Most founders I talk to know little about cold email rules NZ and believe one of two things about cold email. Either it is completely illegal in New Zealand, or nobody actually enforces anything, so it does not matter. Both are wrong, and both are expensive.
The cold email rules in NZ are set by a single piece of legislation; they are more permissive for business-to-business outreach than people assume, and they have a hard edge that catches sloppy senders. The line is not where you think it is.
This post covers the law that applies, the three tests every commercial message has to pass, where deemed consent runs out, what the Privacy Act adds on top, and how the NZ rules differ from Australia, the US and Europe. I am not a lawyer, and this is not legal advice. It is what an operator needs to know before pressing send.
Key Takeaways
- The cold email rules in NZ come from the Unsolicited Electronic Messages Act 2007, enforced by the Department of Internal Affairs.
- Every commercial email needs three things: a valid form of consent, accurate sender identification, and a working unsubscribe.
- Deemed consent lets you email a published business address, but only if the message is relevant to that person’s actual role.
- Penalties run to $200,000 for an individual and $500,000 for an organisation, plus compensation orders to anyone affected.
- Unsubscribe links must stay live for at least 30 days, and a request takes effect five working days after it is sent.
- The Privacy Act 2020 sits on top of the spam rules the moment you scrape, enrich or store a named person’s work email.
- Australia, the US and the EU each run different rules, so your sending list has to be segmented by country before it goes out.
Cold Email Rules in NZ Start With One Act
The governing law is the Unsolicited Electronic Messages Act 2007, usually shortened to UEMA. It is administered by the Department of Internal Affairs, which runs a compliance unit and a public complaints process.
UEMA covers “commercial electronic messages” with a New Zealand link. That means the message was sent from New Zealand, or sent to a New Zealand address, or the sender is based here. If you are an Auckland business emailing a Christchurch prospect, you are squarely inside it. If you are emailing Sydney from Auckland, you are inside both UEMA and Australia’s regime at once.
Two things surprise people about the scope. First, it is not just email. Text messages and instant messages count too, which matters if your follow-up sequence drops to SMS. Second, live voice calls are excluded. Telemarketing and AI voice calls sit outside UEMA and are governed by different rules, which is why so many businesses get the email side right and the calling side wrong.
The other thing worth understanding early: UEMA is not an opt-in-only regime. New Zealand did not copy Europe. The Act recognises three kinds of consent, and one of them lets you send a genuine business message to someone who has never heard of you. That is the entire basis on which legitimate B2B cold email operates here.
What it does not permit is volume for the sake of volume. The Act also prohibits using address-harvesting software or harvested-address lists to send commercial messages. Scraping ten thousand addresses off the web with a bot and blasting them is a separate offence from the message content itself.
The Three Tests Every Cold Email Has to Pass
Forget the noise. A commercial message sent in New Zealand has to clear three specific requirements. Fail any one and the message is non-compliant, no matter how polite it is.
1. Consent
You need express, inferred, or deemed consent.
Express is what it sounds like. They ticked a box, filled in a form, handed you a card and asked to be contacted.
Inferred consent comes from an existing relationship and the conduct of both parties. A past customer, an active supplier, someone mid-quote. This is why reactivating your own dormant database sits on much firmer ground than a cold list. I ran a reactivation campaign for James, a finance broker, across 319 contacts his team had written off. It recovered $49,000, and every one of those contacts had an existing relationship with the business.
Deemed consent is the one that makes B2B cold email possible, and it is covered properly in the next section.
2. Accurate Sender Identification
The message has to clearly and accurately identify who sent it and how to contact them, and those contact details have to stay valid for at least 30 days after sending.
This is where most cold email operations quietly break the law. Fake sender names, a burner domain registered last Tuesday, a reply-to address that bounces, no company name, no physical presence. None of that survives scrutiny. If your sending setup is designed to be untraceable, you have already failed the identification test.
3. A Functional Unsubscribe
Every commercial message needs a clear and conspicuous unsubscribe facility, and it has to remain functional for at least 30 days after the message goes out.
The plain-text, no-footer cold email is popular because it performs. It is also the most common compliance gap I see. You do not need a marketing footer with a logo. A single clear line offering to stop is enough, as long as it actually works.
