Luxembourg SMS Guide: GDPR Compliance, Regulations & Best Practices

Send SMS messages in Luxembourg with confidence by navigating GDPR compliance, CNPD data protection requirements, and ILR telecommunications regulations. This comprehensive guide covers everything you need to send SMS in Luxembourg: compliance requirements, technical capabilities, phone number formats, and integration with Luxembourg's three major mobile operators—POST Luxembourg, Tango, and Orange. Learn how to implement two-factor authentication, transactional notifications, and marketing campaigns while maintaining full regulatory compliance in Luxembourg's highly regulated telecommunications market.

Luxembourg SMS Market Overview: Mobile Operators & Network Infrastructure

Market Conditions: Luxembourg operates a highly developed telecommunications market with 140% mobile penetration (880,000 subscriptions for a population of ~640,000) as of 2021 (CIA World Factbook 2024). Three mobile operators run their own networks and control over 98% of the market (source: Institut Luxembourgeois de Régulation, October 2024):

• POST Luxembourg: >50% market share (state-owned incumbent with best nationwide coverage)
• Tango (Proximus Luxembourg): ~33% market share
• Orange Luxembourg: ~15% market share

MVNO Market: Luxembourg hosts several Mobile Virtual Network Operators (MVNOs) including E-Lux Mobile, Blue Communications, Interactive digital media GmbH, Mitto AG, MTX Connect, and Syniverse Technologies (MCC-MNC Database). These MVNOs operate on the infrastructure of the three major network operators but hold minimal market share, as the primary operators maintain dominant positions.

Users favor OTT (Over-The-Top) messaging apps like WhatsApp and Facebook Messenger for personal communications, but SMS remains essential for business communications:

• Authentication (two-factor codes)
• Transaction notifications (banking, purchases)
• Official messages (government, healthcare)
• Appointment reminders

The market splits relatively evenly between Android and iOS devices, with iOS showing slight preference among business users.

Phone Number Format: Luxembourg employs a closed dialing system with no trunk prefix. Dial all numbers in the same format domestically and internationally:

• E.164 international format: +352 XXXXXXXX (6–9 digits after country code)
• Mobile numbers: Three-digit network code "6x1" followed by 6 digits (e.g., +352 621 123 456)
• No geographic area codes: Carriers organize numbers by assigned prefix blocks
• Toll-free numbers: 800 prefix
• Premium SMS: 90 prefix

Mobile Network Codes (MNC): Luxembourg's major operators use the following network codes under MCC 270 (MCC-MNC Database):

• POST Luxembourg: MNC 01 (PLMN ID 27001)
• Tango SA: MNC 77 (PLMN ID 27077)
• Orange SA: MNC 99 (PLMN ID 27099)

How SMS Works in Luxembourg: Technical Capabilities & Requirements

Luxembourg supports standard SMS messaging capabilities with limitations on advanced features like two-way messaging and concatenation.

Two-Way SMS Support

Most standard international API providers do not support two-way SMS in Luxembourg. However, Mpulse (mpulse.eu), a local Luxembourg operator operating since 2006, offers high-quality two-way SMS routing with direct connections to Luxembourg mobile operators' networks. Mpulse handles >90% of Luxembourg's professional SMS routing and provides SMPP protocol support for high-volume two-way messaging.

Workarounds for two-way SMS without Mpulse:

Concatenated Messages (Segmented SMS)

Support: Major SMS providers do not support concatenated messaging in Luxembourg.

Message length rules: Standard SMS length limits apply – 160 characters for GSM-7 encoding, 70 characters for Unicode.

GSM-7 extended characters: The following characters count as 2 characters each due to escape codes: { } [ ] ~ \ ^ € | (Twilio GSM-7 Documentation). Plan message length accordingly when using these special characters.

Encoding considerations: Both GSM-7 and UCS-2 encodings work, with GSM-7 recommended for optimal character usage and cost efficiency. Including any non-GSM-7 character forces UCS-2 encoding, reducing capacity from 160 to 70 characters.

Handling longer messages without concatenation:

MMS Support

MMS messages automatically convert to SMS with an embedded URL link to view the media content. This ensures compatibility across all carriers while delivering rich media content to end users.

Recipient Phone Number Compatibility

Number Portability

Number portability is not available in Luxembourg for SMS services. Messages route based on the original carrier assignment of the phone number. This limitation exists because SMS routing relies on the Mobile Network Code (MNC) embedded in the phone number, which reflects the original operator assignment rather than the current carrier after porting. Mpulse maintains access to Luxembourg's national portability database for accurate routing.

