Spain SMS Messaging Guide: GDPR Compliance, Lista Robinson & Business SMS Regulations

Spain SMS Market Overview

Market Conditions: Spain operates a highly developed mobile market with widespread SMS adoption. The country's major mobile operators – Movistar, Vodafone, and Orange – collectively serve over 55 million mobile subscribers. While OTT messaging apps like WhatsApp dominate personal communications, SMS remains critical for business communications, particularly for authentication, notifications, and marketing. The mobile market divides between Android users (around 80%) and iOS users (around 20%), with smartphone penetration exceeding 80% of the population.

Key SMS Features and Capabilities in Spain

Spain supports comprehensive SMS capabilities that enable effective business communications. These features allow you to reach customers reliably across all major carriers while maintaining message integrity and supporting interactive communications.

Two-way SMS Support in Spain

Spain fully supports two-way SMS communications. Enable conversations by meeting standard compliance requirements: obtain user consent and maintain clear opt-out mechanisms. Use two-way SMS for customer service inquiries, order confirmations with reply options, appointment reminders that accept responses, and feedback collection.

For more information on implementing interactive messaging, see our guide on two-way SMS best practices.

Concatenated Messages (Segmented SMS)

Support: Yes, concatenation is fully supported across Spanish networks.

Message length rules:

• GSM-7 encoding: 160 characters for single SMS, 153 characters per segment for concatenated messages
• Unicode/UCS-2: 70 characters for single SMS, 67 characters per segment for concatenated messages

Encoding considerations: Use GSM-7 for standard Latin alphabet. Switch to UCS-2 for Spanish-specific characters (ñ, á, é, í, ó, ú).

Example: "Buenos días" (GSM-7) uses 11 characters. "Buenos días, señor García" requires UCS-2 due to ñ and í, consuming 27 characters from your 70-character limit.

MMS Support

Spanish carriers automatically convert MMS messages to SMS with an embedded URL link to access the multimedia content. This conversion ensures compatibility across all devices while preserving your ability to share rich media. The recipient receives a standard SMS containing your text plus a clickable link to view images, videos, or other multimedia files through their mobile browser.

Recipient Phone Number Compatibility

Number Portability

Spain supports full number portability, allowing users to keep their phone numbers when switching carriers. Spanish telecommunications infrastructure handles all routing automatically – you don't need to adjust your SMS logic or perform special lookups. Send messages to any Spanish mobile number, and the network will deliver them correctly regardless of which operator currently serves that number.

Sending SMS to Landlines

You cannot send SMS to landline numbers in Spain. Attempts fail with a 400 response error (error code 21614). Your account won't be charged for these failed attempts, and failed messages won't appear in logs.

GDPR Compliance and Regulatory Guidelines for SMS Marketing in Spain

Two primary authorities regulate Spain's SMS communications: the Spanish Data Protection Agency (AEPD) enforces GDPR compliance, while the National Commission of Markets and Competition (CNMC) enforces telecommunications regulations. Non-compliance can result in GDPR fines up to €20 million or 4% of annual global turnover (whichever is higher).

Consent and Opt-In Requirements for Spanish SMS

Explicit Consent Requirements:

Obtain written or electronic confirmation from recipients before sending marketing messages. Follow these specific requirements:

Compliant consent collection methods:

• Checkbox opt-in on web forms (pre-checked boxes are not compliant)
• SMS-based confirmation with double opt-in verification
• Signed paper forms with clear disclosure
• Email confirmation with explicit acceptance

Non-compliant methods:

• Pre-checked boxes or automatic enrollment
• Assumed consent from business card collection
• Implied consent from website visits
• Generic terms and conditions without explicit SMS opt-in

Required disclosure elements:

• Clear message purpose (marketing, transactional, or notifications)
• Expected frequency (e.g., "up to 4 messages per month")
• Company identity and contact information
• Data usage and storage practices

Documentation requirements:

• Timestamp of when consent was given
• Method of consent collection
• Exact wording shown to the recipient
• IP address or device identifier (for electronic consent)
• Proof that consent was freely given and specific

HELP/STOP and Other Commands

Required Keywords:

Support all commands in both Spanish and English. Send response messages in the same language as the received command.

