OTP Verification Across the UK and EU: Formats, GDPR and Best Practice
Mobile formats from +44 to +48, how PSD2 shapes SMS codes, what GDPR means for phone numbers, and how to test European signup flows efficiently.
OTP Bolt Team · · 7 min read
Europe is a patchwork of 40-plus numbering plans, languages and carrier rules, held together by two big regulations: GDPR for personal data and PSD2 for payments. If you build or test signup flows for European users, here's what changes from country to country — and what stays the same.
Mobile formats at a glance
| Country | Code | Mobile pattern |
|---|---|---|
| United Kingdom | +44 | 7XXX XXXXXX (drop the leading 0) |
| Germany | +49 | 15X / 16X / 17X + 7–8 digits |
| France | +33 | 6 or 7 + 8 digits |
| Spain | +34 | 6XX or 7XX + 6 digits |
| Italy | +39 | 3XX + 6–7 digits |
| Netherlands | +31 | 6 + 8 digits |
| Poland | +48 | 9 digits |
The most common bug we see in European flows is leading-zero handling: users type 07700 900123 and the form either rejects it or sends to +4407700900123. Normalise to E.164 by stripping the national trunk prefix.
PSD2 and strong customer authentication
Under PSD2, online payments and account access at banks and payment providers require two independent factors. An SMS code counts as a possession factor. Banks increasingly prefer in-app approvals, but SMS remains the fallback across the EU and UK. The code must be bound to the specific transaction (amount and payee), which is why payment OTP messages include those details.
For testers: payment and banking flows should always be tested on real SIMs and real accounts in the provider's sandbox, never with rented numbers.
GDPR: phone numbers are personal data
A phone number identifies a person, so under GDPR (and the UK GDPR) it's personal data. For teams that collect numbers this means:
- a lawful basis for processing — usually contract for account security;
- data minimisation — only ask for a number when you need it;
- retention limits — delete numbers you no longer need;
- honouring access and erasure requests.
For people who give their number to services, it means you're entitled to know how it's used — and you may prefer not to hand your personal number to every trial or newsletter. A temporary number for one-off signups is a practical privacy measure.
Sender IDs and delivery
Many European countries allow alphanumeric sender IDs ("ACME"), but rules vary: some require pre-registration, others replace unregistered IDs with a numeric sender. If your brand name disappears from codes in one country, check its sender-ID regime. Delivery speed across the EU is generally excellent — often under ten seconds on direct routes.
Language and character sets
A code message in Polish, Czech or Greek may contain characters outside GSM-7, switching the SMS to UCS-2 encoding and cutting the single-segment limit from 160 to 70 characters. Keep localised OTP templates short so they stay in one segment and arrive as one message.
Testing European flows efficiently
- Pick your core markets (often UK, Germany, France, Spain, Italy) and test them every release.
- Rent temporary numbers per country in OTP Bolt — prices and stock are shown before you pay, and silent rentals refund automatically.
- Test format variants: with
+, with00, with the national0. - Check that localised templates render correctly and fit in one segment.
- Automate with the REST API using ISO country ids such as
gb,de,fr.
Summary
- Normalise every European number to E.164 — leading-zero bugs are the #1 failure.
- PSD2 makes SMS a possession factor for payments; test those flows only in official sandboxes.
- GDPR treats phone numbers as personal data — collect less, keep it shorter.
- Short, single-segment, localised templates deliver best.