Under UEMA, consent is treated as withdrawn five working days after the unsubscribe request is sent. So five working days is your outside limit for suppressing that address across every sequence you run. Not just the one they replied to.
Where Deemed Consent Runs Out
Deemed consent is the mechanism that lets you email a stranger legally. It has three conditions, and all three have to hold at the same time.
The address must be conspicuously published in connection with that person’s business, role or official duties. The publication must not carry a statement saying unsolicited commercial messages are not wanted. And the message you send must be relevant to that person’s business, role, functions or duties.
Read that third condition again, because it is the one that does the work. It is not “the address is public, so anything goes.” The relevance test is what separates a legitimate B2B approach from spam.
An example. You sell workshop scheduling software. You email the operations manager of a fabrication business whose work email is listed on their site. That is relevant to her role. Same list, but you email her about a health insurance product. That is not relevant to her role, and deemed consent does not cover it.
The “no statement to the contrary” condition matters too. If a site says “this address is not to be used for unsolicited marketing,” deemed consent is gone. Plenty of NZ businesses now put exactly that line on their contact page, and plenty of scrapers ignore it.
There is one more distinction worth holding. A generic role address like info@ or accounts@ is usually not personal information about a specific individual. A named address like sarah@ almost always is. That difference does not change your UEMA position much, but it changes your Privacy Act position a lot, which brings us to the layer most senders skip entirely.
The penalties are why this is worth getting right. Under UEMA, the courts can impose civil pecuniary penalties of up to $200,000 for an individual and up to $500,000 for an organisation, alongside compensation orders and damages. The Department of Internal Affairs also issues formal warnings well before it gets to that, and warnings are usually the first sign that someone on your list complained.
The Privacy Act Layer Most Senders Miss
UEMA governs the message. The Privacy Act 2020 governs the data behind it. Both apply, and the second one is where AI-assisted outreach creates new exposure.
The moment you scrape, buy, enrich or store a named individual’s work email, you are collecting personal information. That triggers the information privacy principles. Two of them matter most for cold outreach.
Principle 1 says you can only collect personal information for a lawful purpose connected to your business, and only if collecting it is actually necessary for that purpose. Principle 4 says the collection must not be unfair or unreasonably intrusive. Hoovering up every address on a website with a bot, then having AI build a personal profile from someone’s social posts, starts to look unreasonable fast.
There is a third one to watch if you are running modern tooling. Principle 12 covers sending personal information outside New Zealand. If your list sits in an offshore enrichment service or an overseas sending platform, you need to be satisfied that the information will be protected to a comparable standard. Most operators have never checked which country their enrichment vendor stores data in.
Then there is the content of the message itself. The Fair Trading Act 1986 applies to anything you claim in a cold email. Fabricated results, invented case studies, and made-up scarcity are misleading conduct regardless of whether the send was compliant. If your AI writer is inventing proof points to make the copy land, that is a bigger legal problem than the send itself, and it is one of the common ways AI automation fails small businesses.
Keeping a record of where each contact came from, when they were emailed, and when they unsubscribed is the practical answer to all of this. That is the same reason I argue for building an audit trail into any AI system you run. If a complaint lands with the DIA, the question will be what you knew and when. A spreadsheet is not an answer.
Cold Email Rules NZ vs Australia, the US and Europe
The single most common mistake I see in outbound is treating one list as one legal problem. Your sending list has to be segmented by country before anything goes out, because four jurisdictions have four different answers.
New Zealand runs the UEMA regime described above. Consent-based, with deemed consent available for relevant business messages to conspicuously published addresses.
Australia runs the Spam Act 2003, enforced by ACMA. Structurally very similar to UEMA, including consent inferred from conspicuous publication and a five working day unsubscribe window. The difference is enforcement appetite and penalty scale, both of which are materially larger than New Zealand’s. If you are sending across the Tasman, assume the tighter interpretation.
The United States runs CAN-SPAM, which is an opt-out regime rather than an opt-in one. No prior consent is required. In exchange, you must include a valid physical postal address in every commercial message and honour opt-outs within ten business days. American cold email is legally easier and reputationally harder, because inbox providers police it more aggressively than regulators do.
