Three Standards, Three Problems
The GSMA has published three major eSIM remote provisioning specifications, each responding to a specific industry need at a specific moment in time.
SGP.02 – Built for Automotive M2M (2014)
SGP.02 was designed primarily for the automotive industry, which needed to embed SIM connectivity into vehicles for multiple global markets. It worked adequately for automotive – high-value devices with always-on connectivity. But for the coming wave of low-cost IoT devices, it was already the wrong answer.
Where SGP.02 Failed IoT
- SM-SR infrastructure is expensive and complex, limiting the ecosystem to large operators
- Devices are locked to the SM-SR provider, creating vendor and operator lock-in
- No support for constrained networks – assumes reliable HTTPS connectivity
- Binary SMS was used to trigger device activation, adding complexity and cost
SGP.22 – Built for Consumer Devices (2016)
SGP.22 brought eSIM to smartphones and tablets. The Local Profile Assistant model allowed users to download profiles using QR codes or operator apps. The SM-DP+ server introduced in SGP.22 is widely deployed and forms the basis of the infrastructure SGP.32 reuses.
Where SGP.22 Failed IoT
- Every profile change requires a user action – QR code, activation code or app
- No mechanism for server-initiated or bulk fleet management natively
- HTTPS-only provisioning is impractical for NB-IoT and LTE-M devices
- LPA assumes a display and user interaction that most IoT devices do not have
SGP.32 – Built for IoT (2023)
SGP.32 takes the SGP.22 SM-DP+ infrastructure and adds a server-initiated management model designed for IoT realities. The eIM replaces the SM-SR. The IPA replaces the LPA. CoAP replaces the mandatory HTTPS dependency.
| Feature | SGP.02 | SGP.22 | SGP.32 |
|---|---|---|---|
| Designed for | M2M / Automotive | Consumer | IoT |
| Profile trigger | SM-SR (server) | User / LPA | eIM (server) |
| User interaction required | No | Yes | No |
| Server-initiated management | Limited | No | Yes |
| Transport protocol | HTTPS | HTTPS | CoAP / HTTPS |
| NB-IoT viable | Marginal | No | Yes |
| Fleet management at scale | Complex | No | Yes |
| Asynchronous operations | No | No | Yes |
| Operator lock-in risk | High | Low | Low |
Which Standard Should You Use?
For new IoT hardware designs in 2025 and beyond, SGP.32 is the right foundation. It is the only standard designed for the operational realities of IoT – constrained networks, no user interfaces, fleet-scale management, and device lifetimes measured in decades.
SGP.22 remains appropriate for devices with users, or where a management layer like Teltonika RMS delivers comparable fleet management on top. SGP.02 has a long tail in automotive and legacy M2M but is not recommended for new IoT designs.
See the eSIM Hardware Guide for a review of available hardware supporting each standard.