To run SMS marketing in South Africa you need prior consent from each recipient, unless they are an existing customer whose number you collected during a sale and you are marketing your own similar products, as section 69 of the Protection of Personal Information Act (POPIA) sets out. Every marketing message must identify you and give a way to opt out, and the WASPA Code of Conduct and Consumer Protection Act regulations bar direct marketing on Sundays, public holidays, Saturdays outside 09:00 to 13:00 and other days between 20:00 and 08:00.

Last reviewed: 28 October 2026

This guide is for marketing, CRM and compliance teams at South African retailers, insurers, lenders, clinics and online stores. It goes beyond our bulk SMS overview for South Africa to cover the consent rules in detail, the Information Regulator's position, WASPA obligations, the four networks, sender IDs, language and encoding, and a checklist you can work through before your first campaign. It is not legal advice; check edge cases with your attorney or the Information Regulator.

The three rulebooks that shape a South African SMS campaign

RulebookWho enforces itWhat it means for SMS
POPIA, section 69Information RegulatorConsent or the existing-customer route; sender identity and an opt-out address in every message
Consumer Protection Act (CPA) section 11 and 12, plus regulationsNational Consumer CommissionRight to block direct marketing; prohibited days and hours
WASPA Code of Conduct, section 16Wireless Application Service Providers' Association (industry body)Binds members that carry your traffic: STOP replies, opt-out confirmation, timing rules, proof of consent on request

POPIA section 69 in plain language

Section 69(1) prohibits processing personal information for direct marketing "by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail" unless the person has consented or is your customer. SMS is named in the Act, so there is no grey area about whether it applies.

Route 1: consent

Under section 69(2) you may approach a person whose consent you need only once, to ask for that consent, and only if they have not already refused. The request must follow the prescribed form (Form 4 of the POPIA Regulations). In practice that means a first SMS to a new number must be a consent request, not an offer. The Regulations also state that an opt-out does not count as consent for this purpose, so "we will message you unless you tell us not to" does not work.

Route 2: existing customers

Section 69(3) lets you market to a customer without separate consent if all three conditions are met:

  1. You obtained their contact details in the context of selling them a product or service.
  2. You are marketing your own similar products or services.
  3. They had a reasonable, free opportunity to object when you collected the details, and on every marketing message since.

A clothing retailer texting a past buyer about a new range fits. The same retailer texting that buyer about a partner's insurance product does not, because it is not the retailer's own similar product.

What every marketing SMS must contain

Section 69(4) requires the identity of the sender (or the business on whose behalf it is sent) and an address or other contact details for opt-out requests. On SMS that usually means the brand name at the start and a STOP instruction or opt-out link at the end.

The Regulator's direct marketing guidance

The Information Regulator published a Guidance Note on Direct Marketing in December 2024. Law firm summaries note that it treats SMS as electronic communication, expects you to keep a record of people who refused consent, and takes the view that a person who has not registered a pre-emptive block still has to be asked for consent. The note is guidance rather than binding law, but it shows how the Regulator reads section 69.

WASPA rules your provider has to apply

Messaging providers that are WASPA members must follow the Code of Conduct, so these rules reach you through your provider's terms. From version 17.10 of the Code:

  • Prohibited times (16.8): no direct marketing on Sundays or public holidays, on Saturdays before 09:00 or after 13:00, or on other days between 20:00 and 08:00. The CPA regulations set the same windows.
  • STOP replies (16.15 and 16.16): where technically feasible, recipients must be able to opt out by replying STOP, and END, CANCEL, UNSUBSCRIBE and QUIT must be honoured too, in any capitalisation. Where replies are not possible, clear opt-out instructions go in the message body.
  • Confirmation (16.14): once someone opts out, a free message confirming the opt-out must be sent.
  • Source of data (16.13): on request, the sender must say where the number came from and prove consent or a prior sale.
  • Limits (17.2 to 17.3A): opt-outs do not have to block messages needed to perform a contract, messages required by law, or personal messages meant only for that recipient. Delivery notices, OTPs and account alerts fall here.

A one-way alphanumeric sender ID cannot receive replies, so if you want "Reply STOP" to work, send from a two-way number or include an opt-out link that writes to your opt-out list. The eSMS dashboard blocks sends to any number on your opt-out list. See two-way SMS for inbound options.

Networks and number format

South Africa has four mobile networks: Vodacom, MTN, Cell C and Telkom. Numbers are portable, so the prefix does not reliably tell you the network; route on the full number and let delivery reports confirm the outcome. Store every number in E.164 format: drop the leading 0 and add +27, so 082 123 4567 becomes +27821234567. Our E.164 guide covers clean-up of spreadsheet exports, which often lose the leading zero or add spaces.