Do Not Call / Do Not Disturb Registries

Spain maintains the Lista Robinson, a national opt-out registry for marketing communications managed by the Spanish Data Protection Agency (AEPD).

Legal obligations:

• Mandatory consultation: Check Lista Robinson before sending marketing messages to contacts who haven't provided explicit consent
• Effectiveness window: Inscriptions take up to 2 months to become fully effective, as data may already be in active campaigns
• Processing timeframe: Process opt-out requests within 24 hours for internal lists

Access and integration process:

1. Register your organization at listarobinson.es
2. Request access to the suppression list database (available as CSV or API)
3. Download monthly updates (minimum frequency)
4. Cross-reference your contact list against Lista Robinson entries
5. Remove or flag registered numbers before launching campaigns
6. Document each consultation with timestamp and file version

Best practices:

• Check against the Lista Robinson database regularly (monthly recommended)
• Maintain internal suppression lists separate from Lista Robinson
• Filter registered numbers proactively before campaign launches
• Document audit trails of Lista Robinson consultations
• Automate monthly synchronization to prevent compliance gaps

Source: Lista Robinson Official Registry, AEPD Guidelines

Time Zone Sensitivity

Spain observes specific time restrictions for commercial SMS:

Permitted Hours: 8:00 AM to 9:00 PM (local time)

Time Zone Considerations:

• Mainland Spain: CET (UTC+1) / CEST (UTC+2 during DST)
• Canary Islands: WET (UTC+0) / WEST (UTC+1 during DST) – 1 hour behind mainland
• DST transitions: Last Sunday in March (forward) and last Sunday in October (back)

Schedule your campaigns accordingly:

• Always use Europe/Madrid timezone for mainland Spain
• Use Atlantic/Canary timezone for Canary Islands recipients
• Account for DST changes when scheduling advance campaigns

Exceptions: Emergency or critical service messages (account security alerts, fraud warnings, service outages)

Holiday Considerations: Avoid sending during national and regional holidays. Major dates include January 1, January 6 (Epiphany), Easter Thursday–Monday, May 1, August 15, October 12, November 1, December 6, December 8, and December 25.

Phone Numbers Options and SMS Sender Types for Spain

Alphanumeric Sender ID

Operator network capability: Fully supported across all major networks

Registration requirements: No pre-registration required for standard usage. Dynamic sender IDs work immediately.

Special considerations: MEF-Protected Sender IDs (brand names registered with MEF) require a Letter of Authorization (LOA) from June 6, 2024. Apply for LOA through your SMS provider by submitting proof of brand ownership (trademark registration, company registration documents).

Sender ID preservation: Yes, sender IDs display exactly as specified

Character limits: Up to 11 alphanumeric characters (A-Z, a-z, 0-9, spaces)

Best practices:

• Use recognizable brand names
• Avoid special characters or symbols
• Test across all three major carriers

Long Codes

Domestic vs. International: Both supported

Sender ID preservation: Yes, maintained across all major carriers

Capabilities:

• Support inbound messages for two-way conversations
• Enable reply-based interactions
• Maintain consistent customer touchpoint
• Lower throughput than short codes (typically 1–10 messages/second)

Short Codes

Support: Fully available in Spain

Provisioning time: 12–14 weeks (includes carrier review and approval)

Application process:

1. Select 4-digit or 5-digit short code
2. Submit use case description to carriers
3. Provide sample message templates
4. Complete carrier compliance review
5. Pay setup fees (€5,000–€15,000) and monthly fees (€500–€2,000)
6. Wait for multi-carrier approval
7. Complete technical integration testing

Use cases:

