Most founders I talk to about the Unsolicited Electronic Messages Act NZ are sitting on a database they have never worked, and the reason they give is almost always the same. They heard somewhere that texting old customers is illegal now. So the list sits there, ageing, while they spend money on ads to find people they already know.
The law is narrower and more practical than the rumour suggests. It does not ban marketing by email or SMS. It bans three specific behaviours, and if you avoid those three, you can automate a surprising amount.
This post walks through what the Act actually requires, the three types of consent and which one your automation can safely run on, what you can and cannot turn on, and how to build the compliance into the system so nobody has to remember it.
I am not a lawyer. This is how I build systems, not legal advice.
Key Takeaways
- The Unsolicited Electronic Messages Act NZ governs every commercial email, SMS and instant message with a New Zealand link.
- Three rules cover almost everything: you need consent, you must identify yourself accurately, and you must offer a working unsubscribe.
- Consent comes in three forms: express, inferred and deemed, and only one of them is safe to build automation on at scale.
- Unsubscribe requests must be actioned within five working days, and the unsubscribe facility has to work for at least 30 days.
- Penalties run to $200,000 for an individual and $500,000 for an organisation, enforced by the Department of Internal Affairs.
- Reactivating your own opt-in database is legal and profitable. One finance client recovered $49,000 from 319 dormant contacts.
- Buying a list and texting it is the fastest way to a formal warning, no matter how good the automation behind it is.
- Compliance holds when it lives in the system, not in someone’s memory: one suppression list, timestamped consent, a full message log.
What the Unsolicited Electronic Messages Act NZ Actually Requires
The Act came into force in September 2007 and is enforced by the Department of Internal Affairs. You can read the full text on the legislation site and the DIA’s plain-English guidance here. Both are worth twenty minutes of your time if you send anything at volume.
It applies to commercial electronic messages with a New Zealand link. In practice, that means a message sent from New Zealand, or a message sent to someone in New Zealand, which covers almost everything a local business does. It does not matter where your sending platform is hosted.
A commercial electronic message is one that markets or promotes goods, services, land, or a business or investment opportunity. Email counts. SMS counts. Instant messaging counts. Voice calls and faxes sit outside the Act and are governed by different rules, which is worth knowing if you run phone follow-up alongside your text follow-up.
The three obligations
Everything in the Act reduces to three things.
One, you need consent. The recipient has to have agreed to receive the message, either directly or through one of the two indirect routes I cover in the next section.
Two, you have to identify yourself accurately. The message must clearly say who is sending it, on whose behalf, and include contact details that stay valid for at least 30 days after you send it. No spoofed sender names. No “Your Account Team” with no company attached. If someone replies to the number or address you sent from, a real person or system at your business needs to receive it.
Three, you have to offer a functional unsubscribe. Every commercial message needs a clear way out. The mechanism has to be free, or close to it, and it has to keep working for at least 30 days from the send date. Once someone opts out, you have five working days to action it. Not five working days to think about it. Five working days until you stop.
What is not a commercial electronic message
This is the part most people miss, and it changes what you can automate. Messages that are purely factual and transactional generally fall outside the Act. Order confirmations, delivery notifications, appointment reminders, account statements, warranty and safety information, product recalls. These are not marketing, so the consent and unsubscribe machinery does not apply in the same way.
The catch is that the moment you staple an offer onto a transactional message, the whole message can become commercial. An appointment reminder is factual. An appointment reminder that finishes with “and book your next clean now, 20% off” is marketing, and now it needs to meet all three obligations.
Address harvesting is a separate offence
Part 3 of the Act deals with address-harvesting software and harvested-address lists. Using them, supplying them, or acquiring them is an offence in its own right, regardless of whether you ever send a message. If a vendor offers you 40,000 New Zealand business emails scraped from websites, that list is not a growth opportunity. It is evidence.
The Three Types of Consent, and Which One to Build On
Consent is where compliance is either won or lost, and the Act recognises three flavours of it. Understanding the difference is the difference between an automation you can run for years and one that gets you a call from Internal Affairs.
Express consent
Someone said yes. They ticked a box, filled in a form, gave you their number at the counter and agreed to updates, or replied to a message asking for permission. This is the strongest form, and it is the one worth designing your entire business around.
Express consent is also the easiest to prove, which matters more than most founders realise. If a complaint lands, the burden is on you to show you had permission. “I’m pretty sure they signed up” is not a defence. A timestamped record showing the date, the source, the IP address or the staff member who took it, and the wording they agreed to, is.
Inferred consent
Consent can be reasonably inferred from an existing business relationship and the conduct of the parties. A customer who bought from you last month, gave you their email at the till, and would obviously expect to hear from you about the thing they bought. That is inferred consent.
It is real, and it is useful, but it has a shelf life nobody can tell you exactly. A customer from six weeks ago is a reasonable inference. A customer from 2019 who bought once and never came back is a much weaker one. The further you get from the transaction, the harder the inference is to argue.
Deemed consent
This is the one that gets misused. If someone has conspicuously published their work address, has not attached a statement saying they do not want unsolicited commercial messages, and your message is directly relevant to their role, functions or duties, consent can be deemed.
