The SMS regulator directory

How this directory is organized (by region, with cross-refs)

The directory below covers 149 countries grouped into four geographic regions: Europe (41), Americas (27), Asia-Pacific (35), and Africa–Middle East (40). Within each region, entries list the national telecom regulator first, followed by the relevant data-protection authority (DPA) where distinct. We also identify secondary bodies (e.g., financial regulators overseeing crypto-settlement, postal authorities managing bulk SMS routes) that may enforce complementary rules. Each entry includes the regulator's official name in English, local language abbreviation or acronym, and a link to its public complaint or inquiry portal where available.

Regulatory jurisdiction is not always territory-based. If your SMS targets residents of a country (based on phone number, IP address, or declared geography), that country's rules apply—regardless of where your server or company is registered. The GDPR principle of "targeting" (Articles 3 and 4) has become a standard test across regulators: if your campaign aims at or affects a jurisdiction's residents, you must comply with that jurisdiction's rules. Use this directory to identify each relevant regulator for every country on your sending list before launch.

Data-protection authorities are almost always separate from telecom regulators, though their mandates often overlap for SMS. A single campaign may require clearance or notification to both bodies. In decentralized or federal nations (USA, Canada, Australia, Mexico, India), additional sub-national regulators may apply; we note these where they govern A2P SMS specifically.

Europe: 41 regulators

Europe enforces the most stringent unified framework for A2P SMS: GDPR (Regulation (EU) 2016/679), the ePrivacy Directive (Directive 2002/58/EC), and national implementations of the Digital Markets Act and Digital Services Act. Telecom regulators are typically independent national authorities; data-protection authorities (DPAs) are separate bodies, though some nations consolidate them. Key point: any SMS to an EU resident requires explicit prior consent (Article 21 GDPR, Regulation 22 PECR in the UK), a lawful basis under Article 6, and retention management under Article 5(1)(e).

United Kingdom: Ofcom (telecom), ICO (data protection). Post-Brexit, the UK retained GDPR-equivalent rules under the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR, Regulation 22(3)). PECR still requires opt-in for marketing SMS; unsolicited promotional texts to individuals are prohibited unless prior consent exists. Ofcom oversees carrier routing and number-range allocation; ICO handles data-protection complaints and enforcement. Both publish enforcement notices regularly.

Germany: BNetzA (Bundesnetzagentur für Elektrizität, Gas, Telekommunikation und Post; telecom regulator), BfDI (Bundesbeauftragte für Datenschutz und Informationsfreiheit; federal DPA). German telecommunications law (Telekommunikationsgesetz, TKG) mandates carrier compliance with spam-suppression rules; BNetzA enforces fines up to €300,000 for violations. BfDI enforces GDPR and the Kunsturheberrechtsgesetz (KUrhG) on unfair trade practices related to SMS marketing. Both bodies maintain public complaint portals and publish annual enforcement reports.

France: ARCEP (Autorité de régulation des communications électroniques et des postes; telecom), CNIL (Commission Nationale de l'Informatique et des Libertés; DPA). ARCEP regulates carrier compliance with the Code des postes et des communications électroniques; CNIL enforces GDPR and France's Data Protection Act (Law 78-17 of 6 January 1978, amended). France is notably strict on unsolicited SMS: CNIL has issued multi-million-euro fines for consent violations. ARCEP publishes carrier-level network reports; CNIL operates a public "complaint" portal (plainte.cnil.fr).

Spain: AEPD (Agencia Española de Protección de Datos; DPA and telecom regulator consolidated). AEPD enforces Organic Law on Data Protection (LOPDGDD, Law 3/2018) and implements GDPR. AEPD has prosecuted SMS marketing campaigns that lacked documented consent; fines often reach 2–4% of global revenue for systematic violations. The CMT (Comisión del Mercado de las Telecomunicaciones) historically regulated carriers but many functions now fold into AEPD's authority.

Italy: Garante per la protezione dei dati personali (DPA), AGCOM (Autorità per le garanzie nelle comunicazioni; telecom regulator). Italy's Data Protection Code (Legislative Decree 196/2003, amended by GDPR) and Law 27/2022 (anti-spam rules) apply. Garante has issued high-profile fines for SMS marketing without consent; AGCOM oversees carrier compliance and anti-spam obligations. Both publish enforcement decisions (decisioni.gpdp.it for Garante).

