CentriWebIn New Zealand, marketing emails and texts are covered by the Unsolicited Electronic Messages Act 2007, which the Department of Internal Affairs (DIA) enforces. Every commercial message needs three things: the recipient’s consent, accurate details of who sent it, and a free, working way to unsubscribe. Once someone unsubscribes, their consent is treated as withdrawn five working days later, so your system needs to act within that window.
This guide explains the rules in plain English for NZ businesses, works through everyday situations, and covers the differences if you also market to Australians. It’s general information, not legal advice. The Act itself and DIA’s guidance for businesses are the sources to check.
What counts as a commercial message
Under section 6 of the Act, a commercial electronic message is one that markets or promotes goods, services, land or an interest in land, or a business or investment opportunity, or links to something that does. DIA’s guidance makes a few points owners often miss:
- It covers email, text messages, instant messages and fax. Phone calls and website pop-ups aren’t covered.
- A single message counts. It doesn’t need to be a bulk send.
- A link to your website in an email signature can make an otherwise ordinary email commercial.
Messages to businesses are covered too. The Act’s test for a New Zealand link includes organisations that carry on business in New Zealand, not just individuals.
Messages that aren’t commercial
Section 6 also lists messages that are not commercial electronic messages, so the consent, identification and unsubscribe rules don’t apply to them. They include messages that:
- provide a quote or estimate the recipient asked for
- facilitate, complete or confirm a transaction the recipient already agreed to, like an order confirmation or receipt
- give warranty, product recall, safety or security information about something they bought or use
- give factual information about an ongoing subscription, membership or account
- deliver goods or services they’re entitled to under an earlier transaction
The catch is mixing. A booking confirmation with a promotion added to the bottom is no longer purely factual. Keep service messages and marketing separate.
Consent: express, inferred and deemed
You need consent before sending a commercial message. Section 4 of the Act recognises three kinds.
Express consent
The person actively agrees, for example by ticking a box on your website, replying YES, or telling you in person. DIA says verbal consent is acceptable but you should keep a record, because the Act puts the onus of proving consent on the sender.
Inferred consent
Consent that can reasonably be inferred from the conduct and the business and other relationships of the people involved. This is narrower than many businesses assume. DIA’s FAQ says a single transaction doesn’t support ongoing marketing, whether it’s one year or five years later, and that one purchase doesn’t justify sending a satisfaction survey either. Where someone cancels a membership or unsubscribes, DIA says you need fresh consent before sending more commercial messages.
Deemed consent
Deemed consent applies when a business or work address has been conspicuously published, for example on a company website or in a trade directory, there’s no statement saying they don’t want unsolicited messages, and your message is relevant to the person’s business role. It doesn’t cover personal addresses, and it doesn’t cover messages unrelated to their work.
Identifying yourself and the unsubscribe
Section 10 says every commercial message must clearly and accurately identify the person who authorised it and include accurate information about how to contact them, and that information should stay valid for at least 30 days. For texts, DIA accepts an abbreviated business name if it clearly identifies you, but contact details still need to be there.
Section 11 sets out the unsubscribe rules. The facility must:
- be clear and conspicuous
- let the person respond using the same method the message came by, so a text needs a text-based opt-out, not just an email address
- cost the recipient nothing
- keep working for at least 30 days after the message is sent
Section 9 says that once someone uses the unsubscribe facility, their consent is withdrawn from the day that is five working days after they used it. DIA’s FAQ adds that the clock starts the day after the request. A “thanks, you’ve been unsubscribed” confirmation is fine inside that window. More marketing after it isn’t. DIA’s unsubscribe page sets out when recipients can complain.
Penalties
DIA’s enforcement page describes responses ranging from a formal warning to High Court action. Under section 45 of the Act, a court can order a pecuniary penalty of up to $200,000 for an individual and up to $500,000 for an organisation. The Act also provides for civil infringement notices and enforceable undertakings.