• High-volume marketing campaigns (up to 100 messages/second)
• Two-factor authentication at scale
• Customer engagement programs (voting, contests)
• Premium rate services with carrier billing

Restricted SMS Content, Industries, and Use Cases

Prohibited Content:

Spain enforces strict content restrictions under the Spanish Penal Code (Articles 197–204 for privacy violations) and Law 34/1988 on advertising regulations:

• Cannabis-related content (strictly forbidden under all circumstances)
• Gambling without proper licensing (requires Spanish Directorate General for Gaming Regulation approval)
• Adult content (pornography, explicit sexual services)
• Unauthorized financial services (requires Bank of Spain or CNMV licensing)
• Political messaging without proper disclosure (must comply with Electoral Law requirements)

Content Filtering

Carrier Filtering Rules:

Spanish carriers employ multi-layer spam detection systems that analyze:

• Keyword patterns: Known spam phrases, restricted industry terms
• URL reputation: Blacklisted domains, newly registered domains, suspicious URL patterns
• Message velocity: High-frequency identical messages from single sender
• Compliance markers: Missing opt-out information, invalid sender IDs
• Spam scores: Aggregate score above carrier threshold (typically > 0.7) triggers blocking

Best Practices to Avoid Filtering:

• Avoid URL shorteners in sensitive industries (finance, healthcare)
• Include clear sender identification in message body
• Maintain consistent sending patterns (avoid sudden volume spikes)
• Use approved templates for regulated industries
• Include opt-out instructions in every marketing message
• Warm up new sender IDs gradually (start with low volume, increase over 2–4 weeks)
• Register sender IDs with carriers when possible

Best Practices for Sending SMS in Spain

Messaging Strategy

Craft effective messages with these proven techniques:

• Keep messages under 160 characters – Single-segment messages have higher deliverability and lower costs
• Lead with value – State the benefit or action in the first 20 characters
• Include clear call-to-action – Use specific verbs like "Reply YES," "Visit [URL]," or "Call now"
• Personalize using data – Insert recipient's name, order number, or relevant details
• Maintain consistent brand voice – Use the same tone, terminology, and style across campaigns

Sending Frequency and Timing

Recommended frequency: Limit to 2–4 messages per month per recipient. Spanish consumers report optimal engagement at this frequency, with higher volumes triggering opt-outs.

Optimal sending times:

• Peak engagement: 10:00–13:00 and 17:00–20:00 on weekdays
• Avoid: 14:00–16:00 (siesta time), Sundays, national holidays
• Business hours: 9:00–14:00, 16:00–19:00 for professional communications

Scheduling strategy:

• Schedule promotional messages for Tuesday–Thursday (highest engagement)
• Send transactional messages immediately (not time-restricted)
• Respect regional holidays in Catalonia, Basque Country, and other autonomous communities

Localization

Formatting standards:

• Dates: DD/MM/YYYY (e.g., 15/03/2025, not 03/15/2025)
• Times: 24-hour format (e.g., 14:00, not 2:00 PM)
• Currency: €50,00 (note comma as decimal separator in Spain)
• Phone numbers: +34 XXX XXX XXX (spaces preferred over dashes)

Cultural considerations:

• Use formal "usted" for initial business communications
• Transition to informal "tú" only after established relationship
• Respect regional pride – avoid assuming all Spain is culturally uniform

Opt-Out Management

Process opt-outs efficiently to maintain compliance:

1. Immediate suppression – Remove number from active campaigns within 24 hours
2. Centralized database – Maintain single source of truth for opt-outs across systems
3. Confirmation message – Send one final message confirming unsubscription
4. Regular audits – Review opt-out lists monthly for accuracy
5. Cross-channel sync – Ensure opt-outs apply to SMS, email, and other channels

Testing and Monitoring

Pre-launch testing checklist:

• Test delivery across Movistar, Vodafone, and Orange networks
• Verify message rendering on iOS and Android devices
• Check sender ID display on different handsets
• Test opt-out keyword responses
• Confirm URL links work on mobile browsers