Europe and the UK run GDPR alongside the ePrivacy rules. Consent-first, with narrow legitimate-interest room for B2B in some member states and effectively none in others. If you are not sure which category a German or French prospect falls into, the safe answer is do not send.
The operational implication is simple. One list, one template and one sending schedule across four countries is a compliance failure waiting to happen. Country has to be a field on the record, and the sequence has to branch on it. If you are comparing vendors to run this for you, that branching logic is a fair question to ask, and it is one of the things worth checking when you compare AI automation companies in NZ.
Conclusion
The cold email rules NZ are not a wall. They are a shape. Relevant business message, to a published business address, from a sender who is honest about who they are, with a working way out. Stay inside that shape, and you can run outbound at real volume without ever hearing from the Department of Internal Affairs.
What trips businesses up is that compliance depends on the person sending, every single time. Someone forgets to suppress an unsubscribe. Someone reuses a list for a product that has nothing to do with the recipient’s role. Someone lets an AI writer invent a statistic. None of those is legal problems in isolation; they are systems problems that become legal problems.
The fix is to move the rules out of people’s heads and into the system that does the sending. Country segmentation, suppression lists, relevance checks and record-keeping should be structural, not something a person remembers on a busy Thursday. That is the difference between an AI workforce you can point at outbound and a liability you have automated.
If cold email is part of your growth plan and you are not sure whether your current setup would survive a complaint, book a 30-minute Discovery Call. I will walk through how your outreach is structured and tell you straight where the gaps are. No pitch, no deck.
Frequently Asked Questions
Is cold emailing legal in New Zealand?
Yes, when it is done properly. The Unsolicited Electronic Messages Act 2007 permits commercial messages sent with express, inferred or deemed consent. Deemed consent covers business messages sent to conspicuously published work addresses, provided the message is relevant to that person’s role. Every message also needs accurate sender details and a working unsubscribe facility.
Do I need consent to send a cold email to a business in NZ?
You need a form of consent, but it does not have to be a tick box. Deemed consent applies when a work address has been published in connection with someone’s business role, the publication carries no statement rejecting unsolicited messages, and your message is genuinely relevant to their role or duties. Miss the relevance test and deemed consent no longer protects you.
What are the penalties for breaching the Unsolicited Electronic Messages Act?
The courts can impose civil pecuniary penalties of up to $200,000 for an individual and up to $500,000 for an organisation, plus compensation orders and damages for people affected. In practice, the Department of Internal Affairs usually issues formal warnings first. Separate prohibitions cover the use of address-harvesting software and harvested-address lists.
Does the Act apply to info@ addresses?
Yes. The Unsolicited Electronic Messages Act applies to commercial electronic messages regardless of whether the address belongs to a named person or a shared inbox. The difference shows up under the Privacy Act instead. A named work address is personal information about an individual, while a generic role address usually is not, which changes your data handling obligations.
Do I need an unsubscribe link on a one-to-one cold email?
If the message is commercial in nature, yes. The Act requires a clear and conspicuous unsubscribe facility that remains functional for at least 30 days after sending. It does not have to be a marketing footer. A single plain line offering to stop is enough, as long as the request is actually honoured across every sequence you run.
Can I buy an email list in New Zealand?
Buying a list is risky. The Act prohibits using address-harvesting software and harvested-address lists to send commercial messages, and a purchased list rarely comes with proof of how each address was gathered. You also inherit a Privacy Act problem, because you are holding personal information collected by someone else for a purpose you cannot verify.
Does the Privacy Act 2020 apply to cold email?
Yes, as soon as you collect or store a named individual’s contact details. The information privacy principles require a lawful purpose for collection, and prohibit collection that is unfair or unreasonably intrusive. If your list or enrichment tooling sits offshore, principle 12 also applies, meaning you need comparable protection wherever that data is held.
About Octavius
Titus Mulquiney is the founder of Octavius AI, where he builds AI brains and AI workforces for founder-led businesses stuck running everything out of their own head. Twenty years in marketing, ex-Sony product manager, ex-GM Zeal NZ. Based in Auckland, working with operators across NZ, Australia, and the US. Connect on LinkedIn.