Everyday examples
A customer you did one job for last year
A single job is a weak basis for inferred consent, according to DIA. You can still send factual messages about that job, like warranty information. For promotions, ask for express consent, ideally next time you’re in touch about something else. DIA’s FAQ says an order confirmation can invite customers to join your mailing list.
Someone who asked for a quote
The quote they asked for isn’t a commercial message under section 6, so you can send it. Moving them onto your newsletter or promotions list is different. DIA says you can’t use an address from a single enquiry for promotions, and suggests using your reply to ask for express consent.
Business cards from a trade show
DIA’s view is that swapping cards can support inferred consent for messages tied to that meeting and that business relationship. It’s unlikely to cover unrelated promotions. A card someone else passed you doesn’t give you consent to email that person, though DIA says phoning to ask is fine.
An email address on a company’s website
Deemed consent may apply if the address is conspicuously published, there’s no “no unsolicited messages” statement, and your message is relevant to their role. A generic promotion sent to every published address you can find won’t meet that test.
A bought or borrowed list
The people on it haven’t consented to hear from you, and DIA says consent can’t come from a referral the recipient didn’t know about or agree to. The Act also restricts using address-harvesting software and harvested-address lists. Don’t use them.
Emailing your list to “unsubscribe if you don’t want these”
DIA says silence isn’t consent. A message telling people to opt out if they object doesn’t create consent for future marketing.
If you market in both New Zealand and Australia
DIA’s FAQ says the NZ Act is based on Australia’s Spam Act 2003 but is simpler, with fewer specific exceptions. The basics line up: consent, identify yourself, include a working unsubscribe, and honour opt-outs within five working days. Our guide to Australia’s SMS marketing rules covers the Australian side.
| Topic | New Zealand | Australia |
|---|---|---|
| Law and regulator | Unsolicited Electronic Messages Act 2007, DIA | Spam Act 2003, ACMA |
| Core rules | Consent, sender details, functional unsubscribe | Consent, sender details, functional unsubscribe |
| Unsubscribe timing | Consent withdrawn 5 working days after the request | Requests honoured within 5 working days |
| When the law applies | The message has a “New Zealand link” | The message has an “Australian link” |
The NZ Act applies when a message has a New Zealand link, which includes messages sent from New Zealand, accessed by someone in New Zealand, or sent to a .nz address or +64 number. So an Australian business texting customers in Auckland is covered by the NZ Act, and an NZ business emailing customers in Brisbane needs to check ACMA’s spam guidance as well. The detail differs, so don’t assume a rule from one country carries over word for word.
Separately, how you collect and store contact details falls under the Privacy Act 2020. The Privacy Commissioner’s privacy principles explain what that means.
Setting up your CRM to stay on the right side
Most breaches aren’t deliberate. They happen because consent lives in someone’s head and unsubscribes are handled by hand. A properly configured CRM takes most of that risk away, and these are the pieces we build in during a CRM setup:
- Separate consent fields for email and text, each with the date, source and the wording the person agreed to.
- Automatic unsubscribes, so a STOP reply or unsubscribe click updates the contact and removes them from every marketing sequence straight away, well inside five working days.
- Split templates, with confirmations, reminders and quotes kept free of promotional content.
- A default filter so campaigns only go to contacts with consent recorded and no opt-out.
- Sender details in every template, with a business name and contact method people recognise.
- Double opt-in for website sign-ups, which DIA recommends to stop people signing up someone else.
Getting the technical side right also matters for delivery. Our guide on why business emails go to spam covers authentication and sender reputation.
Where to start
- List every type of message you send and mark each one as factual or commercial.
- Add an unticked consent box for email and text to every form and booking flow.
- Check every commercial template has your business name, contact details and a free unsubscribe that works by the same channel.
- Test your unsubscribe: reply STOP to your own campaign and confirm you drop off every list.
- Remove contacts you can’t show consent for from your marketing lists.
A smaller list of people who said yes is worth more than a big list of people who didn’t. If you’d like help setting up consent tracking and compliant campaigns across New Zealand and Australia, that’s part of our marketing work.