Small beauty and hairdressing salon owners often don't know where operational reminders end and promotional messages begin.
On this page you'll learn what separates an operational SMS from a marketing one, how to properly set up consent in your booking form, and how to avoid paying fines.
What is direct marketing in the context of SMS
The Electronic Communications Code (PKE) in Art. 398(1) clearly prohibits using automatic calling systems and telecommunication end devices for direct marketing purposes unless the subscriber has previously given consent — Prawo komunikacji elektronicznej, Dz.U. 2024 poz. 1221. The rule has been in force since July 1, 2024 and applies to every salon sending automated messages to clients — regardless of whether you use a CRM system, Booksy, or a simple bulk SMS tool.
What this means in practice: if your message contains any element encouraging the client to take advantage of an offer — a discounted price, promotion, event invitation, new service — it's a marketing message. It doesn't matter if the SMS mentions an upcoming appointment. Content is what counts.
Why automated SMS systems fall under the restriction
Automated messaging systems register the client's phone number and send messages without human involvement. From a legal perspective, this is using a telecommunication end device for direct marketing purposes — and requires prior consent. It doesn't matter whether you send messages yourself or through an external system. What matters is that messages arrive automatically, without manually dialing each number.
When is an SMS a reminder versus advertising
An operational message contains only information related to the booked appointment: date, time, location, service name, possibly a request to confirm attendance. Such an SMS is allowed without marketing consent because it serves the contract between you and the client.
A marketing message is any content that goes beyond appointment information and encourages purchasing, taking advantage of a promotional offer, or returning to the salon at another time.
The distinction is simple: if you remove everything except the date and time of the appointment and the message still makes sense — it's an operational SMS. If removing that information leaves the message empty — it's advertising.
How to obtain valid consent
Having consent in a form isn't enough. You must obtain consent in a way that's easy to prove in case of an audit. The Personal Data Protection Office (UODO) emphasizes that a request for consent in a statement concerning other matters must be clearly distinguished from other form elements — UODO RODO guide for schools. This means the checkbox "I agree to marketing messages" cannot be pre-checked or hidden in a long terms and conditions text.
In your booking form, it's worth separating two types of consent:
- Consent for operational messages: appointment reminders, confirmations, schedule change information. This consent usually stems from the booking itself and often doesn't require a separate checkbox.
- Consent for marketing messages: promotions, news, special offers. This consent must be explicit, voluntary, and separate.
Each consent must be withdrawable. A client has the right to withdraw consent at any time, and you must make it easy — preferably with an unsubscribe link in each marketing message or one click in the system (e.g., "No offers — unsubscribe"). Refusal shouldn't require the client to call the salon or send an email.
Legal requirements for consent content
Consent must meet the conditions specified in GDPR: be voluntary, specific, informed, and unambiguous. The data subject has the right to withdraw consent at any time. This means every marketing SMS must inform about the right to unsubscribe and provide an actual opportunity to opt out without contacting the salon. If you're wondering where your clients' data physically ends up once it leaves that consent checkbox, see Automation and GDPR: where your customer data physically ends up.
What isn't marketing
Not every message sent to a client is marketing. Operational messages that don't encourage purchasing are allowed without marketing consent. Here are examples of messages that don't require separate marketing consent:
- Reminder of a booked appointment with date and time
- Confirmation of a booked service
- Information about rescheduling an appointment at the salon's initiative (e.g., due to specialist illness)
- Reminder about completing payment for a previous appointment
- Thank you message after a visit with a review request (without promotional offer)
Practical divide: if a message only serves an already-booked appointment or reports its status, it usually isn't marketing yet; if it encourages using something the client didn't order, that's advertising requiring consent. An unusual, borderline case is best assessed by a lawyer or DPO.
Cases requiring legal assessment
Some situations may require individual assessment: whether a single message about a new service in response to a client question is marketing or a response to an inquiry. Doubtful cases are worth consulting with a DPO or lawyer to avoid violations.
Edge case: rescheduling at the client's request
Clients often ask to reschedule their appointment. You reply "OK, changing to Thursday at 4pm." Is this marketing? No. It's still an operational message related to contract performance. But if in the same message you add "By the way — we have an open slot for manicure on Thursday, which you get done rarely" — you're entering marketing territory and need consent. Whether a specific message is marketing — a lawyer or DPO will assess.
How to check if your SMS is legally compliant
Take any message template you use and ask yourself:
- Does the message contain only appointment-related information (date, time, service, location)?
