How the double opt-in works, plus the legal basis for sending SMS

The day has finally come: You have decided to use SMS in your company. You want to send booking confirmations, appointment reminders or pick-up notices to customers to improve internal processes. Or do you want to use the personal character of SMS and give direct marketing a try? That is a great idea! But there is one thing that makes you hesitate: How does data protection work when it comes to SMS? We would like to take away your uncertainty by showing you the most important facts at a glance. Here is what you can expect: The most important information about consent, double opt-in and the agreement on commissioned data processing in relation to sending SMS to your customers.

Consent

As you surely know, you need a legal basis if you want to use personal data of your customers. This also applies, as mentioned above, if you store data related to SMS messages. In most cases, obtaining consent is the most sensible solution here. It enables you to prove, physically, that you are allowed to send SMS to an individual person. What is important here is that your customers must give you this consent voluntarily. Also, you must inform your customers about what exactly you will use their number for – BEFORE they give their consent. Essentially this means: If you ask for the number to send booking confirmations, you may not send marketing SMS and certainly not e-mails without explicit consent. Although there are certain exceptions to this rule, it can serve as a basic guideline.

Furthermore, you should be aware that consent is not necessarily valid forever. If you do not contact the recipients in the specified manner for a long time, the consent may expire. Furthermore, you must be able to provide information about the consent at any time and be able to prove that you have it.

What is a double opt-in?

Here is what happens in a double opt-in procedure: Customer Anna enters her mobile phone number in a form on your website and agrees to receive an SMS from you. You then send an SMS to the received number and ask her to confirm that she would like to receive SMS from you in the future. This is to prevent that someone misuses Anna’s number, and that she receives unwanted messages as a result.

It is particularly important to inform your customers that they can withdraw their consent at any time. You should also note that revocation must be as simple as consent. This means: If only one click is required for registration, it must also be possible to cancel the subscription with a single click. It also has to be very simple, and easy to access for subscribers.

Especially for companies with very young target groups there is another important fact to consider. Minors under the age of 16 can only give their consent with the consent of a parent or guardian. In this case it is difficult to verify the age of the recipient with legal certainty. If you want to be on the safe side, consider offering your services only to people who have already reached the age of 16.

No matter which variant you choose: It is your responsibility to ensure that the customer’s consent is processed correctly. This means that they cannot receive any further SMS if they have not given their consent or if they objected. Moreover, the confirmation message for the double opt-in must not yet contain any advertising or other offers. Instead, it is advisable to provide details about the SMS messages that will be sent, such as how often you will send messages and that it will cost money to reply to the SMS (this last note is mandatory in some countries).

Agreement on Commissioned Data Processing

Since the GDPR came into force in May 2018, the need for commissioned data processing emerged. When it comes to German law, the specifications have become more comprehensive, compared to the law that had been in place before. The most important fact at this point:

In some rare instances, an agreement on commissioned data processing is not needed to send SMS via an SMS gateway, because the processing of data is necessary to provide the service (§88 (3) TKG). However, anything that goes beyond the mere sending of SMS always necessarily requires an agreement. This also includes the storage of data in a cloud. 

What has to be included in your agreement with the respective service provider depends on the type of further use of the data, your company and the external service providers. Please consult your data protection officer or a legal advisor.

Source of header picture: iStock.com/marchmeena29