# Messaging Compliance Basics: Consent & Opt-Out | ZafeConnect

> A practical overview of consent, opt-out and sender identity for business messaging in the EU and beyond. General information, not legal advice.

Canonical URL: https://www.zafeconnect.com/resources/messaging-compliance-basics
Language: en
Last modified: 2026-11-09

## Messaging compliance basics: consent, opt-out and sender identity

URL: https://www.zafeconnect.com/resources/messaging-compliance-basics

Rules for business messaging differ by country and by message type, but a few principles apply almost everywhere. This guide is general information and not legal advice.

Key takeaways:
- Marketing messages generally need prior consent. Service messages follow different rules.
- Always offer a clear, free way to opt out, and honour it quickly.
- Be transparent about who is sending, and use a recognisable sender where allowed.
- Keep records of consent, and check local rules with your legal adviser.

### Service messages versus marketing messages
Service (transactional) messages relate to something the customer asked for or an existing relationship, such as a delivery update or a security code. Marketing messages promote products or services.

In the EU, marketing by electronic message generally requires prior consent, with limited exceptions for existing customers. Many other countries apply similar or stricter rules.

### Consent

- Ask clearly and separately; do not bury consent in general terms
- Say what the customer will receive and how often
- Keep a record of when and how consent was given
- Make withdrawing consent as easy as giving it

### Opt-out
Include simple opt-out instructions in marketing messages and honour requests promptly. Two-way messaging can process replies such as STOP automatically.

### Sender identity
Customers should know who is messaging them. Some countries require SenderIDs to be registered and others restrict alphanumeric senders. Plan for local requirements before launch.

### Data protection
Phone numbers are personal data. Under the GDPR you need a lawful basis, must keep data secure and limit retention, and must respect individuals’ rights. When a messaging provider processes data on your behalf, a data processing agreement is required.

### Health, finance and other sensitive topics
Keep message content minimal and link to a secure channel for details. Sensitive categories need extra care and may need agreement with your data protection officer.

### Country-specific registration
Some countries require registration of message content, templates or sender identity with operators or regulators. For example, the United States requires registration for A2P traffic on certain number types. Requirements change, so confirm them for each destination.

This page is general information. Rules change and depend on your situation, so ask your legal adviser.

FAQ:
Q: Do I need consent for transactional messages?
A: Service messages about something the customer requested usually do not need marketing consent, but rules vary. Do not use them to slip in promotions.

Q: What is a data processing agreement?
A: A contract between a data controller (you) and a processor (your provider) that sets out how personal data is handled. The GDPR requires one when a provider processes personal data on your behalf.