SMS Marketing for Online Stores — Consent, Cost and Compliance

An SMS campaign is a batch of text messages sent to a group of recipients from one number or sender name — usually through an SMS gateway, not from the shop's own phone. An online store sends two kinds of text message, and the law treats them very differently. A transactional SMS reports on an order the customer has already placed. SMS marketing is any message with an offer, a discount or a nudge to buy — and that is the one that needs the most preparation. Before your first campaign you need two independent legal bases, one of them specific to the channel. You can work out the cost in advance, because gateways publish their prices per message — and for Polish numbers they are published in PLN by the Polish gateways. The last part of the article covers email, the other owned channel in the customer lifecycle, which comes with its own requirements from mailbox providers.

Two legal bases for SMS marketing: GDPR and the ePrivacy rules (Art. 398 PKE)

To send an SMS marketing campaign legally, a store needs two independent legal bases — not one.

The first is a lawful basis under Article 6(1) of the GDPR to process the customer's phone number for a marketing purpose at all. In practice, that's usually consent (point (a)) or, for a customer who has already bought something, legitimate interest (point (f)); the article also lists performance of a contract (b) and legal obligation (c), but those two cover fulfilling the order itself, not sending offers.

The second, separate basis is consent to the channel itself, under the EU ePrivacy Directive (2002/58/EC), Article 13. Article 13(1) allows electronic mail to be used for direct marketing only to recipients who have given their prior consent, and the Directive's definition of "electronic mail" (Article 2(h)) covers any stored text message, which is why it applies to SMS as well — recital 40 names SMS explicitly. Article 13(2) adds one exception: a business that obtained a customer's contact details in the context of a sale may use them to market its own similar products or services, provided the customer was clearly given a free, easy way to object when the details were collected and is given it again in every message. Each EU member state transposes the Directive into national law, and in Poland the provision is Art. 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej, PKE; Journal of Laws 2024, item 1221). It says: “It is prohibited to use: 1) automatic calling systems, 2) telecommunications terminal equipment […] for the purpose of sending commercial information […], including direct marketing, to a subscriber or end user, unless they have given their prior consent.” Two further points are easy to miss. The sending “cannot take place at the expense of the end user or subscriber”, so the customer does not pay to receive your campaign. And breaching the prohibition “constitutes an act of unfair competition” under the Act on Combating Unfair Competition, so the consequences go beyond the GDPR. Art. 398 makes no exception for people who have already bought from you, so for Polish recipients plan on prior consent to the SMS channel even for existing customers. An SMS marketing message sent without this second consent breaches Art. 398 regardless of whether the GDPR basis was in order, and each layer is checked separately: getting one right does not fix a missing other. The authorities involved are the President of the Personal Data Protection Office (UODO) for the GDPR layer and the President of the Office of Electronic Communications (Urząd Komunikacji Elektronicznej, UKE) for the telecommunications layer.

The GDPR also says what valid consent looks like: a freely given, specific, informed and unambiguous indication of the customer's wishes, by a statement or a clear affirmative action (Art. 4(11)), which you must be able to demonstrate (Art. 7(1)). The practical conclusion: consent recorded only as "consent to processing of personal data", with no mention of the SMS channel, is not enough to send an SMS marketing campaign. You need a separate record of consent to this specific channel — ideally with the date, the exact wording the customer accepted, and where they gave it.

Where you collect that consent can vary: a checkbox in the order form (unticked by default, not required to complete the purchase), a separate field in account settings, or a sign-up form for a text-message list on the store's site. Any of these works, as long as the customer clearly understands they're signing up for marketing messages, not just order-status notifications.

Transactional SMS vs. SMS marketing — where the line sits

A transactional SMS reports on something already happening within an order the customer placed: an order confirmation, a shipping-status change, a pickup code for a parcel locker, a pickup-deadline reminder. A message like that follows from performing the contract — it doesn't need the ePrivacy consent, because it generally isn't "direct marketing" under that rule, only the execution of a transaction already agreed.

SMS marketing, by contrast, is any message that encourages a purchase or promotes an offer, a discount, a sale or a new product — regardless of whether it goes to an existing customer or to someone who only signed up to a list. This type always needs both legal bases described above, with no exception for people who already bought from you: legitimate interest can replace consent under the GDPR, but it does not replace consent to the channel.

The line gets blurry in one place: a status update that also carries a cross-sell link ("buy the accessory for the product we just shipped") stops being purely transactional for that extra part. If you don't have marketing consent for every recipient of your status SMS, split the two messages instead of combining them.

