"Stop" now has to mean stop: Oman hands the phone back to its owner

Muscat — For years, asking a company to stop texting you in the Gulf has been a request rather than an instruction. A new regulation from Oman's Telecommunications Regulatory Authority changes that, and it does something no Gulf market has done at national scale before: it puts an advertising label on the sender field of every marketing message before you open it.

The regulation on promotional and service calls, text messages and value-added services was published in Official Gazette issue 1661, signed by Eng. Said bin Hamoud bin Said Al Maawali, Minister of Transport, Communications and Information Technology and Chairman of the TRA Board. It was issued on 12 August 2026, takes effect the day after publication, and gives every company it touches six months to comply, which places the real deadline in the opening weeks of 2027.

The centre of gravity is the opt-out. Under the new rules, operators are not merely required to offer a way to stop promotional calls and messages. They are required to make it work. The mechanism has to follow a procedure approved by the Authority, has to be clearly signposted on the operator's website and app, and has to let a user block everything or pick and choose which senders and short codes to silence. Once a request is made, the operator has to execute it and confirm back to the user that the traffic has actually stopped. If messages keep arriving anyway, the operator must provide a channel for the user to report that. And if the user changes their mind later, there has to be a way to switch a particular sender, or all of them, back on.

The most demanding piece of this sits in a single line. Operators are required to build a unified database together, so that an opt-out registered with one network holds across all of them. Today a customer who blocks a marketer on one operator can find the same marketer reaching them through another. That gap is what the shared database is meant to close, and it is the provision most likely to determine whether the whole regulation succeeds.

Alongside the off switch, the regulation sets working hours for marketing. Promotional messages and calls are confined to the window between eight in the morning and nine at night, Oman time, with a narrow allowance for messages that were sent inside the window and arrived late for technical reasons. Anything outside that window is a violation.

Then there is the labelling rule, which is the change users will notice first. Any sender name used for a promotional message must begin with the letters AD. Marketing arrives pre-declared as marketing. Beyond that, sender names can no longer be generic or invented: they have to match the registered commercial or legal name of the company behind them, and the company has to hand over its commercial registration, state in writing what it intends to use the service for, and confirm the physical location of the systems it sends from.

Calls get comparable treatment. Promotional, service, value-added and automated calls all have to display the caller's name on the recipient's screen, showing the registered name of the business rather than an anonymous number. Using a number registered in an individual's name to make these calls is prohibited outright, and an operator that receives complaints, or detects the practice through its own systems, has to suspend the service. A company that signed up to send service notifications cannot quietly start using the same channel to sell.

Personal data is fenced in as well. An operator cannot pass user data to a bulk messaging reseller, an international routing partner, or a local or international client without the Authority's approval, and is obliged to put the software, systems and technology in place to protect it.

Fraud is handled as an engineering problem rather than a complaints problem. Operators are required to build systems capable of recognising fraudulent and intrusive calls and messages in advance and blocking them before they reach anyone, whether the traffic originates inside Oman or abroad. They have to monitor usage behaviour to catch fraud patterns early, share fraud data with each other through a common database, cooperate with operators and regulators outside the country, and give users a single approved way to report what does get through. There is also a rule that closes one of the most common routes for brand impersonation in the region: a message carrying a local company's sender name can no longer be routed into Oman through an international intermediary.

None of this is advisory. Failing to honour opt-out requests carries a fine of five to fifteen thousand Omani rials. Breaking the time window or falling short on fraud prevention carries five to ten thousand. Breaching the caller display and personal-number rules carries one to five thousand. The Authority can double any of these if the same violation happens again within a year, on top of the enforcement measures already available to it under the telecommunications law.

There is a quieter decision that arrived at the same time and says more than the fines do. A companion order amended Oman's consumer rights regulation to delete its definition of spam and its entire chapter on intrusive and advertising messages. Read alone, that looks like protection being removed. Read together with the new regulation, it is protection being relocated. The rules that used to sit in a consumer-rights document, where they functioned mainly as grounds for complaint after the fact, now sit inside a licensing instrument that governs who is allowed to send bulk messages in the first place, on what terms, and through which routes.

Gulf ICT's takeaway

We think the shift in where these rules live matters more than the rules themselves. A right to be left alone that exists in a consumer charter is something you invoke after you have already been disturbed. A right built into the licensing conditions of the companies that carry the traffic is something that operates before the message is sent. Oman has moved from the first model to the second, and the AD prefix will make the difference visible in a way regulation rarely is.

What is still missing is the answer to the hardest question the regulation asks. A shared opt-out database across competing operators needs someone to own it, a standard to exchange data by, and a way to resolve disputes when one network's list disagrees with another's. The text sets the obligation without naming the mechanism. Every regulator in the Gulf that has reached for a cross-network do-not-disturb registry has found that the mandate is the easy part. Oman has six months to work out the rest, and that is what will decide whether this becomes the regional template or a well-written document waiting on plumbing that never quite arrived.