Sending SMS to Landlines

You cannot send SMS to landline numbers in Luxembourg. Attempts to send messages to landlines result in failed delivery and an error response (400 error code 21614) from the SMS API, with no charges applied to your account.

Luxembourg SMS Compliance: GDPR, CNPD & ILR Regulatory Requirements

Luxembourg enforces strict GDPR (General Data Protection Regulation) and ePrivacy Directive requirements for SMS communications. The National Commission for Data Protection (CNPD) oversees data privacy compliance, while the Institut Luxembourgeois de Régulation (ILR) regulates telecommunications services under the Act of 17 December 2021 on electronic communications networks and services, which implements the European Electronic Communications Code.

General Authorization: To provide electronic communications networks or services in Luxembourg, you must notify the ILR at least 20 days before initiating service. The notification grants general authorization to operate under the regulatory framework established by the Act of 17 December 2021. Submit notifications through the ILR regulatory portal with details of your intended services, technical specifications, and operational plans.

How to Obtain GDPR Consent for SMS Marketing in Luxembourg

Explicit Consent Requirements:

• Obtain written or electronic consent before sending marketing messages
• Ensure consent is freely given, specific, informed, and unambiguous (GDPR Article 4(11))
• Document consent with timestamp, source, and scope
• Existing business relationships may allow soft opt-in but must provide immediate opt-out options

Soft Opt-In Exception (CNPD Guidelines):

• If you have an existing contractual relationship (sale or services), you may use your clients' email addresses or phone numbers for advertising similar products without prior consent
• Recipients must have the right to object at any time to this advertising
• Inform recipients of this right during data collection and in each advertising message
• This exception applies only to similar products or services from your company

Best Practices for Consent:

• Use double opt-in processes for marketing lists
• Maintain detailed consent records including date, time, and method
• Clearly state the types of messages recipients will receive
• Provide transparent information about data usage and sharing

Example Consent Language:

Consent Record Fields to Store:

• Phone number
• Consent timestamp (ISO 8601 format)
• Consent method (web form, phone, in-person)
• IP address (if digital)
• Message types agreed to
• Opt-out timestamp (when applicable)

HELP/STOP and Other Commands

• Support STOP, ARRÊT, and STOPP commands (accommodating French, German, and English)
• Provide support information in relevant languages for AIDE and HELP commands
• Make all commands case-insensitive
• Respond to opt-out commands immediately and send confirmation

Example responses:

• STOP: "You have been unsubscribed. You will receive no further messages from [Company Name]."
• HELP: "For assistance, contact [Company Name] at [email/phone]. Reply STOP to unsubscribe. Msg&Data rates may apply."
• ARRÊT: "Vous avez été désinscrit. Vous ne recevrez plus de messages de [Nom de l'entreprise]."

Do Not Call / Do Not Disturb Registries

Luxembourg does not maintain a centralized Do Not Call registry. You must:

• Maintain your own suppression lists
• Honor opt-out requests within 24 hours
• Implement proper list hygiene practices
• Regularly clean contact databases

Premium SMS Regulations in Luxembourg

Legal Framework: The ILR regulation of July 14, 2014 governs premium-rate SMS subscriptions, covering numbering rules, the national numbering plan, and fees relating to numbering resources.

Key Requirements:

• Maximum price: €5.00 (including VAT) per premium SMS
• Number format: Premium SMS services use numbers starting with 90
• Unsubscribe method: Users send "STOP" (even if misspelled) to the originating short number

StopSMS.lu Platform: In March 2022, Luxembourg mobile operators (POST Telecom, Tango, Orange) and SMS routing specialist Mpulse launched www.stopsms.lu, a self-service portal that enables subscribers to:

• View all current premium SMS service subscriptions
• Access content provider contact details
• Request additional information about services
• Trigger unsubscribe processes directly from the website
• Log in securely using their telephone number

Consumer Protection: In 2021, the ILR observed a significant increase in disputes concerning premium SMS billing and requested operators strengthen consumer protection measures, leading to the creation of the StopSMS.lu platform.

Time Zone Sensitivity

Luxembourg observes Central European Time (CET/CEST). While no strict time restrictions exist:

• Recommended sending window: 08:00–20:00 CET
• Avoid sending on: Sundays and public holidays
• Emergency messages: Send 24/7 if truly urgent
• Best practice: Schedule campaigns between 10:00–18:00 on business days

Luxembourg Public Holidays (avoid marketing SMS):

How to Choose a Sender ID for SMS in Luxembourg: Complete Guide

Alphanumeric Sender ID

Operator network capability: Supported with dynamic usage

Registration requirements: No pre-registration required

Sender ID preservation: Sender IDs are preserved across all major carriers

Length restriction: Maximum 11 characters

Character restrictions: Alphanumeric sender IDs can contain upper-case (A-Z), lower-case (a-z), numbers (0-9), spaces, and special characters + - _ &. The period . can be used but is not supported in all countries. Must contain at least one letter (Twilio Alphanumeric Sender ID Requirements).

