Direct Marketing (CPA + POPIA)
Also known as: Unsolicited Marketing, Electronic Marketing, Section 69 Direct Marketing.
What is Direct Marketing?
Direct marketing is the approach of a consumer, personally or by post, email, SMS or telephone, for the direct or indirect purpose of promoting goods or services or requesting a donation. Under the CPA and POPIA it is subject to opt-out and opt-in rules respectively, with electronic direct marketing requiring prior written consent.
Drafted and reviewed by
Attorney & Founder, My-Contracts.co.za · Legal Practice Council of South Africa (LPC F17333)
Definition and context
"Direct marketing" is defined almost identically in section 1 of the Consumer Protection Act 68 of 2008 (CPA) and section 1 of the Protection of Personal Information Act 4 of 2013 (POPIA) as any approach to a person, in person or by mail or electronic communication, to promote or sell goods or services or to request a donation. The two statutes impose different consent regimes. The CPA operates on an opt-out model: a consumer may pre-emptively block direct marketing via the national Opt-Out Register under section 11 and may at any time demand that a supplier desist. POPIA imposes a stricter opt-in regime for direct marketing by unsolicited electronic communication under section 69.
Section 69 of POPIA prohibits the processing of personal information for the purpose of direct marketing by electronic communication (email, SMS, automated call) unless the data subject has given prior consent in prescribed Form 4, or is an existing customer whose contact details were obtained in the context of a sale of similar products and who was given a reasonable opportunity to object at the point of collection. The practical effect is that cold electronic direct marketing requires a signed Form 4 opt-in; customer-base marketing can rely on the "similar products" exception provided opt-out was offered at every touchpoint.
Non-compliance carries layered exposure: the CPA permits Commission fines; POPIA permits Information Regulator enforcement notices and administrative fines of up to R10 million; and section 99 of POPIA recognises a private right of action for data subjects. Operationally, marketers must maintain auditable consent records, honour unsubscribe requests without charge, and identify the sender and a valid opt-out mechanism in every electronic message. Telemarketing and door-to-door marketing are additionally restricted by CPA regulations on permitted days and hours.
Where this term lives in law
Consumer Protection Act 68 of 2008
Sections: 1, 11, 12, 32
Protects consumer rights in transactions for goods and services within South Africa.
Protection of Personal Information Act 4 of 2013
Sections: 1, 11, 69
Regulates the processing of personal information by public and private bodies in South Africa.
Frequently asked questions
Do I need opt-in or opt-out consent for email marketing?
For electronic direct marketing to non-customers, POPIA section 69 requires prior opt-in consent in Form 4. For existing customers acquired during a sale of similar goods, you may rely on an opt-out mechanism, provided opt-out was offered at collection and in every message.
Is a single B2B cold email covered?
Yes. Section 69 applies to any direct marketing to a data subject. Where the recipient is a juristic person the protections still apply because POPIA protects juristic persons' personal information.
What must every direct-marketing message contain?
The sender's identity, a valid contact address, a free opt-out mechanism, and the purpose of the communication. ECTA section 45 adds that opt-out requests must be honoured without cost to the recipient.
What does the CPA Opt-Out Register do?
Section 11 of the CPA establishes a national register administered by the Commission. Consumers who register may pre-emptively refuse all direct marketing. Suppliers must check the register before a campaign or face CPA sanction.
Can I send a "please opt in" email to my existing list?
Only if the existing list was built on a lawful basis that permits further processing. A re-permissioning email is widely treated by the Information Regulator as itself a direct-marketing communication requiring existing opt-in.
Contract templates using this term
2 templates reference Direct Marketing (CPA + POPIA).