Add to Preferred Sources
POPIA SMS marketing in South Africa is governed by Section 69 of the Protection of Personal Information Act, which prohibits sending promotional text messages unless the recipient has explicitly consented — or qualifies as an existing customer under a narrow, three-condition exception. Understanding where your campaigns sit is a core part of website compliance in South Africa.
The stakes have risen for POPIA SMS campaigns: the Information Regulator's December 2024 guidance note and the April 2025 Regulation amendments changed exactly how consent must be documented and what an opt-out actually means.
This post maps the three overlapping legal layers that govern SA text campaigns — POPIA Section 69, the WASPA Code of Conduct, and the 2026 CPA opt-out registry — and shows you when each applies, what the existing-customer exception actually permits, and the specific steps your database and send process need to survive an audit. For the equivalent rules covering email, see SA email marketing law: CPA, POPIA and ECTA.
Quick Answer
POPIA SMS marketing requires either documented opt-in consent or an existing-customer relationship meeting all three conditions of Section 69(3). A pre-ticked box or an opt-out mechanism alone does not constitute consent under the April 2025 Regulation amendments. All marketing texts must identify the sender and provide a free opt-out path.
The WASPA Code adds timing windows (no texts on Sundays or public holidays, weekdays 08:00–20:00, Saturdays 09:00–13:00) and a weekly Do-Not-Contact list check. From July 2026, the CPA opt-out registry adds monthly database cleansing as a third obligation running in parallel.
In This Post
Not sure whether your SMS list and consent records meet current POPIA requirements?
Send us your current flow and we'll show you where the gaps are — before the Regulator does.
Get a Free Compliance ReviewWhat POPIA Section 69 Says About POPIA SMS Marketing
Section 69 of POPIA is the single provision that specifically governs direct marketing by electronic communication — and it is stricter than the general processing rules under Section 11. You can read the full text of Section 69 on popia.co.za. The section explicitly names SMS alongside email, fax and automated calling machines as channels that require either consent or an existing-customer relationship before you can send.
The section works in three parts:
- Section 69(1) — the prohibition. You may not process a person's contact details for direct marketing by electronic means unless they have consented, or are a customer meeting the s69(3) conditions.
- Section 69(2) — the one-approach rule. If you want to request consent from someone who has not already given it, you may approach them exactly once. If they refuse, that refusal is permanent — you cannot ask again. The Information Regulator's December 2024 guidance note confirmed this applies to all electronic marketing channels.
- Section 69(4) — mandatory message elements. Every marketing text must include the sender's identity and a contact address or mechanism that allows the recipient to demand that messages stop.
Key Point: Section 69 vs Section 11
Section 11 lists several lawful bases for processing personal information — including contractual necessity, legitimate interests and legal obligation. Section 69 is different: for direct electronic marketing it effectively narrows the available bases to consent or the existing-customer exception. Relying on "legitimate interests" alone to send marketing texts is not a defensible position under s69. The Regulator's December 2024 guidance note made this explicit.
The s69(3) Existing-Customer Exception — When You Can Text Without Upfront Consent
The existing-customer exception allows a responsible party to send direct electronic marketing to a customer without first obtaining consent, but only when all three conditions are simultaneously satisfied.
| Condition | What It Requires | Common Failure Point |
|---|---|---|
| 1. Source of contact details | Details were obtained in the context of a sale of a product or service — the customer bought from you | Purchased lists; lead forms without a transaction; downloaded a freebie but did not purchase |
| 2. Similarity of offer | Marketing concerns the responsible party's own similar products or services — not a third-party offer | Sending partner-brand promotions or unrelated products to an existing customer database |
| 3. Opt-out opportunity | Customer received "a reasonable opportunity to object, free of charge" both at initial collection AND at each subsequent communication | No opt-out on the first message; opt-out mechanism that is not free or not working |
All three must hold at the same time. A clothing retailer sending a discount text about similar clothing to someone who purchased last month satisfies the exception — provided the customer had a clear opt-out option when their number was collected and every message since. The same retailer sending a home insurance promotion to the same customer does not satisfy condition 2, regardless of the existing relationship.
Fails the exception: An online store purchases a B2B contact list and sends a promotional text to business owners who have never transacted with the brand. Condition 1 fails immediately — there is no prior sale. This is also the scenario that triggers the one-approach rule: the store may approach each person once for consent, but that text itself is the approach — and if the person ignores or opts out, no further marketing texts may be sent.
Satisfies the exception: A salon sends an appointment-reminder text that includes a brief mention of their new conditioning treatment to a customer who booked a cut last month. The number was collected at booking, the treatment is similar to existing services, and every message includes a working STOP opt-out. All three conditions are met.
What the April 2025 POPIA Regulation Changes Mean for SMS Consent
The POPIA Regulations were amended on 17 April 2025, and the changes directly affect how consent must be captured and evidenced. POPIA SMS consent requirements are now more precisely defined — but the core opt-in obligation has not softened.
Form 4 flexibility. Consent no longer has to be captured on the exact prescribed Form 4. The amended Regulations allow a form that is "substantially similar" to Form 4, provided it is expedient, free of charge and reasonably accessible to the data subject. The form can be delivered via email, phone, SMS, WhatsApp or fax. This makes digital consent flows (a branded opt-in widget on your website, for example) legally defensible — as long as the information requirements mirror Form 4.
Opt-out is not consent. The April 2025 amendments expressly state that "an opt-out shall not constitute consent." A pre-ticked checkbox, a "you can unsubscribe at any time" notice, or a soft opt-in mechanism does not satisfy the consent requirement. Consent must be a positive, active choice by the data subject.
Telephonic consent requires a recording. If your sales team collects SMS consent verbally over the phone, you must keep an electronic recording of that consent and make it — or a transcription — available to the data subject free of charge upon request.
