- The law
- Unsolicited Electronic Messages Act 2007 (UEMA), sections 4, 6 and 9
- Who enforces it
- Department of Internal Affairs (DIA)
- Penalties
- Court penalties up to NZ$200,000 for an individual and NZ$500,000 for an organisation, plus formal warnings and civil infringement notices.
What’s changed (2026/27 edition). For details collected from someone else on or after 1 May 2026 (a partner's list, a list you buy), the Privacy Act's new principle 3A says you must tell the people concerned, unless an exception applies.
What it means for your email
- You must not send a commercial email with a New Zealand link to someone who hasn't consented. A New Zealand link includes a sender or recipient in New Zealand, or an address ending in .nz.
- Express consent is a direct yes from the person, such as a ticked box or a sign-up form. The DIA says verbal consent is fine, and advises keeping a record, because you have to prove consent.
- Inferred consent comes from the conduct and the business or other relationships of the people involved. The DIA says it's limited, and you can't reasonably infer it from a single purchase.
- Deemed consent only applies when someone has conspicuously published their address in a business or official capacity, hasn't said they don't want unsolicited messages there, and your email is relevant to their business or role.
- If someone challenges you, you have to prove consent. Keep a record of who agreed, when and how.
Do
- Ask for express consent wherever you can, with its own tick box for each kind of marketing.
- Keep the source, date and wording of every sign-up.
- Check consent on any list you buy or inherit before you send to it.
- Make sure deemed-consent emails really are about the person's job or business.
Don't
- Don't treat silence as consent, for example after an email that says "click here to unsubscribe".
- Don't rely on a referral from a colleague or a business card someone else gave you.
- Don't assume an address is "conspicuously published" just because you found it online.
- Don't use address-harvesting software or harvested lists to send unsolicited marketing.
Good to know
- Quotes the person asked for, order and account updates, warranty, recall and safety notices aren't commercial messages under the Act, so they don't need consent. The DIA says you can add promotional material to an order confirmation; if promotion becomes the main point of the email, treat it as marketing.
- Free offers still count as marketing. The DIA says it's irrelevant that the goods or services are free.
- Unsubscribing withdraws consent. See the New Zealand unsubscribe card.
- Since 1 May 2026, the Privacy Act 2020 has a new information privacy principle, 3A. When you collect someone's details on or after 1 May 2026 from someone other than them (a partner's list, a list you buy), you must take reasonable steps to tell them: that you have their details, why, who will get them, your name and address, and their right to see and correct them. Do it as soon as reasonably practicable, unless they were already told all of this (for example, in the partner's privacy notice) or another exception applies. Details collected before 1 May 2026 aren't covered.
- The Privacy Commissioner's guidance gives a marketing example: a list from a partner agency, with the notice sent alongside the first campaign email rather than as a separate one. Principle 3A is about telling people; it doesn't replace the consent you need under the Unsolicited Electronic Messages Act.
Sources
- Unsolicited Electronic Messages Act 2007 (Parliamentary Counsel Office, New Zealand Legislation)
- Three steps to ensure you are not spamming (Department of Internal Affairs)
- Spam Frequently Asked Questions (Department of Internal Affairs)
- What anti-spam law means for businesses (Department of Internal Affairs)
- Privacy principle 3A: collection of information from a source other than the individual (Office of the Privacy Commissioner)
- IPP3A guidance (Office of the Privacy Commissioner)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.