. 3 lit. a UWG a message in which the sender’s identity is concealed or disguised is an unreasonable nuisance. In practice: send marketing under your real company name as the sender ID and link to a page that carries your Impressum. Offers must state their conditions clearly (§ 6 para. 1 no. 3 DDG), so a “20 % off” message needs the conditions or a link to them.

What happens when it goes wrong

Unsolicited advertising gives competitors and consumer associations a claim for injunctive relief (§ 8 UWG), usually enforced through a warning letter (Abmahnung) with a cease-and-desist declaration and lawyer’s fees. Under the GDPR, supervisory authorities can impose fines under Art. 83, up to €20 million or 4 % of worldwide annual turnover, and data subjects can claim damages under Art. 82. Individual SMS cases are usually far cheaper than that, but the reputational cost of spamming your own customers is real.

The gateway as a processor: Art. 28 and EU hosting

Your SMS gateway processes numbers and message texts on your behalf. That makes it a processor under Art. 4(8) GDPR, and Art. 28(3) requires a written contract, the data processing agreement (DPA, in German Auftragsverarbeitungsvertrag or AVV), that sets out instructions, confidentiality, security measures, sub-processors, deletion and audit rights. Ask every provider for it before you send the first number. Check also where the data is processed: processing within the EU avoids the additional requirements for transfers to third countries in Art. 44 et seq. GDPR.

With TopSMS the DPA under Art. 28 GDPR is published at topsms.eu/dpa and applies to every account without separate paperwork. The application and database run in an EU data centre, delivery to the networks goes through EU-based carriers, and no data leaves the EU for message delivery.

Checklist

1. Separate transactional and marketing templates; never mix a promotion into a notification.
2. Collect express, SMS-specific, company-specific consent before the first marketing message; use double opt-in and store the evidence.
3. Rely on the existing-customer exception of § 7 para. 3 UWG only after checking all four conditions.
4. Put a free opt-out into every marketing message and maintain the blacklist.
5. Send under your real company name and link to your Impressum; state conditions of offers.
6. Update your privacy notice (Art. 13) and your register of processing activities (Art. 30) to include SMS and the gateway.
7. Sign a DPA with the gateway and prefer processing inside the EU.
8. Set deletion periods for numbers, consents and message logs.