Long Codes

Domestic vs. International:

• Domestic long codes: Not supported
• International long codes: Fully supported

Sender ID preservation: Yes, original sender ID is preserved

Provisioning time: Immediate for international long codes

Use cases:

• Two-factor authentication (2FA)
• Transactional messages
• Customer support communications

Short Codes

Support: Not currently available in Luxembourg

Alternative: Use international long codes or alphanumeric sender IDs

Use cases: N/A

Restricted SMS Content, Industries & Use Cases in Luxembourg

Restricted Industries:

• Gambling and betting services (unless licensed by Loterie Nationale under Law of 20 April 1977)
• Adult content and services
• Cryptocurrency promotions
• Unauthorized financial services

Regulated Industries:

• Banking and financial services (require CSSF regulatory compliance under Luxembourg financial sector laws)
• Healthcare (subject to GDPR Article 9 special category data protections and patient confidentiality requirements)
• Insurance (must follow CAA disclosure requirements and GDPR compliance)

Content Filtering

Known Carrier Filters:

• URLs from unknown shorteners
• Excessive punctuation
• All-capital messages
• Multiple exclamation marks

Spam Trigger Words to Avoid:

• Urgency tactics: "ACT NOW", "LIMITED TIME", "HURRY", "URGENT"
• Financial claims: "FREE MONEY", "GUARANTEED INCOME", "RISK-FREE"
• Excessive punctuation: "!!!!", "$$$", "????"
• All caps messages: "YOUR ACCOUNT HAS BEEN LOCKED"
• French/German equivalents: "GRATUIT", "KOSTENLOS", "GAGNER", "GEWINNEN"

Best Practices:

• Use official domain URLs
• Maintain consistent sender IDs
• Include clear business identification
• Write naturally without excessive emphasis

Best Practices for Sending SMS in Luxembourg: Strategy & Optimization

Messaging Strategy

• Keep messages under 160 characters when possible
• Include clear calls-to-action
• Use personalization tokens thoughtfully (first name, account reference)
• Maintain consistent brand voice

Sending Frequency and Timing

• Limit to 4–5 messages per month per recipient
• Respect business hours and time zones
• Avoid sending during major holidays
• Space out messages appropriately

Localization

• Support French, German, and English (Luxembourg's three official languages)
• Consider cultural nuances (formal vs. informal address varies by language)
• Use appropriate date/time formats (DD.MM.YYYY for German, DD/MM/YYYY for French and English)
• Respect local holidays and customs

Opt-Out Management

• Process opt-outs within 24 hours
• Maintain centralized suppression lists
• Confirm opt-out with final message
• Clean databases regularly

Testing and Monitoring

• Test across all major carriers
• Monitor delivery rates
• Track engagement metrics
• Conduct regular performance analysis

Healthy Campaign Metrics:

SMS API Integrations for Luxembourg: Twilio, Sinch, MessageBird & Plivo

Twilio

Twilio provides a robust SMS API with comprehensive support for Luxembourg. Integration requires an account SID and auth token for authentication.

import { Twilio } from 'twilio';

// Initialize Twilio client
const client = new Twilio(
  process.env.TWILIO_ACCOUNT_SID,    // Your Account SID
  process.env.TWILIO_AUTH_TOKEN      // Your Auth Token
);

// Function to send SMS to Luxembourg
async function sendSmsToLuxembourg(
  to: string,
  message: string,
  senderId: string
): Promise<void> {
  try {
    // Ensure number is in E.164 format for Luxembourg
    const formattedNumber = to.startsWith('+352') ? to : `+352${to}`;

    const response = await client.messages.create({
      body: message,
      from: senderId,    // Alphanumeric sender ID or long code
      to: formattedNumber,
      // Optional parameters for delivery tracking
      statusCallback: 'https://your-webhook.com/status'
    });

    console.log(`Message sent successfully! SID: ${response.sid}`);
  } catch (error) {
    console.error('Error sending message:', error);
    throw error;
  }
}

Common Luxembourg-specific error codes:

• 21211: Invalid 'To' phone number (verify E.164 format with +352)
• 21408: Permission to send SMS not enabled (check account settings)
• 21614: 'To' number is not a valid mobile number (landline number used)
• 30003: Unreachable destination (carrier network issues)
• 30005: Unknown destination (invalid Luxembourg number)

