Two laws govern the same marketing list. POPIA controls how you may collect contact details and when you may send unsolicited electronic marketing. The Consumer Protection Act gives every consumer the right to make you stop, backed from 2026 by a national opt-out registry. The rules overlap without matching, so a list that satisfies one can still break the other.
What POPIA asks on the way in
Section 69 of POPIA treats electronic direct marketing as opt-in. For a prospect who has never bought from you, marketing by email, SMS, phone or direct message needs prior consent, and you may ask for that consent only once. The Information Regulator’s guidance note on direct marketing, issued in late 2024, adds that the ask should use the Act’s Form 4 or something substantially similar: a form naming what you intend to market and letting the person choose the channel.
Existing customers are the exception. If you obtained the contact details in the context of a sale, you may market your own similar products to that person, provided they could object when the details were collected and can object again in every message.
What the CPA asks on the way out
The CPA’s concern is the stop right. The 2026 amendments give it teeth through a registry where a consumer registers once and blocks direct marketing from specific companies or from everyone, with penalties reaching R1 million or 10% of annual turnover. POPIA consent does not override a registry entry. A person can lawfully be on your list under POPIA and still be off limits under the CPA.
One list that satisfies both
The reconciliation is per record rather than per policy. Each marketable contact needs a basis field showing why you may market to them at all, either recorded consent or an existing customer relationship, and a check against the opt-out registry before every send. Both belong in the campaign system itself, as conditions no send can bypass, because a rule that lives in a compliance document gets skipped the first time a deadline arrives.
Does your campaign tool know which law covers each contact? Tell us what’s on fire