Building an Bulk SMS opt-in list can sound simple. Add a checkbox to a form, collect phone numbers, then start sending messages. Easy enough, right? For UK organisations, though, it’s often a bit more involved, and that can catch people out. SMS is personal, immediate, and very visible, which is why it works so well for marketing and customer updates. It also means the rules matter more than many teams expect at first.

When the consent process is weak, a list can become a risk instead of a useful asset. A contact database filled with unclear permissions, old numbers, and mixed channel consent can create problems across marketing, CRM, operations, and compliance. In most cases, it turns into a real headache. That tends to matter even more in regulated sectors such as healthcare, education, finance, retail, and travel, where checks and reviews are usually stricter.

The good news is that a strong, scalable list is completely achievable. The key is putting the right structure in place from the start. In this guide, you’ll learn how to collect subscriber consent in a way that supports PECR compliant SMS marketing. It explains how to design forms and systems that stand up to review, how to grow an SMS opt-in list without cutting corners, and it also looks at soft opt-in, audit records, developer needs, and common mistakes that can quietly weaken compliance. That gives you a practical starting point.

Start with the rules that shape Bulk SMS opt-in list consent

Before growing a list, it helps to understand what PECR expects. The ICO says marketing texts to individual subscribers will usually need consent unless the narrow soft opt-in exception applies, and that exception is fairly limited. The ICO also makes clear that consent needs to be specific to the channel. In simple terms, a yes to email doesn’t also count as a yes to SMS.

That point often changes how sign-up forms need to be set up. A single line saying ‘I agree to marketing’ is often too vague for strong subscriber consent collection. Really, it leaves too much open to interpretation. A more reliable approach is to ask separately for Email and SMS, and for WhatsApp too where relevant, if that channel is used. That makes it easier to show exactly what the person agreed to.

Ofcom data also shows why SMS still needs care. In the reporting period used in Ofcom’s 2025 Communications Market Report, the UK sent 176 billion SMS and MMS messages, even after a 6% year-on-year decline. Those are still very large numbers. In a separate telecommunications market update, UK mobile messages were 5.86 billion, down 19.9% year on year for that reported period.

These figures don’t define the present by themselves, but they still show the scale. SMS is still a major channel, so PECR compliant SMS marketing needs a clear permission model rather than guesswork, and usually fewer assumptions than some forms still seem to use.

Build forms that collect clear, channel-specific consent for your SMS opt-in list

A compliant form doesn’t need to sound long or intimidating, and that helps. It just needs to be clear, so the person signing up understands they’re agreeing to receive marketing text messages from your organisation. They should also know who is collecting the consent, which channel it applies to, and how they can stop messages later, so there’s less room for confusion.

A strong form will usually include a few basic things:

What to include in every SMS opt-in list point

• Your organisation name
• A clear mention of SMS or text marketing
• A separate unticked checkbox or another clear affirmative action
• A simple note saying people can opt out at any time
• A link to your privacy information, if that’s part of your wider process

The ICO says valid consent must be freely given, specific, informed, unambiguous, and shown through clear affirmative action. It also says that pre-ticked boxes, silence, and inactivity don’t count as valid consent. In practice, that means no hidden defaults and no assumed agreement, which is often where this goes wrong. It’s pretty straightforward.

For example, a retail checkout form might say: ‘Yes, I want marketing text messages from Brand X about offers and updates. I can opt out at any time.’ That’s much stronger than ‘Receive marketing communications.’ The first version clearly names both the sender and the channel. The second leaves too much open to interpretation, and that missing detail is usually the problem. It’s just too vague.

This also matters for developers and CRM teams. Proof can get messy very quickly when the website form uses one version, the app uses another, and the in-store tablet says something different. In most cases, standardising consent wording across systems makes subscriber consent easier to defend. It also makes day-to-day management simpler, especially when teams need to check records later.

Know when soft opt-in applies to an SMS opt-in list and when it does not

Soft opt-in is probably one of the most misunderstood parts of PECR. A lot of teams treat it like a shortcut that covers every customer record, but it does not. The ICO’s guidance says it applies only when contact details were collected during a sale or while discussing a sale. The marketing also needs to be for your own similar products or services, not someone else’s. The person must also get a chance to opt out when the details were collected, and again in every later message.

In most cases, it’s much narrower.

A few examples usually help, I think:

Likely within soft opt-in

A travel company gets your mobile number during booking, which is pretty normal. Later, it sends offers for similar trips from the same brand, and each message includes a clear opt-out, as you’d usually expect.

Likely outside soft opt-in

A college might collect a mobile number for course administration, then later use it for partner promotions. That’s probably outside soft opt-in, and it’s usually fairly easy to spot.

A healthcare provider may use patient contact data for promotional messages that have nothing to do with the original service context. That’s not a small change, and in most cases it won’t fit the original purpose the data was collected for.

A retailer might also use older customer records to promote unrelated third-party products. That’s another fairly clear example where soft opt-in often doesn’t apply.

For charities, there’s also a recent change to note. ICO guidance updated on 28 April 2026 covers changes, including a new charitable soft opt-in under the Data (Use and Access) Act 2025, effective from February 2026. So if a workflow was built before mid-2025, it deserves a fresh legal review, and probably an operational one too.