Sinch

Sinch offers a straightforward REST API for sending SMS to Luxembourg, with support for both JSON and XML formats.

import axios from 'axios';

interface SinchSmsConfig {
  apiToken: string;
  servicePlanId: string;
  senderId: string;
}

class SinchSmsService {
  private readonly baseUrl = 'https://sms.api.sinch.com/xms/v1';
  private readonly config: SinchSmsConfig;

  constructor(config: SinchSmsConfig) {
    this.config = config;
  }

  async sendSms(to: string, message: string): Promise<void> {
    try {
      const response = await axios.post(
        `${this.baseUrl}/${this.config.servicePlanId}/batches`,
        {
          from: this.config.senderId,
          to: [to],
          body: message
        },
        {
          headers: {
            'Authorization': `Bearer ${this.config.apiToken}`,
            'Content-Type': 'application/json'
          }
        }
      );

      console.log('Message sent:', response.data.id);
    } catch (error) {
      console.error('Sinch SMS error:', error);
      throw error;
    }
  }
}

MessageBird

MessageBird provides a feature-rich API with strong support for European markets including Luxembourg.

import messagebird from 'messagebird';

class MessageBirdService {
  private client: any;

  constructor(apiKey: string) {
    this.client = messagebird(apiKey);
  }

  sendSms(
    to: string,
    message: string,
    senderId: string
  ): Promise<any> {
    return new Promise((resolve, reject) => {
      this.client.messages.create({
        originator: senderId,
        recipients: [to],
        body: message,
        // Optional parameters
        reportUrl: 'https://your-webhook.com/delivery-reports'
      }, (err: any, response: any) => {
        if (err) {
          reject(err);
        } else {
          resolve(response);
        }
      });
    });
  }
}

Plivo

Plivo offers reliable SMS delivery to Luxembourg with detailed delivery reporting.

import plivo from 'plivo';

class PlivoSmsService {
  private client: any;

  constructor(authId: string, authToken: string) {
    this.client = new plivo.Client(authId, authToken);
  }

  async sendSms(
    to: string,
    message: string,
    senderId: string
  ): Promise<void> {
    try {
      const response = await this.client.messages.create({
        src: senderId,
        dst: to,
        text: message,
        // Optional parameters
        url: 'https://your-webhook.com/delivery-status',
        method: 'POST'
      });

      console.log('Message sent:', response.messageUuid[0]);
    } catch (error) {
      console.error('Plivo error:', error);
      throw error;
    }
  }
}

API Rate Limits and Throughput

• Default rate limits vary by provider (typically 1-10 messages per second)
• Implement exponential backoff for retry logic
• Use batch APIs for high-volume sending
• Consider queue implementation for large campaigns:

import Queue from 'bull';

const smsQueue = new Queue('sms-queue', {
  redis: process.env.REDIS_URL
});

// Add rate limiting
smsQueue.process(10, async (job) => {
  // Process SMS sending logic here
});

Error Handling and Reporting

• Implement comprehensive logging
• Monitor delivery receipts
• Track common error codes

Luxembourg-Specific Error Codes:

Frequently Asked Questions About Sending SMS in Luxembourg

What phone number format should I use for Luxembourg SMS?

Use the E.164 international format: +352 followed by 6–9 digits. Luxembourg employs a closed dialing system with no trunk prefix, so all numbers are dialed identically domestically and internationally. Mobile numbers use a three-digit network code "6x1" followed by 6 digits (example: +352 621 123 456). Always include the +352 country code when sending SMS to ensure proper routing across all carriers.

Do I need GDPR consent to send marketing SMS in Luxembourg?

Yes, you must obtain explicit GDPR consent before sending marketing SMS in Luxembourg. Consent must be freely given, specific, informed, and unambiguous per GDPR Article 4(11), enforced by the CNPD (National Commission for Data Protection). However, the "soft opt-in" exception allows you to send marketing for similar products to existing customers without prior consent, provided you give them the right to object during data collection and in each message. Always document consent with timestamp, source, and scope.

Which mobile operators work in Luxembourg?

Luxembourg has three major mobile operators that control over 98% of the market (source: ILR, October 2024): POST Luxembourg (>50% market share, state-owned incumbent with best coverage), Tango/Proximus Luxembourg (~33% market share), and Orange Luxembourg (~15% market share). All three operate their own networks. Number portability is not available for SMS services, so messages route based on the original carrier assignment.

Can I send two-way SMS in Luxembourg?