Belgium: IBPT/BIPT (Institut Belge des Postes et Télécommunications; telecom), APD/DPA (Autorité de Protection des Données; data protection). Belgium's Privacy Law (Law of 30 July 2018) implements GDPR. Unsolicited promotional SMS requires prior explicit consent. The APD maintains a public complaint form (www.autoriteprotectiondonnees.be).

Netherlands: ACM (Autoriteit Consument en Markt; telecom and competition regulator), AP (Autoriteit Persoonsgegevens; DPA). ACM enforces the Telecommunications Act (Telecommunicatiewet); AP enforces GDPR and the Dutch Data Protection Act (AVG). The Netherlands is known for swift DPA investigations into SMS campaigns; fines are often proportional to the number of affected individuals.

Austria: RTR (Rundfunk und Telekom Regulierungs-GmbH; telecom), DSB (Datenschutzbehörde; DPA). Austria's Telecommunications Act (Telekommunikationsgesetz 2003) and GDPR implementation (DSG 2000) both apply. RTR approves SMS routes through Austrian carriers; DSB investigates consent and data-retention violations. Both maintain English-language complaint portals.

Sweden: PTS (Post- och Telestyrelsen; telecom), Datainspektionen (DPA). Sweden's Electronic Communications Act (Elektronikommunikationslagen, 2003:389) requires carrier compliance; Datainspektionen enforces GDPR and the Swedish Data Protection Act (GDPR-implementering). Sweden has been active in fining companies for SMS marketing consent violations.

Denmark: NKKR (Statens IT- og Telestyrelse; telecom), Datatilsynet (DPA). Denmark's Telecommunications Act and the Danish Data Protection Act (implementeret fra GDPR) apply. Datatilsynet maintains a public complaint portal (www.datatilsynet.dk). Unsolicited SMS marketing is prohibited without prior consent.

Norway: NKOM (Nasjonal kommunikasjonsmyndighet; telecom), Datatilsynet (DPA). Norway (not in the EU but under the EEA Agreement) enforces GDPR-equivalent rules through the Personal Data Act (Personopplysningsloven, 2018). NKOM oversees carrier anti-spam obligations; Datatilsynet enforces consent and data-protection rules. Both publish enforcement actions.

Poland: UKE (Urząd Komunikacji Elektronicznej; telecom), PUODO (Prezes Urzędu Ochrony Danych Osobowych; DPA). Poland's Telecommunications Act and the Personal Data Protection Act (based on GDPR) apply. PUODO has fined SMS marketers for missing consent documentation. UKE enforces carrier-level obligations.

Czech Republic: ČTÚ (Český telekomunikační úřad; telecom), ÚOOÚ (Úřad pro ochranu osobních údajů; DPA). Czech Telecommunications Act and GDPR implementation (Act 101/2009 Sb., amended) apply. ÚOOÚ investigates consent violations and data-retention issues; ČTÚ enforces carrier rules.

Romania: ANCOM (Autoritatea Națională pentru Administrare și Reglementare în Comunicații; telecom), ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal; DPA). Romania's Telecommunications Act and Law 677/2001 (amended by GDPR implementation) apply. ANSPDCP has issued significant fines for SMS marketing violations.

Hungary: NMHH (Nemzeti Média- és Hírközlési Hatóság; consolidated telecom and media regulator), NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság; DPA). Hungary's Telecommunications Act and GDPR implementation (Act CXII of 2011, amended) apply. NAIH enforces consent requirements strictly; NMHH handles carrier compliance.

Bulgaria: CRC (Communications Regulation Commission), CPDP (Commission for Personal Data Protection). Bulgaria's Law on Electronic Communications and GDPR implementation (Law 3/2018) apply. Unsolicited SMS marketing requires explicit prior consent. Both bodies maintain complaint processes.

Croatia: HAKOM (Hrvatska agencija za poštu i elektroničke komunikacije; telecom), AZOP (Agencija za zaštitu osobnih podataka; DPA). GDPR and Croatian Telecommunications Act apply. AZOP investigates consent violations; HAKOM handles carrier-level issues.

