1-1 The eighth paragraph of Article Three of the Communications Law states that "the telecommunications sector shall be organized to protect the Public interest, the interests of users, and to maintain the confidentiality of communications and the security of information."

2-1 Article Eighteen (18) of the Law stipulates that: "Anyone wishing to provide telecommunications services – who meets the conditions – must submit a request to the Authority to obtain a License for that purpose, and the Authority shall issue the License in accordance with the provisions of the Law and its Regulations, and operators must comply with the conditions stated in the Licenses granted to them."

3-1 Article Thirty-Seven (37) of the Law includes that any operator, or individual with natural or legal status, who misuses telecommunications services, such as intentionally making a call that violates public morals, or has a threatening nature, or causes panic or disturbance, is considered in violation of the provisions of this Law.

4-1 Article Fifty-Eight (58) of the Implementing Regulation of the Law includes the obligations of service providers regarding the protection of users' personal information.

5-1 Based on the above, and due to the needs of the telecommunications sector; the Authority has worked through these controls to update its procedures aimed at reducing spam messages to include the application of new technical solutions to enhance the efficiency of providing telecommunications services to end users, thereby contributing to the reduction of spam messages.

The phrases and terms used in this document shall have the same meanings as those stated in the Communications Law and its Executive Regulations, and the following words and phrases shall have the meanings indicated next to them, unless the context requires otherwise:

• 1-2 "Electronic Address": Refers to an address through which communication can be made electronically, such as an email address or a mobile phone number.

• 2-2 "Electronic Message": Refers to a message sent using communication networks to an electronic address, such as email or short message service (SMS) or multimedia messaging service (MMS) or flash messages (FlashSMS) or fax, and this definition does not include voice calls.

• 3-2 "Intrusive Message": Refers to any electronic message sent without allowing the user to request to unsubscribe from it, using any electronic communication means, including, but not limited to, email, short message service (SMS), multimedia messaging service (MMS), flash messages (FlashSMS), and fax, excluding from this definition warning, awareness, and personal messages.

• 4-2 "Unsubscribe Request": Refers to a request from a recipient of an electronic message to the sender to stop sending any further electronic messages to their electronic address.

• 5-2 "Sender": Refers to the person who sends the electronic message.

• 6-2 "Recipient": Refers to the person to whom the electronic message is sent.

• 7-2 "Address Harvesting Programs": Refers to computer programs used to search the internet for electronic addresses and collect them.

• 8-2 "Random Attack" (Dictionary Attack): Refers to sending messages to electronic addresses obtained using automated methods, by combining names, letters, numbers, punctuation marks, or symbols.

• 9-2 "Warning Messages": High-priority short text messages (SMS) with warning content sent to the general public in all regions of the Kingdom or some of them, by the relevant government authorities to warn of an imminent event or one that has already occurred, provided that these messages are for individuals located in the danger area only.

• 10-2 "Awareness Messages": Electronic messages with awareness or guidance content sent to the general public (or specific categories of them) by entities with legal personality such as government authorities, banks, hospitals, universities, schools, associations, and others.

• 11-2 "Service Messages": Electronic messages with service content, sent to a specific user for the purpose of providing a contracted service or informing them of operations performed on that service or its features and options or providing a personal or automated notification such as appointments, or for electronic documentation to confirm their possession of the mobile number such as accessing websites or electronic programs, and this is done at the request or consent of the user.

• 12-2 "Personal Messages": Short text messages (SMS) directed from a specific user number to another specific user number.

• 13-2 "Promotional Messages": Electronic messages with a commercial or marketing nature for products or services or for fundraising or reminders thereof.

1-3 The sender of the promotional email must:

• A- include their email address in the email.

• B- allow the recipient to request to unsubscribe for free and in an easy manner.

• C- cease sending any further messages after receiving the unsubscribe request within a period not exceeding (24) hours from the receipt of the cancellation request.

• D- send a notification confirming the unsubscription after receiving such a request.

• E- not use Flash SMS messages.