Ongoing monitoring metrics:

• Delivery rate by carrier – Track Movistar, Vodafone, Orange separately (target: >95%)
• Time-to-delivery – Measure latency from API call to recipient receipt (target: <30 seconds)
• Engagement rate – Track click-through and response rates by time of day
• Opt-out rate – Monitor weekly (acceptable: <0.5% per campaign)
• Carrier filtering – Watch for sudden delivery drops indicating filter triggers

A/B testing priorities:

1. Message length (short vs. medium)
2. Call-to-action wording
3. Personalization depth
4. Sending time windows
5. Sender ID formats (alphanumeric vs. long code)

SMS API integrations for Spain

Twilio

Twilio provides a robust REST API for sending SMS to Spain. Authentication uses account SID and auth token.

import { Twilio } from 'twilio';

// Initialize client with environment variables
const client = new Twilio(
  process.env.TWILIO_ACCOUNT_SID,
  process.env.TWILIO_AUTH_TOKEN
);

async function sendSMSToSpain() {
  try {
    // Send message with Spanish number formatting
    const message = await client.messages.create({
      body: 'Hola! Este es un mensaje de prueba.',
      from: '+34XXXXXXXXX', // Spanish sender number
      to: '+34XXXXXXXXX',   // Spanish recipient number
      statusCallback: 'https://your-callback-url.com/status'
    });

    console.log(`Message sent successfully! SID: ${message.sid}`);
    return message.sid;
  } catch (error) {
    // Handle specific Twilio errors
    if (error.code === 21614) {
      console.error('Invalid Spanish number format');
    } else if (error.code === 21408) {
      console.error('Permission denied for Spain messaging');
    } else {
      console.error('Error sending message:', error);
    }
    throw error;
  }
}

Sinch

Sinch offers a straightforward REST API with bearer token authentication.

import axios from 'axios';

const SINCH_API_TOKEN = process.env.SINCH_API_TOKEN;
const SINCH_SERVICE_PLAN_ID = process.env.SINCH_SERVICE_PLAN_ID;

async function sendSinchSMS() {
  try {
    const response = await axios.post(
      `https://sms.api.sinch.com/xms/v1/${SINCH_SERVICE_PLAN_ID}/batches`,
      {
        from: 'YourBrand', // Alphanumeric sender ID
        to: ['+34XXXXXXXXX'],
        body: 'Su mensaje de confirmación',
        delivery_report: 'summary'
      },
      {
        headers: {
          'Authorization': `Bearer ${SINCH_API_TOKEN}`,
          'Content-Type': 'application/json'
        }
      }
    );

    console.log('Batch ID:', response.data.id);
    return response.data.id;
  } catch (error) {
    console.error('Sinch API error:', error.response?.data);
    throw error;
  }
}

MessageBird

MessageBird provides a feature-rich API with support for various message types.

import messagebird from 'messagebird';

const client = messagebird(process.env.MESSAGEBIRD_API_KEY);

function sendMessageBirdSMS() {
  const params = {
    originator: 'CompanyName',
    recipients: ['+34XXXXXXXXX'],
    body: 'Mensaje importante de su empresa',
    language: 'es',
    reportUrl: 'https://your-webhook.com/delivery-status'
  };

  client.messages.create(params, (err, response) => {
    if (err) {
      console.error('MessageBird error:', err);
      return;
    }
    console.log('Message sent successfully:', response.id);
  });
}

Plivo

Plivo offers a powerful API with support for high-volume messaging.

import plivo from 'plivo';

const client = new plivo.Client(
  process.env.PLIVO_AUTH_ID,
  process.env.PLIVO_AUTH_TOKEN
);

async function sendPlivoSMS() {
  try {
    const response = await client.messages.create({
      src: '+34XXXXXXXXX', // Your Plivo Spanish number
      dst: '+34XXXXXXXXX', // Destination Spanish number
      text: 'Su mensaje de texto',
      url: 'https://your-callback-url.com/status',
      type: 'sms'
    });

    console.log('Message UUID:', response.messageUuid);
    return response.messageUuid;
  } catch (error) {
    console.error('Plivo error:', error);
    throw error;
  }
}

API Rate Limits and Throughput

Note: Actual throughput depends on account tier, payment history, and destination country. Contact providers to request rate limit increases.

