Sending a promotional SMS is easy. Knowing whether you can send it to a particular customer – and whether you have the right consent to do so – is where things get more complicated.
For businesses in the Philippines, SMS marketing must take into account requirements under the Data Privacy Act of 2012 (Republic Act No. 10173), the rules set by the National Privacy Commission (NPC), and consent requirements for marketing communications.
Whether you are promoting a new product, sending a limited-time offer or re-engaging an existing customer, you need to consider who you are contacting, what you are sending and whether the recipient has consented to receive promotional messages.
The good news is that compliance does not have to mean giving up on SMS marketing. The key is building consent, customer preferences and messaging controls into your SMS workflow from the start.
In this guide, we’ll look at the key Data Privacy Act rules for promotional SMS in the Philippines, including what counts as marketing, how consent works under NPC guidance and how you can run SMS campaigns more responsibly.
What are the Rules for Promotional SMS or Telemarketing Messages in the Philippines?
Before sending an SMS marketing message in the Philippines, you need to establish whether the message is actually promotional.
A promotional SMS is generally a message intended to promote or offer goods, services, business opportunities or other commercial activity. This could include:
- “Enjoy 20% off your next purchase.”
- “Upgrade your broadband plan and receive one month of free service.”
- “New season arrivals are now available.”
- “Get ₱2,000 off your next hotel booking.”
- “Refer a friend and receive a reward.”
The distinction matters because not every SMS a business sends to a customer is a marketing message.
The Philippines does not operate a Do Not Call Registry, so this distinction isn’t about checking a message against an opt-out list – it’s about determining whether a message requires consent under the Data Privacy Act in the first place. Service-related messages and messages directed at businesses rather than individuals are generally treated differently from marketing messages that require consent.
Consider the difference between these two messages:
“Your appointment at ABC Clinic is tomorrow at 10 am.”
and:
“Your appointment is tomorrow. Book another treatment this month and receive 20% off.”
The first is a service reminder. It relates directly to an existing appointment and does not introduce a promotional offer.
The second goes further by promoting another service and offering a discount. That promotional element means you should assess the message under the Data Privacy Act’s consent requirements.
This is why you should look at the purpose and content of the message, rather than assuming that every SMS sent to an existing customer is automatically exempt from marketing rules.
A customer relationship does not, by itself, mean you can send any type of promotional SMS. Before launching a campaign, consider what you are sending, who you are sending it to and whether you have the appropriate consent to contact them for marketing purposes.
What Is the Data Privacy Act and How Does It Apply to Promotional SMS in the Philippines?
When you send promotional SMS in the Philippines, the key law to consider is the Data Privacy Act of 2012 (RA 10173), enforced by the National Privacy Commission (NPC).
It’s worth noting that the Philippines’ framework works differently from Singapore’s. Singapore splits data protection and telemarketing consent across two separate regimes – a broader privacy law and a separate Do Not Call Registry. The Philippines does not have an equivalent Do Not Call Registry: although bills proposing one have been filed in both the Senate and the House of Representatives, none has been enacted into law. This means that, for promotional SMS, compliance in the Philippines centers almost entirely on obtaining and properly documenting consent under the Data Privacy Act, rather than cross-checking a separate opt-out registry.
The Data Privacy Act governs how organizations collect, use and disclose personal data and generally requires organizations to obtain consent for these activities unless an exception applies. The NPC has also been explicit about what counts as valid consent for SMS marketing: under NPC Circular No. 2023-04, consent for direct marketing must be explicit and opt-in – implied or negative consent, such as a pre-ticked box or an assumption that the customer agrees unless they object, is not considered valid.
A simple way to think about Philippine SMS compliance is: do you have explicit, opt-in consent to send this customer this type of marketing message, and can you prove it?
How Does the Data Privacy Act Apply to Promotional SMS Marketing in the Philippines?
The Data Privacy Act sets out the Philippines’ general framework for how organizations collect, use and disclose personal data. For SMS marketing, this matters because a customer’s mobile number is personal data when it can be associated with an identifiable individual.
The Data Privacy Act generally requires you to obtain consent before collecting, using, or disclosing personal data for a particular purpose, and under NPC Circular No. 2023-04, that consent must be explicit and opt-in for direct marketing. You should also let customers know why you are collecting, using or disclosing their data, and avoid using it for purposes they were not informed about.
For SMS marketing in the Philippines, it helps to think about the entire customer data journey:
Collection → Notification → Explicit Consent → Marketing use → Opt-out → Suppression
For example, a retailer might ask for a customer’s mobile number when they create an account. Having the number does not automatically mean you can use it for every future marketing purpose.
You need to consider what the customer was told when their number was collected, what explicit consent they provided and whether that consent covers the promotional communications you intend to send.