Most standard international API providers do not support two-way SMS in Luxembourg. However, Mpulse, a local Luxembourg operator operating since 2006, offers two-way SMS routing with direct connections to Luxembourg mobile operators' networks. If you require interactive messaging for customer support or engagement, consider Mpulse or implement workarounds using separate inbound and outbound numbers with other providers like Twilio or Sinch.

Are concatenated messages supported in Luxembourg?

No, major SMS providers do not support concatenated (multi-part) messages in Luxembourg. You must keep messages within standard SMS length limits: 160 characters for GSM-7 encoding or 70 characters for Unicode/UCS-2 encoding. Plan your message content accordingly and use GSM-7 encoding when possible for optimal character usage and cost efficiency.

What are the SMS compliance requirements in Luxembourg?

Luxembourg SMS compliance requires: (1) GDPR-compliant explicit consent or soft opt-in exception, (2) support for STOP, ARRÊT, and STOPP opt-out commands in French, German, and English, (3) immediate response to opt-out requests within 24 hours, (4) maintaining your own suppression lists, and (5) respecting premium SMS regulations (€5 maximum per ILR regulation of July 14, 2014). The CNPD enforces data protection rules while the ILR regulates telecommunications under the Act of 17 December 2021.

What is the StopSMS.lu platform?

StopSMS.lu is a self-service portal launched in March 2022 by Luxembourg mobile operators (POST, Tango, Orange) and Mpulse to manage premium SMS subscriptions. Subscribers can log in securely with their phone number to view all current premium SMS subscriptions, access content provider contacts, request information, and trigger unsubscribe processes directly. This platform was created after the ILR observed increased disputes about premium SMS billing in 2021.

What are the best times to send SMS in Luxembourg?

While Luxembourg has no strict legal time restrictions for SMS, best practices recommend sending between 08:00–20:00 CET (Central European Time). For optimal engagement, schedule marketing campaigns between 10:00–18:00 on business days. Avoid sending on Sundays and public holidays unless messages are emergency or explicitly requested. Luxembourg observes CET/CEST (Central European Summer Time), so adjust sending schedules for seasonal time changes.

Can I send SMS to landline numbers in Luxembourg?

No, you cannot send SMS to landline numbers in Luxembourg. Attempts to send messages to landlines result in failed delivery with an error response (400 error code 21614) from the SMS API, and no charges are applied to your account. Always validate phone numbers before sending to ensure they are mobile numbers using the "6x1" network code format.

How much does it cost to send SMS in Luxembourg?

SMS pricing in Luxembourg varies by provider and volume. Typical costs range from €0.03 to €0.08 per message segment for standard SMS. Premium SMS services are capped at €5.00 (including VAT) per message as mandated by the ILR regulation of July 14, 2014. Alphanumeric sender IDs typically cost the same as numeric long codes. Contact your SMS provider for volume-based pricing and negotiate bulk discounts for high-volume campaigns.

Recap and Additional Resources

Key Takeaways:

• Always format numbers in E.164 format (+352 followed by 6-9 digits)
• Mobile numbers use the "6x1" network code format
• Implement proper error handling and retry logic
• Monitor delivery rates and engagement
• Maintain compliance with GDPR and local regulations enforced by CNPD
• Respect premium SMS regulations (€5 maximum, ILR regulation of July 14, 2014)

Next Steps:

1. Review the Act of 17 December 2021 on electronic communications networks and services
2. Check ILR Telecommunications Guidelines for current regulations
3. Consult with legal counsel for GDPR and CNPD compliance review
4. Set up monitoring and reporting systems
5. Test thoroughly across all three major carriers (POST, Tango, Orange)

SMS Troubleshooting Checklist:

• Phone numbers formatted in E.164 (+352XXXXXXXX)
• Numbers use mobile prefix (6x1), not landline
• Message length under 160 chars (GSM-7) or 70 chars (Unicode)
• Sender ID is 11 characters or less (alphanumeric)
• GDPR consent documented with timestamp
• STOP/ARRÊT/STOPP commands implemented
• Sending during recommended hours (08:00–20:00 CET)
• Avoiding public holidays and Sundays
• Delivery rate monitoring enabled
• Error handling and retry logic implemented
• Suppression list maintained and honored
• Content avoids spam trigger words
• Testing completed on POST, Tango, and Orange networks

Additional Resources:

• Luxembourg Data Protection Authority (CNPD)
• Institut Luxembourgeois de Régulation (ILR)
• StopSMS.lu Platform – Premium SMS management
• European Electronic Communications Code
• Act of 17 December 2021 on electronic communications networks and services