2-3 The sender may not use random attack programs or address collection programs, nor may they use email addresses obtained through such programs.

3-3 The sender may not send intrusive messages.

1-4 Establish clear conditions in the service contracts concluded between telecommunications service providers themselves or between telecommunications service providers and electronic message senders that comply with these regulations and clarify the consequences of violating them. It should also include the possibility of canceling or suspending the service immediately upon violation.

2-4 Provide a prominent link on their website that offers information related to the regulations for limiting spam messages and how to comply with them, as well as the mechanisms available for users to limit spam messages.

3-4 Provide the Authority or any entity designated by the Authority with information related to spam messages at any time, including, but not limited to, providing information, conducting investigations, and technical intervention.

4-4 Take necessary measures to prevent IP Spoofing.

5-4 Take necessary measures to prevent the creation of email accounts with the service provider without human intervention from the account creator.

6-4 Take necessary measures to prevent impersonation of other personalities or entities that are not the actual identity of the sender in short messages.

7-4 Cooperate with other telecommunications service providers inside and outside the Kingdom and take necessary measures to limit spam messages transmitted through their networks.

8-4 Ensure the implementation of necessary procedures to prevent their networks from being used to send spam messages, monitor their networks to limit these messages, and take necessary preventive measures to eliminate them.

9-4 Commit to classifying short messages into five types, which are:

• A- Warning messages.

• B- Awareness messages.

• C- Service messages.

• D- Personal messages.

• E- Promotional messages.

10-4 The types of short messages in Article (9-4) shall be dealt with according to the following procedures:

• 1-10-4 Messages of types (A), (B), (C), and (D) are not subject to filtering by mobile telecommunications service providers.

• 2-10-4 Messages of types (A), (B), (C), and (D) must not contain any commercial or marketing content and must not promote any commercial products or services, nor aim for profit directly or indirectly, and must not collect donations or remind of them.

• 3-10-4 Messages of type (E) must be subject to filtering by mobile telecommunications service providers according to the details provided in paragraph (9-10-4) below.

• 4-10-4 Messages of type (E) must be sent through specific short codes, and no other type of messages may be sent through these codes.

• 5-10-4 The short message service provider must prepare a specific list of sender clients "Sender List" - updated continuously - and approved by mobile telecommunications service providers, so that these names are used in the sender name field (Tag Name) for short messages. Mobile telecommunications service providers must maintain a record that includes complete information about each name on the list, the entity to which the name belongs, and the contact person at the entity to provide it to the Authority upon request.

• 6-10-4 All messages of types (A), (B), (C), and (E) must be sent through the approved sender list of mobile telecommunications service providers.

• 7-10-4 The sender name (Tag Name) of type (E) messages must include the suffix (AD-) after the name of the sending entity to indicate the nature of its advertising content, such as (XXXX-AD ), except for interactive messages (the sender name is a group of numbers) when including the following text in the message: "This message is promotional and can be stopped from being received".

• 8-10-4 Sending messages of types (B) and (E) is prohibited from 10 PM to 8 AM.

• 9-10-4 Provide a free filtering service from mobile telecommunications service providers for users via short text messages that enables them to prevent receiving unwanted messages of type (E), provided that the service includes the following:

  • • A short number dedicated to automated command messages for the filtering service.

  • • Providing each user with the option to block or lift the block on receiving messages of type (E) from all senders of that type at once according to the user's preference.

  • • Providing each user with the option to block or lift the block on receiving messages of type (E) from specific sender names (Tag Names) according to the user's preference.

• For further clarification regarding the mechanism for dealing with types of text messages and the filtering system, please refer to the explanatory diagram number (Error!  Reference source not found).

1-5 These regulations apply to electronic messages sent from within the Kingdom.

2-5 The Authority shall monitor compliance with these regulations and take the necessary procedures against violators in accordance with its systems.

3-5 These regulations replace the regulations for limiting unsolicited messages issued by Decision No. 1431/259 dated 12/4/1431 H, and the procedures for limiting unsolicited messages communicated to service providers on 25/5/1439 H.