> I am wondering if this is also happening in the EU or with customers from the European Union. The provider would probably put something to the effect of "we c

> I am wondering if this is also happening in the EU or with customers from the European Union. The provider would probably put something to the effect of "we can do what we want" into their fine print. > But I am not sure if this is legally clear cut under the regulations of the GDPR. > I am wondering if this is also happening in the EU or with customers from the European Union. The provider would probably put something to the effect of "we can do what we want" into their fine print. > But I am not sure if this is legally clear cut under the regulations of the GDPR. Those messages are part of the original reason for SMS existence, and yes all networks use them - both remotely triggered and unsolicited like in the article. They are vital to operation of the network. Allowing end users to message over this channel was a relatively late addition to the spec. Effectively, for many good reasons, the demarcation point between your part of the device and provider part is the interface between application processor (what runs Android/iOS etc) and the baseband processor which handles the stuff you need a license for, with the licensed party being effectively the provider. When it comes to GDPR, what actually happens is that the providers can't escape handling PII anyway, as it is crucial for their operation. Usually it means that there are some heavy safeties on access to PII, both practical and legal, but operations crew has a lot of capability and thus responsibility. Main difference seems to be that in EU, the carriers can't get away with as much monetization of this as they can in USA.