This is spelled out in the GOF guidelines for direct operator billing services.
Some key points:
Before an end user can finish a purchase of subscribed or adult content, the service provider must ask the end user to confirm that they are at least 18 years old.
The SMS product or service must be clearly described for the end user on the bill.
Personal data about the end user may only be handed over from the telecom operator to the service provider (CM in this case) if that is necessary in order to deliver the product/service the end user has requested.