The Department of Internal Affairs

Te Tari Taiwhenua | Department of Internal Affairs

Building a safe, prosperous and respected nation



Three steps to ensure you are not spamming

Follow the steps below to ensure you are not sending spam:

Step one - Consent

Commercial messages must be sent only when you have express consent, inferred consent, or deemed consent.

Express consent

Express consent is a direct indication from the person you wish to contact that it is okay to send the message(s).

Express consent can be gained in a variety of ways such as:

  • Filling in a form
  • Ticking a box on a website
  • A phone or face-to-face conversation.

Businesses should keep a record of all instances where consent is given, including who gave the consent and how. Under the Act it is up to the sender to prove that consent exists. 

Double opt-in

To ensure that consent is provided by an account owner and not by a third party or a “friend”, it is advisable to verify each subscribe request through a two-step process known as “double opt-in”. This involves sending an email containing a link to an account once a subscribe request has been received. The account owner then clicks the link which completes the subscribe process. If this link is not clicked, then electronic marketing should not take place. By taking such an action, you are ensuring that the account owner is agreeing to receive marketing or promotional material from you. No third parties can click this link.

Databases

If you are using an existing database of addresses or if you have purchased a database of addresses you need to ensure you have the appropriate consent for each of those addresses (even if you have been sending electronic messages to these recipients for years).

Inferred consent

Inferred consent is when the person you wish to contact has not directly instructed you to send them a message, but due to the conduct and business relationship of the person concerned, there is a reasonable expectation that messages will be sent.

Inferred consent tends to take place when an address-holder provides their electronic address during the process of purchasing goods and services with the general expectation that there will be follow-up communication. Please note however, if someone has been on your existing database and has not ‘unsubscribed’, it does not mean that consent can be inferred. If you are not confident that the existing relationship is strong enough to infer consent, you should obtain express consent. Inferred consent is limited in its application.

For example, a regular customer known to purchase the latest brand of a particular bike often visits the same store for various bike goods and services. In the past the customer has provided their email address relevant to a delivery of an item. The store owner notices the latest version of their favourite bike has been announced and decides to send the customer an email about this with an offer for their latest services.

Deemed consent

Deemed consent is when someone conspicuously publishes their electronic address (e.g. on a website, brochure or magazine) in a business or official capacity.

However, if a publication includes a statement that the person does not want to receive unsolicited commercial electronic messages at that address, consent cannot be deemed. The message must also be relevant to the business, role, functions, or duties of the person in a business or official capacity.

Step two - Identify

Commercial messages must always clearly identify the business responsible for sending the message and how they can be contacted.

Sometimes you might use another organisation, a third party, to send commercial electronic messages on your behalf. This third party must include accurate information about your business, i.e. name and contact details.

The amount of information may depend on the medium by which the message is sent. For instance TXT messages can impose limitations on the number of characters that can be displayed. However accurate contact details must still be provided.

Contact details provided by the sender of a commercial electronic message must be reasonably likely to be accurate for a period of 30 days after the message is sent. This requirement ensures that recipients have a reasonable chance of being able to contact you.

  • For the full legislative requirements see section 10 of the Act.

Step three - Unsubscribe

Commercial messages must contain a functioning unsubscribe facility, allowing people to stop receiving messages and revoke their consent.

It needs to be clearly presented, easy to use, free of charge and use the same medium of communication in which the original message was sent. It could be as simple as a line in your message saying, ‘If you do not wish to receive future messages, send a reply with UNSUBSCRIBE in the subject line’.

However, if you have an ongoing arrangement/contract with the recipient of your message waiving this requirement, you will not need to include an unsubscribe facility in your message. Although you will be required to honour unsubscribe requests when communicated.

You must honour a request to unsubscribe within five working days.

Similar to the identification of the message’s sender (in step 2) the unsubscribe facility must be reasonably likely to remain accurate and functional for a 30-day period. It need not be an automated process, but should be reliable.