The safest approach is still simple: if there’s any real doubt that soft opt-in applies, don’t rely on it. Ask for direct SMS consent instead. That usually leaves a cleaner SMS opt-in list and can help avoid later disputes about whether a contact was actually eligible.

Treat proof as part of the SMS opt-in list product, not an afterthought

A compliant list isn’t just a group of phone numbers. It’s a permission record you can actually prove. That is where many businesses tend to run into trouble. They collect consent, but later can’t show the exact wording, the source, the time, or the action the user took.

For scalable PECR compliant SMS marketing, systems should keep:

• The phone number that was submitted
• The time consent was given
• Source page or form ID
• Exact wording shown at sign-up
• Which channel was selected, such as SMS or WhatsApp
• Checkbox state or any other action taken
• Consent version history
• Unsubscribe or suppression events
• Sync history across tools, where relevant

This usually matters even more when teams work across several systems. A form may sit on the website. Consent may be stored in the CRM. Messaging may happen through a platform like Sendmode (UK). If those systems don’t pass consent status through clearly, mistakes follow. They may seem small at first, but they can be expensive. Someone opts out in one place and still gets a campaign somewhere else.

A simple real-world example makes this easier to see: a finance team imports legacy contacts into a CRM without consent metadata. Marketing sees the mobile numbers and sends a campaign. Later, operations can’t prove who agreed to SMS, when they agreed, or what they were shown. In this case, the issue wasn’t just the send itself. It often starts earlier, with poor records.

Good recordkeeping protects the business and the subscriber. It also makes audits, complaint handling, and internal reviews much easier for the team.

Avoid the list-growth tactics that create hidden risk

Fast list growth can look great on a dashboard, and often it does. But the wrong moves can leave behind a weak database, lead to more complaints and opt-outs, and create extra internal clean-up later when the team has to sort through the mess.

Some common mistakes are easy to miss. That’s probably why they happen so often.

Common pitfalls

• Using pre-checked SMS boxes
• Bundling SMS with general terms and conditions
• Importing old contacts with unclear consent
• Assuming email permission covers text messages
• Buying or renting lists without solid proof for your own use
• Forgetting to include an easy opt-out in each message
• Not identifying the sender clearly in every marketing text

The ICO says every marketing text must clearly identify the sender and include a simple opt-out. Subscribers also need to be able to withdraw consent whenever they want, and that usually affects message templates just as much as the forms used to collect sign-ups.

Platform choice matters here. For UK teams sending at scale, a compliance-led business messaging platform can often help keep workflows cleaner without slowing marketing down. A useful approach is to choose a platform that makes it easy to store channel permissions, apply suppression rules, and sync opt-outs quickly. It sounds basic, but it often makes a real difference as lists and campaigns grow.

Strong growth is still possible. Website forms, checkout flows, account areas, event sign-ups, customer support journeys, and QR-based in-person sign-up points can all work well, and most teams will often want to use more than one. The key is making sure every entry point follows the same consent standards, so records stay clear and permission doesn’t become unclear later.

Create an implementation plan that marketing, CRM, and developers can all follow

The best consent process is the one that keeps working day to day. That usually means the legal wording, form design, data structure, and sending workflow all keep working together, since that’s often the tricky part.

A practical rollout plan can look like this: simple, clear, and easy for both the team and daily work.

Step 1: Audit your current data

Split contacts into clear groups: explicit SMS consent, possible soft opt-in, no valid SMS basis, and unknown, which usually keeps things clear and simple.

Step 2: Standardise sign-up wording

Use one approved consent pattern across web forms, apps, live chat, call centre capture, and in-person collection, so it stays the same everywhere. Keeping it consistent often helps.

Step 3: Store consent by channel

Your CRM should keep separate fields for Email, SMS, and WhatsApp, since that’s usually important. Include timestamps and wording versions too. Simple, but important.

Step 4: Automate suppression

When someone opts out, that status should usually move fast across every system so nothing gets missed.

Step 5: Review message templates

Each marketing message should name your organisation and include a simple way to stop the messages.

Step 6: Recheck older workflows

If a process was set up before the latest ICO updates, it’s probably a good idea to give it a quick review now. For Sendmode (UK) and similar UK-focused platforms, workflows usually work best when compliance rules are built in from the start, rather than added later.

Put compliant growth into practice

A strong SMS opt-in list starts with trust. It may feel slower than more aggressive list-building, and in many cases it is. But it usually leads to better data quality, stronger engagement, and fewer issues over time. People tend to respond better when they know exactly what they signed up for. The same goes for internal teams: they usually work better when they’re clear about what they’re allowed to send and when they can send it, which often matters more than people expect.

If subscriber consent collection needs to grow, keeping the rules simple helps. Ask clearly for SMS consent and keep channel choices separate. Broad wording is usually where confusion begins, so it’s better not to depend on it. Use soft opt-in only when it truly applies. Keep proof for every permission, and make opt-outs easy and immediate. In most cases, being specific and consistent means less guesswork later, which tends to help everyone from marketers to compliance teams.

For UK organisations, this approach supports marketing performance while also helping compliance last over time. Retail teams can promote more responsibly. Healthcare and finance teams can reduce risk, and developers or CRM managers can build systems that keep working over time without constant fixes. That’s often what makes the process more useful in day-to-day work.

Why not start with the basics? Review forms, consent records, and the suppression process. Then clean up legacy data and standardise the wording, so the SMS opt-in list grows on a foundation the team can actually trust.