- Does it encourage purchasing, taking advantage of an offer, or returning to the salon at another time?
- Has the client given separate consent to receive promotional content?
- Is there an unsubscribe link in every marketing SMS?
If you answered "yes" to question 2 but "no" to question 3 — you need to either remove the promotional element or obtain consent.
Implementation in a system: how it looks in practice
The correct process works like this: client books an appointment through your website, Booksy, or directly at the salon. At this point the system automatically sends a confirmation and asks for message consent — but separates reminders from offers.
The CRM or automatic messaging system should have two separate databases: one for clients who gave marketing consent, another for all booked clients (since appointment reminders can be sent to everyone). When you prepare a promotional campaign, you send SMS only to the first group. When an appointment approaches — reminder goes to both.
In the booking form, it looks like this:
- Field 1 (required): "I consent to processing my data for the purpose of delivering the booked service" — this is consent stemming from the booking itself.
- Field 2 (voluntary, unchecked by default): "I want to receive promotional offers and news from the salon" — this is marketing consent.
Every marketing message ends with something like: "Don't want offers? Unsubscribe with one click: [link]."
What the system does versus what you must do
Automatic messages sends confirmations, reminders and thank-you messages — always with the client's consent and an opt-out. You need to ensure your booking form contains proper checkboxes, that SMS content doesn't cross the line between reminder and advertising, and that unsubscribe is actually accessible with one click.
CRM and automations helps manage the client database with their consents and visit history. This way you know who gave consent for marketing and who only for reminders.
Booking Systems allow clients to book themselves — and during booking you can request marketing consent in a legally compliant way.
Guest Returns is a function that automatically reminds about returning — but sends such messages only to clients who gave consent for marketing.
AI Reports sum up leads, campaigns and sales every week in plain language, without counting anything by hand — see Reporting automation: how to set up numbers that the owner actually looks at for how that works.
Benefits of proper consent implementation
Implementing two separate consents and a proper marketing database provides concrete benefits: you avoid the risk of fines, build client trust (you don't send them unwanted messages), and simultaneously don't lose communication channels with people who actually want to receive offers. Your database of clients interested in marketing is smaller, but more engaged.
A smaller but more engaged marketing contact base is a result you notice only after some time, not right after setting up two separate consents. Even a small percentage of unsubscriptions due to unwanted SMS still translates to losing contacts that could generate revenue.
Read more about automation in the beauty industry in Hair salon automation: reservations, SMS and clients who return. Learn how booking systems and SMS can work together with the consent database.
If you're planning to introduce automation in your salon, check the costs in How much does process automation cost in a company?.
When to consult a lawyer about your consent form
If you're unsure whether your consent form complies with legal requirements — consider consulting a lawyer or DPO. It's particularly worth doing when your form contains more than two checkboxes, when you collect consent in non-standard ways (e.g., by phone or during the first visit), or when running promotional campaigns to thousands of clients simultaneously.
Frequently asked questions
Do I need separate consent for reminder SMS about appointments?
No. A reminder of a booked appointment is an operational message related to contract performance — it doesn't require marketing consent. Consent for "messages from the salon" in the sense of reminders stems from the booking itself.
Can I send promotions to clients who book through Booksy?
Yes, but only if they explicitly gave marketing consent in the Booksy form (or in an additional step after booking). Booking an appointment doesn't mean consent to receive promotional offers.
What if a client gave marketing consent but then unsubscribed?
From that moment on, you cannot send them promotional messages. The system should automatically remove them from the marketing list. Sending despite unsubscribe is a PKE violation and can result in a fine.
Is a thank you message after a visit with a review request marketing?
No, if it doesn't contain a purchase incentive. A simple message "Thank you for your visit! Please leave a review on Google" is operational. If you add "By the way — we're launching a new service next month, you'll be the first to know" — that's marketing. Whether a specific message is marketing — a lawyer or DPO will assess.
Is the 3% revenue penalty a real threat or just a theoretical rule?
It's a real penalty provided for in Art. 398(5) PKE. The President of the Electronic Communications Office (UKE) imposes it by decision, considering the nature and scope of the violation. For a small salon, the amount can range from several thousand to tens of thousands of złoty.
Do I need to hire a lawyer for a consent form?
Not always. If the form is simple and contains two separate, clearly labeled checkboxes (reminders and marketing), you can prepare it yourself. But if you're unsure — it's worth verifying with a DPO.