Sender IDs

A branded alphanumeric sender ID (up to 11 characters, such as KAROOHOME) is what customers expect from a retailer or bank. Pick a name that matches the brand on your website and receipts, because the sender identity requirement in section 69(4) is easier to meet when the sender ID itself names you. eSMS Africa registers sender IDs for you and you can test on the eSMS default sender meanwhile; current fees and steps are on the South Africa sender ID page. Keep separate sender IDs for transactional and promotional traffic if your volume is high, so that an opt-out from offers never stops an OTP or a delivery notice.

Language and encoding

South Africa has twelve official languages, and most campaigns go out in English, Afrikaans, isiZulu, isiXhosa or Sesotho. All use the Latin alphabet, so they usually fit the GSM-7 character set at 160 characters per single message (153 per part when longer). Watch Afrikaans: letters such as ê, ë and ô are not in GSM-7, so a single "sê" switches the whole message to Unicode, cutting it to 70 characters per message (67 per part). Either budget for the extra segments or rephrase. The Unicode and emoji note explains how segments are counted.

Sample messages

TypeMessageLegal basis
Consent request (first contact)Karoo Home: You entered our draw at Canal Walk. May we SMS you offers, max 4 a month? Reply YES to agree. No reply = no offers.s69(2) single approach
Offer to existing customerKaroo Home: 20% off bedding for loyalty members until Sat. Shop: go.esmsafrica.io/kh1 Reply STOP to opt outs69(3)
Delivery noticeKaroo Home: Order KH40021 is out for delivery today 10:00-14:00. Track: go.esmsafrica.io/t/40021Contract performance
Opt-out confirmationKaroo Home: You will no longer receive offers by SMS. Order updates will still be sent.WASPA 16.14

The consent request and STOP replies need a two-way number to receive the answer. Short links from eSMS Links keep messages inside one segment and give you click data.

Sending from your own systems

Most South African teams connect their CRM, e-commerce platform or loyalty system to the API so that the legal basis is checked before a message leaves. A single send looks like this:

# Promotional SMS to a customer who bought from you (POPIA s69(3) route)
curl -X POST https://sms.esmsafrica.io/api/messages/send \
  -H "Authorization: Bearer esms_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"to": "+27821234567",
       "sender_id": "KAROOHOME",
       "text": "Karoo Home: 20% off bedding for loyalty members until Sat. Shop: go.esmsafrica.io/kh1 Reply STOP to opt out"}'

For campaigns, use the bulk endpoint with {{name}} placeholders and schedule the send inside the permitted window. Test keys (esms_test_...) simulate sends at no charge. The HTTP API documentation has the full reference and the delivery report guide shows how to capture outcomes.

Payment and pricing

Pricing is pay as you go from USD 20 with no monthly minimum. At the entry tier a South African SMS costs ZAR 0.2743 ($0.0165), dropping to ZAR 0.2544 at the business tier. South African businesses top up by card in USD or by crypto. See pricing for every tier.

Pre-launch checklist

  1. Tag every contact with its legal basis: consent (with date and source) or customer (with the sale it came from).
  2. Remove anyone whose consent you cannot evidence; WASPA members can be asked to prove it.
  3. Import the opt-out list and any previous refusals before the first send.
  4. Register a sender ID that names your brand.
  5. Decide how people opt out: STOP to a two-way number, or an opt-out link.
  6. Schedule inside Monday to Friday 08:00-20:00 or Saturday 09:00-13:00, and skip public holidays.
  7. Check Afrikaans and other copy for characters outside GSM-7.
  8. Send a test to your own Vodacom, MTN, Cell C and Telkom phones.
  9. Review delivery reports and opt-outs after each campaign and update the list.

Frequently asked questions

Can I buy a list of South African numbers for SMS marketing?

Not lawfully for electronic direct marketing unless every person on the list consented to receive marketing from you. A purchased list rarely carries that consent, and section 69(2) only allows one approach to ask for it. Build your own list through sign-ups, in-store forms and sales.

Do the time restrictions apply to OTPs and delivery updates?

No. The prohibited times apply to direct marketing. OTPs, delivery notices and account alerts are service messages and can be sent at any hour, although sensible timing still matters for customer experience.

Is "Reply STOP" enough as an opt-out?

Yes, if replies actually reach you. WASPA expects STOP replies to work where technically feasible, so send marketing from a two-way number or include a working opt-out link, and confirm each opt-out with a free message.

Does the existing-customer exception cover messages from our group companies?

Section 69(3) covers the responsible party's own similar products or services. Marketing a sister company's products to your customers generally needs consent. Check the specific structure with your legal adviser.

Sources

Read the companion OTP guide for South Africa and the transactional vs promotional SMS explainer, or see network and coverage details on the South Africa SMS page. When your list is clean, create an eSMS Africa account and send a test campaign to your own phone.