Bulk SMS rules in Sri Lanka: consent, opt-out and the SMS levy

This is general information, not legal advice. Laws and carrier rules change. Check the sources linked here, and ask a Sri Lankan lawyer about your own case.

The short answer

• Separate promotional from transactional SMS. The levy, consent rules and sender ID rules differ.
• Get opt-in consent for promotions. SMS providers require it now. The Personal Data Protection Act (PDPA) will require it once Part IV starts.
• Offer a free opt-out in every promotional SMS. PDPA section 27 requires this, and providers already ask for it.
• Budget for the levy. The Finance Act sets 25 cents per bulk advertisement SMS, paid by the advertiser.

Promotional vs transactional SMS

Sri Lankan law draws the line in the levy rules. The Finance Act defines "bulk advertisements" as messages sent through mobile phones "to group of recipients for commercial purposes" (section 49). The 2018 regulations exclude customer-specific notifications, alerts and seasonal greetings that do not promote the advertiser's products.

	Transactional	Promotional
Examples	OTPs, account alerts, order and delivery updates	Offers, discounts, product launches, campaigns
SMS levy	Not charged on customer-specific notifications and alerts	25 cents per message, paid by the advertiser
Consent	No SMS-specific rule found	Opt-in required by SMS providers
Opt-out	No SMS-specific rule found	Free opt-out in the message
Unecast price, Sri Lankan businesses	LKR 0.50 per SMS including taxes	LKR 0.75 per SMS including taxes

Sources: Finance Act, No. 35 of 2018; Gazette Extraordinary No. 2104/16, 31 December 2018; carrier guidance from Twilio, Telnyx and Infobip; prices from Unecast bulk SMS gateway. Checked 6 November 2026.

Consent and opt-out under the PDPA

Part IV of the Personal Data Protection Act, No. 9 of 2022 covers marketing messages. Section 27 lets a controller send messages by telecommunication or electronic means "only if a data subject has given consent to receive such messages." The Act calls these "solicited messages."

• Opt-out. When collecting contact details, and each time a message is sent, you must explain how to opt out "free of charge" (section 27(3)).
• Identity. Recipients must be told what the message is about and who sent it (section 27(4)).
• What counts. A message is content meant to promote goods, services, a person or an organisation (section 27(6)).
• Valid consent. Consent must be "freely given, specific, informed and unambiguous," by written declaration or affirmative action (section 56). You must be able to show it was given (Schedule III).

When the PDPA applies

The PDPA starts in stages. As of 6 November 2026, we found no Gazette order bringing Part IV into operation.

Date	What happened
19 March 2022	Act certified. Part IV was to start 24 to 48 months later (section 1(4)).
8 January 2024	Gazette 2366/08 set 18 March 2025 for Parts I, II, III and VII.
14 March 2025	Gazette 2427/34 repealed that 18 March 2025 date.
30 October 2025	Amendment Act, No. 22 of 2025 certified. Remaining provisions start on dates set by Gazette order. The Part IV time window was repealed.
22 July 2026	Gazette 2498/16 set 1 January 2027 for sections 2 and 3, Part I and Part III.

Sources: primary texts linked in the table, checked 6 November 2026.

Part I (processing of personal data) and Part III (controllers and processors) start on 1 January 2027. SMS contact lists are personal data, so prepare now.

The levy on promotional SMS

Part XIII of the Finance Act, No. 35 of 2018 (certified 1 November 2018) imposes a levy on bulk advertisements sent by SMS.

Item	What the law says
Rate	25 cents per mobile short message (section 48)
Applies to	Messages sent to a group of recipients for commercial purposes (section 49)
From	1 January 2019
Who pays	The advertiser, to the mobile operator. Operators pass it to the Telecommunications Regulatory Commission by the 15th of the next month.
Not charged	Customer-specific notifications, alerts, seasonal greetings or similar messages approved by the Minister, if they do not promote the advertiser's products
Fixed lines	Extended to bulk advertisements sent through fixed telephone lines, also at 25 cents (Finance Act, No. 33 of 2023)

Sources: Finance Act, No. 35 of 2018, sections 48 and 49; Finance (Levy on Mobile Short Message Services) Regulations, No. 1 of 2019, Gazette 2104/16 of 31 December 2018; Finance Act, No. 33 of 2023, certified 13 December 2023. Checked 6 November 2026.

Is it still in force? The 2023 amendment kept the 25-cent rate. A Finance (Amendment) Bill published in April 2026 changes only section 44, on cellular towers. We found no repeal. We also found no official 2026 statement confirming collection. Ask your SMS provider how its price treats the levy.

Sending hours and content rules

We found no published regulator text that sets SMS sending hours in Sri Lanka. Providers report these practices:

• Hours. Local promotional traffic may be sent from 8:00 to 20:00 (reported by Infobip). Twilio advises sending only in daytime hours unless urgent.
• Opt-out in the template. Infobip says opt-out is mandatory for domestic promotional traffic. Telnyx asks for clear opt-out in marketing SMS.
• No international promotions. Infobip reports that international promotional traffic is not allowed. Twilio and Telnyx report that Mobitel accepts only OTP and transactional traffic.

In January 2020, the Telecommunications Regulatory Commission (TRCSL) reportedly ordered mobile operators to add a free opt-out to promotional messages. This was reported by the Sunday Times, 19 January 2020 and the Daily News via SAMENA, 20 January 2020. We could not open the directive itself.

Sender IDs have their own rules. See our guide to SMS sender IDs in Sri Lanka.

Practical checklist

1. Label each message type as transactional or promotional before you build it.
2. Register a sender ID that matches your brand. Use separate IDs for OTPs and promotions if your provider asks.
3. Record opt-in consent for every promotional contact: who, when, how and for what.
4. Add a free opt-out to every promotional SMS, and remove opted-out numbers quickly.
5. Name your business in every message.
6. Keep promotions out of OTPs and alerts. The levy exemption covers alerts only if they do not promote your products.
7. Send promotions between 8:00 and 20:00, the window Infobip reports.
8. Budget 25 cents per promotional SMS for the levy, or confirm your provider's price includes it.
9. Prepare for PDPA Parts I and III from 1 January 2027, and watch for a Part IV order.

On Unecast, promotional SMS "goes to your opted-in lists" and campaigns can be scheduled. Use priority 0 for marketing and 3 for OTPs (SMS API). For codes, see OTP SMS.

Before a campaign, test your sender name with the SMS sender ID checker and check message length with the SMS character counter.

Frequently asked questions

This is general information, not legal advice. It reflects the sources above as of 6 November 2026.

Keep reading

• SMS sender ID in Sri Lanka: what a mask is and how to register one
• OTP by SMS or WhatsApp authentication
• Bulk SMS gateway for Sri Lanka
• OTP SMS
• SMS API reference