Messaging Consent & Compliance Index

Consent provenance is the documented, auditable trail showing how, when and where a consumer gave permission to receive SMS marketing. It covers the lawful basis relied upon, the disclosure shown to the consumer at the point of opt-in, the technical metadata captured at that moment, and the retention of that evidence in a form that will survive a regulator audit or enforcement action. Under UK GDPR accountability, the burden of proof sits with the sender — not the consumer — and without provenance the consent is worthless.

The Data (Use and Access) Act 2025 is the most significant UK direct-marketing reform in 20 years. Until June 2025 the maximum PECR penalty was £500,000. The DUAA lifts this cap to £17.5 million or 4% of global annual turnover, whichever is higher — aligning PECR enforcement with UK GDPR. The HelloFresh fine (£140k, 2024) would, under the new regime, have been potentially an order of magnitude larger. Consent provenance has become the single most important compliance artefact in the UK.

The ePrivacy Regulation was formally withdrawn by the European Commission in February 2025, meaning the 2002 Directive remains the governing instrument — transposed through national law in each member state. The result is a fragmented landscape: German BGH case-law requires de facto double opt-in; CNIL (France) has become the EU's most active enforcer with a €325m Google fine in 2025; Ireland's DPC handles US Big Tech with a softer tempo but larger settlements. The CJEU Inteligo ruling (November 2025) clarified that the ePrivacy soft opt-in is a standalone legal basis — a significant simplification for senders.

Canada's CASL is among the world's strictest anti-spam regimes — directors and officers can be held personally liable. Australia's ACMA has issued over A$15m in fines in 18 months, and a mandatory SMS Sender ID Register took effect 15 December 2025. India's DLT framework is the most operationally rigorous A2P regime on earth — sender ID, header, message template and consent are all pre-registered on a blockchain before any message may be sent. Saudi Arabia, UAE, Singapore and Brazil have all introduced GDPR-influenced privacy laws that stack on top of telecom-layer opt-in requirements.