The trap is in the last part. Relevance to their role is a genuine test, not a formality. Emailing an accountant at a published firm address about accounting software has a case. Texting the same person about your landscaping service does not, because mowing lawns has nothing to do with their professional duties. Deemed consent is also close to useless for SMS, because almost nobody conspicuously publishes a mobile number in a role capacity.
The practical rule I use
Build on express consent. Treat inferred consent as something you can lean on for recent customers and warm enquiries, and treat deemed consent as a narrow, business-to-business, email-only tool that you use carefully and rarely.
This is not just risk management. Express consent performs better. A list of people who asked to hear from you converts at a rate that a scraped list will never approach, which is the whole argument for reactivating your own database rather than buying someone else’s.
What You Can Automate Under the Unsolicited Electronic Messages Act NZ
Here is the part nobody writes about, because compliance content is mostly written by people who do not build the systems. Within these rules, the automation surface is large.
Inbound lead response
Someone fills in your form, requests a quote, or messages your Facebook page. They initiated contact and asked to be contacted back. Consent is about as clear as it gets, and a reply within 90 seconds is legal, expected, and the single highest-return automation most businesses can install. First responder wins roughly 78% of the time, and most businesses take four hours or more.
Automate the acknowledgement, the qualifying questions, the booking link, and the follow-up ladder. Keep the sender identification accurate and give them an out, and you are on solid ground.
Reactivation of your own opt-in database
This is the one people are most afraid of, and it is usually the safest large opportunity in the building. Contacts who bought from you, enquired with you, or signed up with you, and who have not opted out, can be re-engaged. Handle the older end of the list more carefully, lead with something genuinely useful rather than a hard pitch, and make the exit obvious.
One of my clients in finance had 319 dormant contacts his team had written off entirely. A multi-touch SMS and email sequence, running on his own opt-in data, recovered $49,000. No ad spend. No new leads. Just a list that had been sitting there going cold while the business paid to acquire strangers.
Appointment reminders, confirmations and no-show recovery
Factual, transactional, expected, and one of the highest-value automations for any business that books time. Reminders reduce no-shows, confirmations reduce phone traffic, and a polite rebooking message after a missed appointment recovers revenue that otherwise evaporates. Keep the marketing out of these, and they stay transactional. See how this sits alongside after-hours call handling if your phone is the main booking channel.
Review and feedback requests
A request for feedback from a customer you just served is generally not promotional. It sits in the same territory as transactional messaging. If you add an offer to the same message, it is no longer transactional, so keep the two separate.
Two-way conversational follow-up
This is where AI actually earns its place. Instead of a broadcast, the system holds a real conversation over SMS, answers questions, handles objections, and books the appointment. It reads as a person because it behaves like one, and it runs at three in the afternoon and eleven at night without anyone rostered on.
The standard I hold every one of these to: the assistant has a name, it discloses that it is an AI if asked directly, and a plain-language opt-out works at any point in the conversation, not just a keyword buried in the first message.
What you cannot automate
Purchased lists. Scraped lists. Anything from a vendor who cannot tell you where each record came from and when the person agreed. Cold SMS to mobile numbers you were not given directly. Messages with a sender name that does not match the business actually sending them. Any sequence where the unsubscribe is a dead link or a reply-to address nobody monitors.
Automation makes every one of these worse, not better, because scale turns a judgement error into a pattern. The Act’s penalties reflect that: up to $200,000 for an individual and up to $500,000 for an organisation, on top of formal warnings, enforceable undertakings and compensation orders.
Build the Compliance Into the System, Not Into Someone’s Memory
Every compliance failure I have seen in a small business came from the same root cause. The rule existed, someone knew it, and the system did not enforce it. Then that person went on leave, got busy, or a new staff member ran the campaign from a different tool.
The fix is structural. Compliance that depends on a human remembering is not compliance. It is luck with a policy document attached.
One suppression list, every channel
When someone opts out of your SMS, they should stop receiving your email too, unless they explicitly said otherwise. Legally, you can argue the channels are separate. Practically, a customer who told you to stop and then got an email from you the following week is a complaint waiting to be filed. Keep one master suppression record and check it before every send, from every system.
This gets harder the more tools you run. If your email platform, your booking system, and your text follow-up all keep their own lists, you have three chances to get it wrong. One record, read by everything, removes the problem entirely.
Timestamped consent on every record
Every contact should carry the date consent was given, the source, and the exact wording they agreed to. Not because it is satisfying to file, but because it is the only thing that answers a complaint. When Internal Affairs asks how you got the number, you want to hand over a record, not a story.
Automatic action on opt-out
Five working days is the legal limit. The right number is seconds. An automated suppression on receipt of STOP, unsubscribe, or any plain-language variant means you never rely on someone clearing an inbox. Build it so the system catches “please stop texting me” as well as the keyword, because real people do not read the instructions.
A full message log
Every message sent, to whom, when, from which system, with which content. This is the audit trail. It is also how you find out that a sequence has been quietly running to a segment nobody meant to include.
