You have gone through the entire process of identifying your target audience, collecting their phone numbers, writing copy for your campaigns, and defining all your preferences.

But before you send your SMS, take a moment to check your campaign and answer one very important question: are you 100% GDPR compliant?

We brought together our lawyers, Sophie Soubelet-Caroit and Perrine Salagnac from SSC Avocats, to understand the implications of GDPR and data protection.

To be concise, in this section, we will focus only on the fundamentals of GDPR, data collection, and consent for SMS marketing campaigns. However, we encourage you to also read our guide Cybersecurity and SMS Marketing: protect your data, in which we explore in depth how to ensure the security of our data, prevent attacks and breaches, and what to do in the event that one occurs.

What is the GDPR?

The General Data Protection Regulation (GDPR) is a "privacy and security law that imposes obligations on any type of institution collecting data from users who belong to the European Union," even when the institution itself is not based in the EU. For example, if you are based in Brazil but process data from European customers or visitors, you must be GDPR compliant.

This regulation was established in 2016 and enforced in 2018 to put an end to nonsensical terms and conditions that neither users could understand nor companies wanted to explain.

The goal here is to ensure that companies inform people correctly and in an understandable way so that they can freely decide whether or not they want to engage with them. This also involves making data protection a central element of all company processes.

• What is the goal of the GDPR? To ensure that users can understand what is being offered to them so they can freely choose when they want to engage or disengage at will, having full authority over their data and its use by third parties.
• Who must comply with the GDPR? All institutions that process the data of EU citizens, even if the institution itself is not based in the EU.
• Can you be fined for violating the GDPR? Yes, you can be fined, and the fines are very high. They can reach up to €20 million or 4% of global revenue (whichever is higher), plus compensation for damages suffered by the data subjects.

Is it only about consent?

"When you read about it on marketing websites, they only care about consent. Is it all about consent? The answer is NO," explains Perrine.

"Consent is not always necessary when dealing with the GDPR. That is a very common misconception. In fact, in Article 6 of the GDPR, you will see that there are other legal bases. Consent is just one of them," she says. Each data controller must choose the bases that are appropriate and feasible for them.

However, if you take other regulations into account, such as the "Post and Electronic Communications Code" and its application regulated by the entity known as ARCEP, in some cases but not in all, you must obtain consent. But it is not the same consent: one concerns data collection, the other SMS messaging. These are two different things," Sophie points out.

So, what can we do to be 100% sure we are complying with the regulations? "It is dangerous to have a one-size-fits-all approach, because you need a case-by-case analysis of the legal requirements," says Sophie. Every case is different, and the answer to this question will depend on the local laws that apply to your customers and your business.

How do you ask for consent?

The GDPR stipulates that consent must be:

• Freely given : it must be voluntary
• Informed : tell the person what information you are going to keep and how you intend to use it
• Unambiguous : stated in clear and simple language
• Specific : clearly distinguished from other matters
• Explicit : you cannot imply it; individuals must give consent in an affirmative manner, such as "I understand and I agree..."

Examples of GDPR-compliant forms

Regulations in France

At Octopush, 70% of our clients are based in France, so it made sense to include a specific analysis of the different types of consent here. Here is a brief summary of our discussion with Sophie and Perrine that can serve as a guide.

Requirements for sending commercial SMS

According to the CNIL, every text message must include:

• The sender's identity: clearly indicate to recipients who is sending the SMS
• An easy and clear opt-out option: such as STOP to XXXX, or noPUB=STOP

Sending times

Most SMS and MMS providers cite the same information from ARCEP:

To prevent abuse and nuisance, sending times are restricted. For most operators, mobile SMS are prohibited between 8:00 PM and 8:00 AM on weekdays. Sending is also prohibited all day on Sundays and public holidays. Any violation of this rule is punishable by a fine of €1,000 excluding tax per infraction.

However, after consulting with our lawyers, this information should be qualified. There is no law in France that specifies the hours and days when you can or cannot send SMS. Consequently, you cannot be fined on this basis.

Nevertheless, the prohibition on sending SMS/MMS between 8:00 PM and 8:00 AM or on Sundays and public holidays is a best practice observed by responsible companies in France. Therefore, these rules are often stipulated in the terms and conditions of SMS and MMS providers and must be respected by Octopush and, by extension, its clients.

Useful links

Commercial prospecting via SMS-MMS (CNIL)

Advertising messages via SMS or MMS: is it legal? (CNIL)

Art. 8 (GDPR)