Greece: EETT (Ελληνική Επιτροπή Τηλεπικοινωνιών και Ταχυδρομείων; telecom), ADAE (Αρχή Διασφάλισης του Απορρήτου των Επικοινωνιών; data protection). GDPR and Greek E-Privacy Law (Law 3471/2006) apply. ADAE enforces consent; EETT handles carrier routing.

Ireland: ComReg (Commission for Communications Regulation; telecom), DPC (Data Protection Commission; DPA). ComReg enforces Ireland's Communications Act; DPC enforces GDPR. Ireland is home to many tech companies' EU subsidiaries, making DPC complaints common. Both maintain public complaint portals (www.comreg.ie, www.dataprotection.ie).

Portugal: ICP-ANACOM (Instituto das Comunicações de Portugal – Autoridade Nacional de Comunicações; telecom), CNPD (Comissão Nacional de Proteção de Dados; DPA). GDPR and Portuguese Telecommunications Act apply. CNPD investigates consent violations; ICP-ANACOM enforces carrier rules.

Finland: Traficom (Finnish Transport and Communications Agency; telecom), Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman; DPA). Finland's Act on Electronic Communications (917/2014) and GDPR implementation apply. The Data Protection Ombudsman is known for swift, high-profile investigations into SMS marketing campaigns.

Luxembourg: ILR (Institut Luxembourgeois de Régulation; telecom), CNPD (Commission Nationale pour la Protection des Données; DPA). GDPR and Luxembourg Telecommunications Act apply. CNPD's small but active team has fined SMS marketers for consent violations.

Slovenia: AKOS (Agencija za komunikacijska omrežja in storitve; telecom), UOOU (Urad za informacijske svobode; DPA). GDPR and Slovenian Telecommunications Act (ZEKom-1) apply. Both maintain complaint portals.

Slovakia: ÚK (Úrad pre reguláciu elektronických komunikácií a poštových služieb; telecom), UOD (Úrad na ochranu osobných údajov; DPA). GDPR and Slovak Telecommunications Act apply.

Estonia: TTJA (Tehnilise Järelevalve Amet; telecom), AKA (Andmekaitse Inspektsioon; DPA). GDPR and Estonian Electronic Communications Act apply. Both maintain English-language portals.

Latvia: SPRK (Sabiedrības politikas un reģionalās attīstības ministrija – Elektronisko komunikāciju regulators; telecom), DKPI (Datu Valsts Inspekteja; DPA). GDPR and Latvian Electronic Communications Law apply.

Lithuania: RRT (Respublikinis ryšių reguliavimo biuras; telecom), VDPT (Valstybinė duomenų apsaugos inspekcija; DPA). GDPR and Lithuanian Telecommunications Act apply.

Cyprus: OCECPR (Office of the Commissioner of Electronic Communications and Postal Regulation; telecom), Commissioner of Data Protection (DPA). GDPR and Cyprus Telecommunications Law apply. The Commissioner's office is known for investigating international SMS campaigns targeting Cypriot residents.

Malta: MCA (Malta Communications Authority; telecom), Commissioner for Data Protection (DPA). GDPR and Maltese Telecommunications Law apply. The DPA's office maintains an active complaint queue.

Republic of Ireland: (Already listed under Ireland above.)

Iceland: IPA (Icelandic Post and Telecom Administration; telecom), Persónuvernd (DPA). Iceland (EEA member, not EU) enforces GDPR and the Icelandic Personal Data Act. Both maintain public portals.

Liechtenstein: Regierungskanzlei (telecom), DataProtection Commissioner. GDPR and Liechtenstein's Data Protection Act apply.

Switzerland: OFCOM (Federal Office of Communications; telecom), FDPIC (Federal Data Protection and Information Commissioner; DPA). Switzerland enforces the Federal Law on Data Protection (Bundesgesetz über den Datenschutz, FADP), which is aligned with GDPR principles. Unsolicited SMS marketing requires prior consent.

Turkey: BTK (Başkanlık Telekomünikasyon Kurumu; telecom regulator), KVKK (Kişisel Verileri Koruma Kurumu; DPA). Turkey's Law on the Regulation of Electronic Communications (Law 5809) and the Personal Data Protection Law (Law 6698, known as KVKK) apply. KVKK enforces consent strictly and has issued significant fines for SMS marketing violations.