The same principle applies when you collect customer data through purchases, registrations, events or other touchpoints. Your SMS marketing workflow should reflect the permission the customer actually gave you – not simply the data you happen to have.
And when a customer withdraws their consent or opts out, your processes should ensure that they are no longer included in future marketing communications.
This makes consent management more than a one-time checkbox. It is an ongoing part of how you collect, use and manage customer data throughout the marketing journey.
What does the Data Privacy Act mean for a business in the Philippines sending promotional SMS?
If you are sending promotional SMS, you should be able to answer a few basic questions about every customer you contact:
- Where did you get the customer’s mobile number?
- Why was the number collected?
- What was the customer told the number would be used for?
- Did the customer give explicit, opt-in consent to receiving marketing communications?
- What channels does that consent cover, such as SMS or voice calls?
- How can the customer withdraw their consent?
- How do you record and apply withdrawal requests to future campaigns?
These questions become particularly important when your SMS campaigns are connected to a CRM, marketing automation platform or customer database.
You may have the same customer’s mobile number stored across several systems. If that customer opts out of marketing, removing the number from just one campaign list may not be enough. Your opt-out and suppression processes need to work across the relevant systems to prevent the customer from being included in future promotional campaigns.
Why Doesn’t the Philippines Have a Do Not Call Registry for SMS?
Some APAC markets, like Singapore, operate a Do Not Call Registry that lets individuals opt out of unsolicited telemarketing messages, including SMS. The Philippines does not currently have one. Bills proposing a Do Not Call Registry have been filed in both the Senate and the House of Representatives, but none has been passed into law.
For businesses, this means there is no separate opt-out list to check before sending a promotional SMS in the Philippines. It does not mean promotional SMS is unregulated – it means that compliance depends entirely on whether you have valid, explicit consent under the Data Privacy Act, and on respecting opt-outs when a customer withdraws consent.
When does a message count as marketing under the Data Privacy Act?
The first step is to look at what the message is actually trying to achieve.
For example:
Promotional SMS:
“Weekend sale! Enjoy 20% off all shoes. Shop now: [link]”
Service message:
“Your order #12345 has been dispatched and will arrive tomorrow.”
The first message promotes a commercial offering and requires valid consent under the Data Privacy Act. The second relates directly to an existing transaction and is not automatically treated as marketing simply because it is sent to a customer’s mobile number.
The distinction becomes less clear when you combine service information with a promotion:
“Your order is arriving tomorrow. While you’re waiting, enjoy 20% off your next purchase.”
The first sentence is operational. The second introduces a promotional purpose.
Adding promotional content to a transactional notification does not automatically make the communication transactional. If the message is partly intended to promote a product, service or commercial opportunity, you should assess whether you have the explicit consent needed to send it.
This is particularly important when designing automated SMS workflows. A message that starts as a legitimate service notification can take on a marketing purpose if promotional content is added later in the workflow.
Does the Data Privacy Act’s consent requirement apply to every type of SMS?
The explicit consent requirement under NPC Circular No. 2023-04 applies specifically to direct marketing messages, not every SMS a business sends.
Certain types of messages generally fall outside the definition of marketing, including service-related messages, employment-related communications and government communications. Messages relating to products or services a customer has already purchased, such as warranty, recall, safety or delivery information, may also fall outside the definition of direct marketing.
This distinction matters when your business uses SMS for different parts of the customer journey. A single messaging program might include:
- Transaction confirmations
- Delivery updates
- Appointment reminders
- Account notifications
- Authentication messages
- Promotional campaigns
These messages may serve very different purposes, so you should not apply a blanket rule to every SMS in your database. Each use case should be assessed based on what the message is intended to achieve and whether it requires explicit marketing consent.
Because there is no Do Not Call Registry to check in the Philippines, there’s also no registry-result validity period to track. Instead, your compliance process should focus on maintaining up-to-date, documented, explicit consent for every recipient, and promptly honoring opt-out requests.
What Consent and Opt-Out Conditions Are Required for Promotional SMS in the Philippines?
For promotional SMS in the Philippines, businesses should make sure recipients have given clear, explicit, opt-in consent to receive the relevant marketing messages. Under NPC Circular No. 2023-04, implied or negative consent – such as treating an unchecked box as agreement, or assuming that silence means consent – is not valid.
Because explicit consent is required, the consent should be properly documented so the business can demonstrate what the individual agreed to receive and when that consent was obtained.
In practice, consent should make the marketing purpose clear. For example, a sign-up form stating:
“I agree to receive promotional offers and updates from ABC by SMS.”
is more explicit than simply collecting a customer’s mobile number during checkout, or relying on a pre-ticked consent box.