The mechanism for sending automatic transactional SMS on an order-status change is covered in our sales automation article — it also covers triggers for cart reminders. If you're implementing automatic transactional SMS yourself and need help integrating an SMS gateway with your order system, see our process automation offer. A legitimate SMS marketing campaign, sent under your store's own name to recipients covered by the legal bases above, is not smishing — regardless of the offer in it.

How much an SMS marketing campaign costs

SMS gateways price per message, and three things move the rate: the volume you buy, the plan, and the type of sender. For Polish numbers three gateways publish their prices openly, in PLN net.

SMSAPI has two models. Prepaid: an SMS costs from PLN 0.17 for a top-up of PLN 49–499.99 down to PLN 0.11 for a top-up above PLN 10,000, and the rate is set by the amount of the last single top-up. Postpaid (marked “bestseller” on the page): you pay a PLN 49 monthly subscription, and the price falls from PLN 0.14 (1–1,000 messages a month) to PLN 0.08 (50,001–100,000 messages a month). These are reduced rates — next to them the page shows struck-through prices from PLN 0.16 to 0.10. The provider states explicitly that the prices are net.

SerwerSMS has four monthly (post-paid) plans, each with a subscription and a pool of SMS included: Lite — PLN 49 a month, PLN 0.19 per SMS, 100 SMS in the package, limit of 3,000 recipients; Standard — PLN 99, PLN 0.17, 400 SMS, 12,000 recipients; Growth — PLN 199, PLN 0.15, 2,000 SMS, 30,000 recipients; Pro — PLN 299, PLN 0.10, 4,000 SMS, 60,000 recipients. Subscriptions are quoted after a promotional 60% discount from list prices (PLN 123–749), and 23% VAT is added to all amounts. So you choose a plan not only by the rate per SMS but also by the recipient limit: a list of 10,000 numbers will not fit in the Lite plan.

JustSend charges no subscription (the minimum top-up is PLN 50) and prices by message type: Basic PLN 0.07 — sent from a numeric sender, Unique PLN 0.08 — one of 10 ready-made sender names, Dynamic PLN 0.09 — your own sender name of up to 11 characters, Voice PLN 0.15, International, that is EU and UK, PLN 0.35. When comparing rates, keep this distinction in mind: the cheapest variant will not send an SMS under your shop's name.

Net prices per SMS at the three publicly priced gateways therefore run from PLN 0.07 (JustSend Basic) to PLN 0.19 (SerwerSMS Lite), depending on the provider, plan and volume. Let's calculate a campaign to 10,000 recipients. In SMSAPI prepaid the PLN 0.11 rate requires a top-up above PLN 10,000, so for a one-off campaign the PLN 500–1,999.99 tier applies, at PLN 0.16 per SMS: 10,000 × PLN 0.16 = PLN 1,600 net, plus 23% VAT = PLN 1,968 gross. In SMSAPI postpaid 10,000 messages a month fall into the 5,001–10,000 tier at PLN 0.12: PLN 1,200 plus the PLN 49 subscription gives PLN 1,249 net, PLN 1,536.27 gross. JustSend with your own sender name (Dynamic, PLN 0.09) is 10,000 × PLN 0.09 = PLN 900 net, PLN 1,107 gross, and the Basic variant (PLN 0.07, numeric sender) PLN 700 net, PLN 861 gross. The same list therefore costs from PLN 861 to PLN 1,968 gross, depending on the gateway and the billing model. Work this out before choosing a provider, not at the first invoice. None of the three providers states a validity period for its price list beyond the current version of the page, so treat these numbers as prices from 1 October 2026 (read 2026-10-01), not as a fixed value.

The same calculation applies to sends abroad. 1,000 messages at JustSend's international price for EU and UK recipients (PLN 0.35 per SMS) is PLN 350 net, or PLN 430.50 gross — on a list ten times shorter than the domestic example. Before you send a campaign to foreign numbers, check the rate for that category, not only the domestic one.

Two more factors change the bill. Many providers sell monthly plans with a subscription on top of the per-message rate (PLN 49 a month for SMSAPI postpaid, PLN 49 to 299 for SerwerSMS), which matters more at low volume: a prepaid model without a subscription can be cheaper for occasional, small campaigns despite a higher rate per SMS, and the other way round for frequent, large ones. And messages are billed per segment, not per text: "a long message or some character sets can produce multiple segments, so a single message can incur more than one segment charge" (Bird SMS pricing, read 2026-10-02). A campaign written with special characters or running over one segment can double its cost without anyone noticing.