Sender identification in the template, not the writer’s hands
Your business name, a real contact route, and a working opt-out belong in the message template, applied automatically, not typed by whoever wrote that campaign. Templates enforce. People forget.
The relationship to the Privacy Act 2020
The Unsolicited Electronic Messages Act governs sending. The Privacy Act 2020 governs how you collect, store and use the personal information behind it, including telling people why you are collecting their details at the point of collection. They work together. A sign-up form that meets the Act’s consent standard but says nothing about what you will do with the data has solved half the problem.
If you are sending across the Tasman as well, Australia has its own regime under the Spam Act 2003 with similar bones and different details, which is worth mapping before you run the same sequences into an Australian audience.
Where This Actually Breaks Down in Practice
The Act is not the hard part. The hard part is that most businesses have no single place where customer contact lives, so consent, opt-outs and history are scattered across a booking system, an email tool, a spreadsheet, someone’s phone, and the memory of whoever has been there longest.
That is not a compliance problem. That is a systems problem showing up as a compliance problem, and it is the same root cause behind slow lead response, missed follow-up, and the admin load that eats a founder’s week.
When contact data sits in one place, with consent recorded, suppression shared, and every message logged, compliance stops being a thing you worry about and becomes a property of the system. You can then automate aggressively, because the guardrails are structural rather than procedural.
That is the order of operations I would push on anyone: fix the data layer, then automate. Doing it the other way round means building fast follow-up on top of a list you cannot account for, which is exactly how businesses end up with a formal warning and a very awkward internal review.
The Bottom Line
The Unsolicited Electronic Messages Act NZ is not the barrier most founders think it is. Consent, honest identification, a working way out. Get those three right, and you can automate lead response, database reactivation, appointment reminders, no-show recovery, review requests and two-way conversational follow-up, all of it running without anyone at a desk.
What you cannot do is buy your way around the consent requirement. There is no automation clever enough to make a scraped list legal, and no volume of sends that beats a smaller list of people who actually asked.
The real opportunity is almost always sitting in your own database already. People who know you, bought from you, and have not heard from you in eighteen months. The Act lets you talk to them. Most businesses just never build the system that does it consistently.
Take the Next Step
If you are looking at a list you have never worked and you are not sure what is safe to send, that is a 30-minute conversation, not a research project.
Book a discovery call, and I will walk through what is in your database, what consent you can evidence, and which follow-up you could turn on this month without taking on risk. No pitch deck, no obligation.
Frequently Asked Questions
Does the Unsolicited Electronic Messages Act apply to SMS as well as email?
Yes. The Act covers commercial electronic messages sent by email, SMS, MMS and instant messaging where there is a New Zealand link. The same three obligations apply across all of them: consent, accurate sender identification, and a functional unsubscribe. Voice calls and faxes are not covered by this Act, though other rules apply to telemarketing.
Do I need consent to text my existing customers?
Usually you can rely on inferred consent for recent customers, because an existing business relationship and the conduct of both parties can make consent reasonable to infer. The further back the relationship goes, the weaker that argument becomes. Express consent, captured at the point of sale or sign-up and recorded with a timestamp, is far stronger and much easier to defend if a complaint is made.
What are the penalties for breaching the Act in New Zealand?
The Department of Internal Affairs can issue formal warnings, accept enforceable undertakings, seek injunctions, and apply to the District Court for civil pecuniary penalties of up to $200,000 for an individual and up to $500,000 for an organisation. Courts can also order compensation to people affected and the payment of any commercial gain made from the breach.
How long do I have to action an unsubscribe request?
Five working days from the date the request is made. Your unsubscribe facility also has to remain functional for at least 30 days after the message was sent, and it must be free or at nominal cost to the recipient. In practice, automate the suppression so it happens immediately, and make sure the system recognises plain-language requests, not only the STOP keyword.
Can I email a business address I found on a company website?
Sometimes, under deemed consent. The address must be conspicuously published in a work capacity, it must not carry a statement refusing unsolicited commercial messages, and your message must be directly relevant to that person’s role, functions or duties. That relevance test is genuine. If the product has nothing to do with their job, deemed consent does not apply and the message is not compliant.
Do appointment reminders and order confirmations need an unsubscribe link?
Purely factual and transactional messages, such as booking confirmations, delivery updates, account statements and safety notices, generally fall outside the definition of a commercial electronic message, so the consent and unsubscribe rules do not bite in the same way. Add a promotional offer to that message, though, and it can become commercial, at which point all three obligations apply to the whole message.
Is buying an email list legal in New Zealand?
Sending to a purchased list is almost never compliant, because you cannot demonstrate consent for the individuals on it. On top of that, the Act separately prohibits acquiring, supplying or using harvested-address lists and address-harvesting software, regardless of whether you send anything. If a vendor cannot tell you exactly how and when each person consented, treat the list as unusable.
About Octavius
Titus Mulquiney is the founder of Octavius AI, where he builds AI brains and AI workforces for founder-led businesses stuck running everything out of their own head. Twenty years in marketing, ex-Sony product manager, ex-GM Zeal NZ. Based in Auckland, working with operators across NZ, Australia, and the US. Connect on LinkedIn.