The distinction matters because having a customer’s mobile number is not the same as having consent to use it for marketing. Businesses should retain appropriate records showing when and how consent was obtained, what the individual was told, and what types of communications they agreed to receive.
Consent is also not necessarily permanent. Individuals can withdraw their consent, and your business will need to provide an appropriate way for them to do so and act on the withdrawal accordingly.
For businesses running ongoing campaigns, keeping consent and communication preferences up to date is just as important as obtaining consent in the first place. Using 8×8 CPaaS’s services to manage SMS campaigns can help centralize campaign operations and reporting, making it easier for your teams to monitor messaging activity and manage customer communication workflows.
How Does Consent Work Under the Data Privacy Act?
The easiest way to understand what’s required is to separate the legal requirement from the documentation that proves you met it.
| Data Privacy Act Requirements | Consent Documentation | General Best Practice | |
| What does it address? | The legal basis for using a customer’s personal data for marketing | Evidence of what the customer agreed to receive and when | Operational habits that reduce compliance risk |
| Does it apply only to SMS? | No | No | No |
| Relevant to SMS marketing? | Yes | Yes | Yes |
| Is implied or opt-out consent valid? | No – NPC Circular No. 2023-04 requires explicit opt-in consent | Consent records should show an affirmative opt-in, not an assumption | Always capture and store explicit opt-in, never infer it |
The practical takeaway is that businesses should not treat “we have the customer’s number” and “we have valid consent” as the same thing.
Instead, your SMS marketing workflow should capture explicit, documented consent for every recipient and respect withdrawal requests promptly.
What Should Businesses Check Before Sending Promotional SMS in the Philippines?
A practical compliance checklist can help your team catch potential issues before a campaign reaches customers.
1. Identify the message type
Start by determining what the SMS is actually intended to do. Is it:
- Promotional or telemarketing
- Transactional
- A service notification
- An appointment or delivery reminder
- A customer service communication
Do not assume that adding a promotional offer to an otherwise operational message makes the entire SMS transactional. Look at the purpose and content of the message as a whole.
2. Check the consent status
Determine whether the recipient has given clear, explicit, opt-in consent to receive the relevant marketing communication. Under NPC guidance, implied consent is not sufficient.
Keep appropriate records showing when and how consent was obtained, what the customer was told and what they agreed to receive.
3. Confirm there is no Do Not Call Registry requirement to check
The Philippines does not currently operate a Do Not Call Registry, so there is no registry to check before sending. This means your compliance rests entirely on having valid, explicit, documented consent under the Data Privacy Act – there is no fallback registry exemption to rely on instead.
4. Review the message
Before sending, check that the SMS meets the applicable requirements for identifying the organization and providing the required contact or opt-out information.
This is also a good opportunity to review the message itself. Make sure any promotional content is clear about what is being offered and does not conflict with the customer’s communication preferences.
5. Apply opt-outs
If a customer withdraws consent or otherwise requests not to receive marketing communications, make sure their preference is applied across the relevant campaign and customer lists.
An opt-out should not simply remove someone from one campaign if their number remains active in another marketing workflow.
6. Keep records
Maintain appropriate records of consent, campaign lists and withdrawal requests.
This gives your organization an auditable process and makes it easier to investigate a customer complaint, review a campaign or demonstrate how your messaging decisions were made.
How Can 8×8 CPaaS Support Effective & Compliant Promotional SMS Marketing in the Philippines?
For promotional SMS campaigns in the Philippines, having the right infrastructure is only part of the equation. Your campaigns also need to fit into your processes for consent, Data Privacy Act compliance, Sender ID registration and campaign management.
8×8 CPaaS can help you put the right SMS infrastructure and processes in place, from Sender ID support and campaign management to reporting, integrations and dedicated support, so your team has greater visibility and control over how promotional messages are sent.
The 8×8 Connect platform is an intuitive, all-in-one multi-channel communications management portal that brings SMS, voice and messaging apps together in a single dashboard.
- Support for Sender ID requirements: Use a custom Sender ID for your business communications, with support for the Philippines’ NTC-mandated Sender ID requirements, registered through Globe and Smart.
- Large-scale messaging: Send millions of messages through a single platform, making it suitable for businesses running high-volume customer communications and marketing campaigns.
- Real-time analytics and reporting: Monitor campaign activity and messaging outcomes through real-time reports, giving marketing teams data they can use to evaluate and optimize campaigns.
- Multi-channel communication: Extend campaigns beyond SMS by connecting with voice and supported messaging apps, helping businesses maintain more consistent customer communications across channels.
- SMS API integration: For businesses that need communications embedded into their own systems, 8×8 CPaaS provides SMS APIs, reporting APIs and integration resources.
Talk to our experts to learn how 8×8 CPaaS can help you build a more controlled, scalable and compliant approach to promotional SMS marketing in the Philippines.