Israel: MOC (Ministry of Communications; telecom regulator), Privacy Protection Authority. Israel's Privacy Protection Law (1981) and amendment (Proper Conduct in Communications Law, 2002) apply to SMS. The Privacy Protection Authority investigates unsolicited marketing SMS.

Serbia: RATEL (Regulatory Authority for Electronic Communications and Postal Services; telecom), Commissioner for Information of Public Importance and Data Protection (DPA). GDPR-like protections apply through Law 87/2018. Both maintain complaint mechanisms.

Bosnia and Herzegovina: CRA (Communications Regulatory Agency; telecom), Data Protection Officer (DPA functions). BiH law on electronic communications (2003, amended) applies. Telecom and data-protection functions are sometimes consolidated under the CRA.

Montenegro: EKIP (Agencija za elektronske komunikacije i poštansku djelatnost; telecom), Commissioner for Data Protection (DPA). Montenegrin law implements GDPR-like protections. EKIP oversees carrier compliance.

North Macedonia: AEC (Agencija za elektronski komunikacii; telecom), Commissioner for Personal Data Protection (DPA). Macedonia's Electronic Communications Law and personal-data protections apply.

Albania: AKEP (Autoritetin e Komunikimeve Elektronike; telecom), Commissioner for Data Protection (DPA). Albanian law on electronic communications applies.

Kosovo: RKS (Regulatory Authority; telecom), Office of Privacy Commissioner (DPA). Kosovo's law on electronic communications applies, though regulatory enforcement varies.

Georgia: GNCC (Georgian National Communications Commission; telecom), Data Protection Officer. Georgia's law on electronic communications and personal-data protections apply.

Ukraine: NCCIR (National Commission regulating Communications and Information Technology; telecom), DPA (under Ministry of Digital Transformation). Ukraine's law on electronic communications applies; data-protection rules have been strengthened post-2022 via digital governance reforms.

Moldova: ANRCETI (Agenția Națională pentru Reglementare în Comunicații; telecom), Data Protection Authority. Moldova's law on electronic communications applies.

Americas: 27 regulators

The Americas lack a unified A2P SMS framework. The United States enforces the Telephone Consumer Protection Act (TCPA, 47 USC § 227) and FCC regulations (47 CFR Parts 64.1200–64.1202), which mandate prior express written consent for SMS to cell phones and strict Do Not Call (DNC) registry compliance. Canada enforces the Personal Information Protection and Electronic Documents Act (PIPEDA) and anti-spam rules under the Canada's Anti-Spam Legislation (CASL). Most Latin American nations have fragmented telecom laws and emerging data-protection statutes, often modeled on GDPR but with weaker enforcement. Mexico, Brazil, and Argentina have the strongest regulatory frameworks; smaller nations often lack dedicated DPAs.

United States: FCC (Federal Communications Commission; telecom), FTC (Federal Trade Commission; consumer protection and anti-spam), and state attorneys general (e.g., California, New York). The TCPA (47 USC § 227) is the primary statute; violations can trigger FCC fines, FTC actions, class-action lawsuits, and state-level enforcement. The National Do Not Call Registry (maintained by FTC) is mandatory for SMS marketers. FCC maintains a complaint database; FTC publishes enforcement actions. SMS gateways operating in the USA must use 10DLC (10-Digit Long Code) carrier agreements, which enforce compliance verification before campaign launch. Delivery compliance is critical: we offer 99% tier-1 delivery across US carriers and integrate with carrier brand registries to maintain reputation.

Canada: CRTC (Canadian Radio-television and Telecommunications Commission; telecom regulator), PIPEDA (federal DPA functions administered by Office of the Privacy Commissioner of Canada, OPC). CASL (Canada's Anti-Spam Legislation, S.C. 2010, c. 23) is stricter than the TCPA: it requires explicit opt-in consent (not opt-out) and applies to SMS, email, and commercial messages. Violations can trigger OPC investigations, CRTC fines, and class-action litigation. The OPC publishes annual CASL enforcement reports (www.priv.gc.ca). Provincial privacy laws (e.g., Quebec's Law 25) add layers of compliance.