Throughput Management Strategies:

Queue-based systems (recommended for >1,000 messages/hour):

import Bull from 'bull';

const smsQueue = new Bull('sms-queue', {
  redis: { host: 'localhost', port: 6379 }
});

// Producer: Add messages to queue
async function queueSMS(to: string, body: string) {
  await smsQueue.add({
    to,
    body,
    timestamp: Date.now()
  }, {
    attempts: 3,
    backoff: {
      type: 'exponential',
      delay: 2000
    }
  });
}

// Consumer: Process messages with rate limiting
smsQueue.process(10, async (job) => {
  // Process 10 concurrent jobs
  await sendSMSToSpain(job.data.to, job.data.body);
});

Batch API usage (for bulk sends):

• Group messages into batches of 100–1,000
• Use provider-specific batch endpoints
• Process responses asynchronously

Exponential backoff (for retry logic):

async function sendWithRetry(messageData: any, maxRetries = 3) {
  for (let attempt = 0; attempt < maxRetries; attempt++) {
    try {
      return await sendSMS(messageData);
    } catch (error) {
      if (attempt === maxRetries - 1) throw error;
      const delay = Math.pow(2, attempt) * 1000; // 1s, 2s, 4s
      await new Promise(resolve => setTimeout(resolve, delay));
    }
  }
}

Monitor rate limit headers:

• X-RateLimit-Limit: Total requests allowed per window
• X-RateLimit-Remaining: Requests remaining in current window
• X-RateLimit-Reset: Timestamp when limit resets

Error Handling and Reporting

Spain-specific error codes:

Comprehensive error handling implementation:

async function sendWithErrorHandling(to: string, body: string) {
  try {
    const message = await client.messages.create({ to, body, from: '+34XXX' });

    // Log successful send
    await logMessageStatus({
      messageId: message.sid,
      to,
      status: 'sent',
      timestamp: new Date()
    });

    return message;
  } catch (error) {
    // Parse error details
    const errorCode = error.code;
    const errorMessage = error.message;

    // Log failure with details
    await logMessageStatus({
      to,
      status: 'failed',
      errorCode,
      errorMessage,
      timestamp: new Date()
    });

    // Alert on critical errors
    if (['30007', '30010'].includes(errorCode)) {
      await alertContentFiltering(to, body, errorCode);
    }

    throw error;
  }
}

Monitoring and alerting setup:

1. Track delivery rates by carrier (alert if <90%)
2. Monitor error code frequency (alert on sudden spikes)
3. Set up webhook endpoints for delivery receipts
4. Store message status updates in database
5. Create dashboards showing real-time metrics
6. Configure PagerDuty/Opsgenie for critical failures

Recap and Additional Resources

Key Takeaways:

1. Compliance First: Obtain explicit consent and honor opt-outs within 24 hours
2. Timing Matters: Send only between 8:00 AM and 9:00 PM local time
3. Language Support: Offer messages in Spanish and regional languages
4. Technical Implementation: Use reliable APIs with comprehensive error handling
5. Monitoring: Track delivery rates and engagement metrics across all carriers

Next Steps:

Additional Resources:

• Spanish Telecom Regulator (CNMC): www.cnmc.es
• Lista Robinson (Opt-out Registry): www.listarobinson.es
• GDPR Guidelines: gdpr.eu/spain
• Spanish Mobile Operators Association: www.digitales.es

Learn more about E.164 phone number formatting for international SMS delivery, or explore our guide on OTP and 2FA implementation for authentication use cases.

