Wake Up Old Customers: SMS and WhatsApp Done Right in the UK

Can I text or WhatsApp my old customers without breaking UK law?

Yes, but only if you have the right basis for each person. Under PECR, marketing texts, emails, voicemails and social media direct messages to individuals generally need specific prior consent. The common exception for businesses is the soft opt-in. Booking confirmations and other admin messages sit outside these marketing rules.

That distinction matters because most owners sit on years of contacts and assume that having a number means they can use it. They can't. Having a number only means you can send messages that serve the booking or order. Promotional messages need consent or the soft opt-in.

Who exactly can I message under the soft opt-in?

You can message past customers without fresh consent if you collected their details yourself during a sale or negotiation, you are promoting similar products or services, and you offered an opt-out when you collected the details and in every message since. It covers only the organisation that collected the details.

In practice, that gives you three tests to run on your list:

• Did they buy from you, or enquire about buying? A newsletter sign-up with no purchase history is not the same thing.
• Did you collect the number yourself? Bought-in lists are excluded, and so are contacts held by a sister or group company.
• Is the offer similar to what they bought? A hair colour customer hearing about a toner top-up is fine. A customer hearing about your unrelated side business is not.

Be honest on the opt-out test. If nobody ever told these customers they could say no to marketing, the soft opt-in is weak ground. In that case, treat them as a list to re-permission, not a list to promote to.

Is a phone number given for a booking consent to marketing?

No. The ICO's own example is a restaurant that collects a mobile number for a booking confirmation and then sends an advertising offer. The ICO treats that as marketing. A confirmation reminder is a service message, but a "come back for 20% off" message is promotion and needs a proper basis.

This is the trap I see most often. Owners reason that the customer handed over the number voluntarily, so it's fair game. The law looks at the purpose of the message, not how the number arrived. Keep reminders and offers clearly separate, and never slip a promotion into a confirmation.

What counts as valid consent, and what should I record?

Valid consent needs a clear affirmative action. Pre-ticked boxes, silence and inactivity do not count. The request must name your business and the channel, such as text. Consent does not transfer between numbers. Record who consented, when and how, so you can prove it later.

A simple record needs four fields: name, number, date and the exact wording or form they agreed to. If your booking system can store this against the customer record, use it. A spreadsheet works too, provided it is kept up to date and you can search it quickly when someone asks.

Should I use SMS or WhatsApp?

Use SMS for broad reach to customers who qualify under the soft opt-in. Use WhatsApp only for people who have explicitly opted in to WhatsApp marketing. UK sources say WhatsApp marketing needs explicit opt-in, and third-party guides say a booking number is not consent to it.

Cost differs too. Third-party guides put UK WhatsApp marketing messages at roughly £0.038 to £0.0635 each, before provider fees and VAT, and say customer-initiated replies are free within 24 hours. Check Meta's official rate card before budgeting. My view: start with SMS to your soft opt-in list, and use WhatsApp as the conversation channel once a customer replies or has clearly asked for it.

What should an old-customer message actually say?

Name your business, mention something real about the relationship, make one simple offer, and include a free opt-out. Hiding your identity or leaving out a valid contact address is not allowed. Keep it short enough to read on a lock screen, and ask for a reply rather than a click.

Here are two examples you can adapt:

Hi Sam, it's Priya at Glow Nails. It's been a while since your last visit. We have a few Tuesday and Wednesday slots free this month. Reply YES and we'll send you the times. Reply STOP to opt out.

Hi Dan, this is Hartley Plumbing. It's a year since we serviced your boiler. Want us to book your annual check? Reply BOOK for available dates. Reply STOP to opt out.

Notice what is missing: no capital-letter shouting, no countdown pressure, no link to an unfamiliar page. Replies are easier to track than clicks, and they start a real conversation.

When is the best time to send, and how often?

Send in waves of small batches, during sociable daytime hours on weekdays, and not more than once per campaign. There is no magic hour, so test. Never send early mornings, late evenings or Sundays, because irritation is the main reason people opt out or complain.

A practical plan is to split your list into three groups by last visit: 3 to 6 months, 6 to 12 months and over 12 months. Message the most recent group first. Send around 10 to 20% of the group, wait two days, read the replies, then adjust wording before sending the rest. One follow-up, at most, a week later to non-replies.

How do I handle opt-outs properly?

Every marketing message needs a free, simple opt-out, such as replying STOP. People must not be forced to log in to unsubscribe, and you must keep a suppression list. Opt-outs usually apply only to the channel used, so an email unsubscribe does not automatically stop texts.

1. Process STOP replies the same day and add the number to a suppression list.
2. Check the suppression list before every send, not just the first one.
3. Keep suppressed numbers on the list. Deleting them means you might message them again by accident.
4. If someone says "stop" in an unusual way, such as "please don't text me", treat it as an opt-out anyway.

Is the risk really worth worrying about?

Yes. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and raises the maximum PECR fine from £500,000 to £17.5 million or 4% of worldwide annual turnover, whichever is higher. That aligns PECR with UK GDPR. Check the commencement status, as provisions were being phased in.

A small business is unlikely to face the top figure, but the direction is clear: regulators are treating this as serious. Don't lean on the charity soft opt-in introduced on 5 February 2026 either. It applies to furthering charitable purposes, not to ordinary commercial firms.

How do I measure whether it worked?

Track four numbers per campaign: messages sent, replies, rebookings and opt-outs. Rebookings are the only figure that pays bills. Divide rebookings by messages sent for your conversion rate, and divide the revenue from those bookings by the cost of the campaign.

• Reply rate: tells you whether the wording works.
• Rebooking rate: tells you whether the offer works.
• Opt-out rate: tells you whether you are annoying people. If it climbs, send less often or tighten who you message.
• Revenue per message: tells you whether to repeat the campaign.

To do this cleanly, tag each rebooking with its source in your booking system. If bookings are scattered across a rented platform, you cannot do that easily.

Why does owning your customer data make this easier?

Because you can only follow up on data you actually control. Rented platforms keep the customer relationship, the records and the terms in their hands, and they can change them overnight. Your own booking system lets you store consent, tag sources and export lists whenever you need them.

Braynex Services has seen how much money hides here. One nail salon was paying Fresha about £1,800 a month in commission. Moving to its own booking system at £35 a month saved roughly £21,000 a year, and the salon now holds its client records itself, with consent and visit history in one place. That is the foundation that makes a respectful win-back campaign possible. Most small businesses lose money in places they cannot see: missed calls, platform commissions and old customer data that is never followed up.

Where should I start this week?

Export your customer list, remove anyone you cannot justify under consent or the soft opt-in, and add a STOP line to your message template. Then send a small test batch to your most recent lapsed customers and measure replies and rebookings before sending more.

If you want help working out which contacts you can legitimately message, setting up automated follow-ups, or moving your bookings and data onto systems you own, book a free audit at braynexservices.com. Braynex Services will review where your customer data sits and show you the quickest route to turning it back into bookings. This article is general guidance, not legal advice, so check the ICO's guidance if your situation is unusual.