Mexico: IFT (Instituto Federal de Telecomunicaciones; telecom regulator), INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales; DPA). Mexico's Telecommunications Law (Ley Federal de Telecomunicaciones) and Federal Law on Protection of Personal Data (LFPDPPP, Law 18.2017) apply. IFT enforces carrier rules; INAI enforces consent and data-protection violations. Mexico has issued fines for SMS marketing without consent, particularly in the financial and casino sectors.

Brazil: ANATEL (Agência Nacional de Telecomunicações; telecom regulator), SENACON (Secretaria Nacional do Consumidor; consumer protection), and state-level data-protection bodies. Brazil's Lei de Proteção de Dados Pessoais (LGPD, Law 13.709 of 14 August 2018) is GDPR-like and applies to SMS sent to Brazilian residents. ANATEL enforces carrier rules and anti-spam regulations (Regulamento de Fiscalização). The LGPD allows for significant fines (up to 2% of revenue) and has triggered enforcement by SENACON and state authorities. smsroute's Brazil compliance checklist covers ANATEL carrier agreements and LGPD consent requirements.

Argentina: ENACOM (Ente Nacional de Comunicaciones; telecom regulator), NDPC (Agencia Nacional de Protección de Datos Personales; DPA, established 2023). Argentina's Telecommunications Law (Law 27.798) and Personal Data Protection Law (Law 25.326, reformed by Law 27.667) apply. ENACOM enforces carrier anti-spam rules; NDPC investigates consent violations. Recent enforcement trends show heightened scrutiny of financial-services SMS campaigns.

Chile: SUBTEL (Subsecretaría de Telecomunicaciones; telecom regulator), SERNAC (Servicio Nacional del Consumidor; consumer protection). Chile's Law on Personal Data Protection (Law 19.628) and the Telecommunications Law apply. SUBTEL and SERNAC jointly oversee SMS compliance. Chile requires consent for SMS marketing, particularly in the financial sector.

Colombia: MinTIC (Ministerio de Tecnologías de la Información y las Comunicaciones; telecom regulator), Superintendencia de Industria y Comercio (SIC; consumer and data protection). Colombia's Law 1581/2012 (Personal Data Protection) and the Telecommunications Regulation apply. SIC enforces consent requirements; MinTIC handles carrier-level compliance.

Peru: OSIPTEL (Organismo Supervisor de Inversión Privada en Telecomunicaciones; telecom regulator), ASPEC (consumer protection). Peru's Law 29.733 (Personal Data Protection Law) and telecommunications regulations apply. Unsolicited SMS marketing is regulated through carrier agreements; OSIPTEL and ASPEC enforce compliance. Peru's enforcement has increased in recent years, particularly for unauthorized SMS.

Ecuador: MINTEL (Ministerio de Telecomunicaciones; telecom regulator), DPDP (Dirección de Datos Personales; DPA). Ecuador's Law on Data Protection (Law 24.2020, reformed to align with constitutional protections) and telecommunications regulations apply. DPDP investigates consent violations.

Venezuela: CONATEL (Comisión Nacional de Telecomunicaciones; telecom regulator), Defensoría del Pueblo (Data Protection). Venezuela's regulations are fragmented; enforcement is inconsistent. Due diligence is advised before launching campaigns.

Guatemala: SIT (Superintendencia de Telecomunicaciones; telecom regulator), Office of Data Protection. Guatemala's Telecommunications Law and personal-data regulations apply, though enforcement is limited. Carrier agreements are the primary compliance mechanism.

Honduras: CONATEL (Comisión Nacional de Telecomunicaciones; telecom regulator). Honduras' telecommunications law and anti-spam regulations apply. DPA functions are underdeveloped; compliance is primarily driven by carrier agreements.

El Salvador: SIGET (Superintendencia General de Electricidad y Telecomunicaciones; telecom regulator). SIGET enforces carrier anti-spam rules; data-protection enforcement is limited. Carrier agreements are primary.

Nicaragua: TELCOR (Instituto Nicaragüense de Telecomunicaciones; telecom regulator). TELCOR enforces carrier rules. Data-protection enforcement is minimal.

Costa Rica: ARESEP (Autoridad Reguladora de los Servicios Públicos; telecom regulator

Read next: prices · developer docs · 149 country pages · more blog posts