Frequently Asked Questions

What are the SMS compliance requirements for Spain?

Follow this compliance checklist:

Required actions:

1. Obtain explicit written or electronic consent before sending marketing SMS
2. Check the Lista Robinson opt-out registry monthly
3. Provide clear opt-out mechanisms (STOP/ALTO commands)
4. Send only during permitted hours (8:00 AM to 9:00 PM)
5. Document all consent with timestamp and method
6. Process opt-out requests within 24 hours
7. Include company identification in every message

Regulatory authorities: Spain enforces GDPR through the AEPD (Spanish Data Protection Agency). Non-compliance can result in fines up to €20 million or 4% of annual global turnover.

How long does Lista Robinson registration take to become effective?

Lista Robinson inscriptions take up to 2 months to become fully effective, as recipient data may already be in active campaigns. However, process opt-out requests to your internal suppression lists within 24 hours. Check the Lista Robinson database monthly before launching campaigns.

What sender ID types are supported in Spain?

Spain supports three sender ID types:

1. Alphanumeric sender IDs: No pre-registration required, but MEF-Protected IDs need LOA from June 6, 2024
2. Long codes: Immediate to 24-hour provisioning for domestic and international messaging
3. Short codes: 12–14 weeks provisioning for high-volume campaigns (€5,000–€15,000 setup fee)

Can I send SMS to Spanish landline numbers?

No, you cannot send SMS to landline numbers in Spain. Attempts fail with a 400 response error (error code 21614). Your account won't be charged, and failed messages won't appear in logs.

What are the permitted hours for commercial SMS in Spain?

Send commercial SMS only between 8:00 AM and 9:00 PM local time. Remember that the Canary Islands (Atlantic/Canary timezone) are 1 hour behind mainland Spain (Europe/Madrid timezone). Emergency or critical service messages are exempt from these restrictions. Avoid sending during Sundays, national holidays, and regional holidays.

What character encoding should I use for Spanish SMS?

Example: "Hola, su pedido está listo" requires UCS-2 due to á, consuming 28 of your 70 characters.

Which keywords must I support for opt-out in Spain?

Support both Spanish and English opt-out keywords:

• STOP/ALTO: Opt-out
• BAJA: Unsubscribe
• AYUDA/HELP: Assistance
• START/INICIO: Opt back in (optional but recommended)

Send response messages in the same language as the received command. Process opt-outs within 24 hours.

What content is prohibited in Spain SMS marketing?

Spain prohibits:

• Cannabis-related content (strictly forbidden under all circumstances)
• Gambling without Spanish Directorate General for Gaming Regulation approval
• Adult content (pornography, explicit sexual services)
• Unauthorized financial services (requires Bank of Spain or CNMV licensing)
• Political messaging without Electoral Law disclosure

Carriers filter keywords related to restricted industries, suspicious URLs, high-frequency identical messages, and messages without opt-out information.

How do Spanish mobile operators handle number portability?

Spanish mobile operators handle number portability efficiently without impacting SMS delivery or routing. Users can keep their phone numbers when switching between Movistar, Vodafone, Orange, and other carriers. You don't need to adjust your SMS sending logic for ported numbers – the network automatically routes messages to the correct current carrier.

What are the main differences between Spanish regional SMS requirements?

While GDPR and Lista Robinson apply nationwide, consider these regional factors:

Language preferences by region:

• Catalonia: Offer Catalan option (7.7 million speakers)
• Basque Country: Provide Basque for regional campaigns (2.2 million speakers)
• Galicia: Use Galician for strong regional resonance (2.7 million speakers)
• Valencia: Offer Valencian variant (5 million speakers)

Regional holidays: Respect regional holidays in addition to national ones. Each autonomous community has 2–4 additional holidays per year.

Time zone: The Canary Islands operate in Atlantic/Canary timezone (1 hour behind mainland Spain's Europe/Madrid timezone).