The calculation before you choose a provider is simple: number of recipients × price per message × number of segments, plus any subscription. Run it on your actual list, split into domestic and foreign numbers, rather than on a single headline rate.

Consent records and opt-outs

The two legal bases above are only as good as your ability to show them. GDPR's information duties (Article 13) mean a customer needs to know who's processing their number, for what purpose and for how long — and the whole accountability of the consent process rests on Article 6: you need to be able to point to the specific consent (date, wording, channel) that authorises sending to a given number. In practice, that means storing a consent record per phone number, not just a ticked checkbox with no date or wording attached.

Every SMS marketing campaign also needs an opt-out mechanism. GDPR Article 7(3) requires withdrawing consent to be as easy as giving it, and once consent is withdrawn it is no longer a basis under Article 6 — further messages to that number have no legal basis at all, however well the consent was originally collected. How a recipient opts out (a reply to the sending number, a link in the message) depends on what your gateway supports; check this in its control panel before your first campaign. Once an opt-out comes in, remove that number from your marketing lists immediately.

Keep the consent record and the opt-out history in one, easily searchable place — your shop system, your CRM or the SMS gateway itself, whichever one you already run as your main contact register. Spreading this data across a spreadsheet, the gateway's panel and your customer database makes it harder to prove consent in an audit and increases the risk of messaging someone who has already opted out.

Email in the customer lifecycle

Email works alongside SMS in the customer lifecycle. Newsletter strategy has its own article on email marketing; here there is only one thing you need to know whatever your strategy: Google, Yahoo and Microsoft introduced hard technical requirements for bulk senders in 2024 and 2025, and without meeting them your campaigns can land in spam or be rejected outright.

Gmail set requirements from 1 February 2024. Every sender needs SPF or DKIM, correct DNS records (including a reverse record), TLS encryption in transit and RFC 5322-compliant formatting, and a spam rate in Postmaster Tools that stays below 0.3% (Google recommends keeping it under 0.1%). Senders of more than 5,000 messages a day additionally need SPF, DKIM (at least a 1024-bit key, 2048 recommended) and DMARC together, with a "From" domain aligned to the SPF or DKIM domain, and marketing/subscription email must support one-click unsubscribe (the List-Unsubscribe and List-Unsubscribe-Post headers) plus a visible unsubscribe link in the body.

Yahoo enforces equivalent requirements from February 2024. Bulk senders need SPF and DKIM, a public DMARC policy (at minimum "p=none"), a "From" domain aligned to the SPF or DKIM domain, a working one-click unsubscribe header (the recommended method is a POST request per RFC 8058; mailto is also acceptable) — opt-outs must be honoured within 2 days — and a spam rate below 0.3%, measured against mail that was actually delivered to the inbox, not against everything sent.

Microsoft added its own requirements from 5 May 2025 for domains sending more than 5,000 messages a day to Outlook.com consumer addresses (hotmail.com, live.com and outlook.com): SPF and DKIM must pass, and DMARC must carry a policy of at least "p=none" aligned with SPF or DKIM. Since that date, non-compliant mail from such senders has been routed to the Junk folder; the announcement's 29 April 2025 update says it will later be rejected outright (Microsoft has not given a date) with the code "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." Microsoft lists a functional unsubscribe link and list hygiene as recommendations rather than requirements, and doesn't publish a numeric spam-rate threshold.

The practical conclusion is the same as in the consent section above: technical compliance with a provider's rules (SPF/DKIM/DMARC for email) and legal compliance (two legal bases for SMS and email) are both a condition of sending, not an extra. Without them a campaign either won't reach the recipient or shouldn't go out at all. Abandoned-cart reminders, sent by email or SMS, have their own logic and triggers — covered in our cart-abandonment article.

How to measure an SMS marketing campaign

An SMS itself doesn't report clicks — whether you can count them depends on the link. Some gateways have their own link shorteners, but traffic only arrives in Google Analytics 4 with the right source if the link to your offer carries UTM parameters — add them and shorten the link before you send. A click from the campaign then shows up in GA4 with its own source and medium, like any other campaign traffic; without UTM parameters you can't tell SMS traffic apart from organic or any other channel.

A click, though, is only half the measurement. The other half is whether that click turned into an order. Divide the campaign cost from the section above by the number of orders it actually produced, to get a cost per order for that specific channel — the same metric we cover generally, across all channels, in our e-commerce KPI article. Don't compare an SMS campaign to an email campaign on click-through rate alone — the two channels differ in cost per recipient, so what actually decides which one performs is cost per order, not raw traffic.