Consent Records: How Long to Keep Them
The WASPA Code of Conduct requires consent records to be maintained for at least three years. This means your consent log — date, channel, what the person agreed to, and the identity of the person — must be retrievable for at least three years from the point of consent. The Information Regulator's guidance note adds that responsible parties must maintain a database of data subjects who have withheld consent or opted out, separate from the active consent log.
WASPA Code of Conduct — the Industry Layer on Top of POPIA
The Wireless Application Service Providers' Association Code of Conduct operates alongside POPIA and applies to all WASPA members and the clients whose campaigns they carry. Even if your business is not a WASPA member directly, any bulk SMS platform you use almost certainly is — which means the Code's obligations flow to your campaigns.
Permitted Sending Times
| Day | Permitted Hours (Marketing SMS) | Transactional SMS |
|---|---|---|
| Monday – Friday | 08:00 – 20:00 | Anytime |
| Saturday | 09:00 – 13:00 | Anytime |
| Sunday | No marketing texts | Anytime |
| Public Holidays | No marketing texts | Anytime |
Sending outside these windows is only permitted if the recipient has explicitly opted in for after-hours or weekend messaging. Transactional messages — OTPs, delivery confirmations, payment receipts — are not subject to these restrictions and can be sent at any time.
Opt-Out Mechanics
The WASPA Code requires a working STOP mechanism in every marketing text. WASPA also requires you to honour END, CANCEL, UNSUBSCRIBE and QUIT as equivalent opt-out commands — a recipient who sends any of these must be treated as if they sent STOP. Once an opt-out is received, you must send a confirmation, remove the number from your active list, and maintain it on a suppression list to prevent future sends. The WASPA Do-Not-Contact list must be checked weekly before any campaign send.
Sender Identification
The WASPA Code requires that the sender's identity and an opt-out address appear in the body of every marketing text, regardless of the originator number displayed. This obligation is independent of whatever number the recipient sees — every marketing text must state who is sending it and include opt-out instructions in the message body itself.
Three Compliance Layers: A Decision Table for SA Text Campaigns
The rules governing SMS direct marketing in South Africa now sit across three simultaneous legal instruments. They do not replace each other — a campaign must satisfy all three that apply to your situation.
| Layer | Governing Body | Core SMS Obligation | Key Timeline |
|---|---|---|---|
| POPIA s69 | Information Regulator | Opt-in consent or existing-customer exception (all 3 conditions); sender ID + opt-out in every message; one-approach rule for consent requests; maintain withheld-consent database | In force since July 2021; guidance note Dec 2024; Regulation amendments Apr 2025 |
| WASPA Code | WASPA (industry self-regulator) | Timing windows (Mon–Fri 08:00–20:00, Sat 09:00–13:00, no Sun/pub hols); STOP/UNSUBSCRIBE honour; WASPA DNC check weekly; consent records 3 years; sender named in body | Ongoing; current edition in force — verify version at waspa.org.za |
| CPA Opt-Out Registry | National Consumer Commission | Register as direct marketer (Annexure P, renewed annually); cleanse database against registry monthly; pre-emptive block by consumer overrides prior consent | Operational from July 2026; implementation phased by NCC |
Note on ECTA: The Electronic Communications and Transactions Act (ECTA) imposes additional obligations on automated electronic marketing communications — for example, requirements on unsolicited commercial communications and opt-out mechanisms under s45 of the ECT Act. ECTA obligations as they apply to online stores and electronic channels are covered separately in the ECT Act and your online store guide.
Where obligations conflict, the conflict-of-laws principle applies: the provision giving the data subject greater protection prevails. In practice this means POPIA's opt-in requirement (stricter) overrides the CPA's historical opt-out model for electronic channels including text campaigns. Section 69 SMS marketing rules take precedence over a general CPA opt-out standard — you cannot rely on the CPA framework alone to justify sending promotional texts.
The CPA 2026 Registry and Prior Consent
If a consumer registers a pre-emptive block on the NCC opt-out registry, that block overrides any prior consent you hold from them. You cannot continue sending marketing texts to a blocked number even if that person opted in to your list last week. Monthly database cleansing against the registry is mandatory — not optional — for registered direct marketers. Implementation of the registry is phased by the NCC; check the NCC's current operational guidance for the specific cleansing workflow that applies to your volume and channel.
Running a campaign list that was built before the April 2025 changes?
Share the consent capture method with us and we will tell you whether it still holds under the amended Regulations — no obligation.
Book a Compliance AssessmentBuilding a POPIA-Compliant SMS Marketing Process
Understanding POPIA SMS requirements is the starting point for every text campaign — before you load a list, configure a platform, or set a send schedule. A compliant setup covers five operational areas: how consent is captured, how it is recorded, how opt-outs are processed, what goes in each message, and when sends happen.
Step 1: Capture consent with a positive action
Use a consent form that is substantially similar to POPIA Form 4 — it must tell the person who is collecting the data, what it will be used for, that they can opt out at any time, and how. The consent must be a deliberate tick, signature or reply — not a pre-checked box. If you collect consent verbally, record the call and store it. Document every consent event: date, channel, what was agreed, and the exact wording the person saw or heard.
Step 2: Maintain two separate databases
Keep an active-consent database (people who have opted in and remain active) and a withheld-consent / suppression database (people who refused consent or opted out). The Information Regulator's guidance note specifically requires the second list. Without it, you have no reliable way to ensure the one-approach rule is honoured and opt-outs stay honoured.
Step 3: Pre-campaign list hygiene
Before any send, check your list against: (1) your internal suppression database, (2) the WASPA Do-Not-Contact list (weekly obligation), and (3) from July 2026, the NCC opt-out registry (monthly obligation). Numbers on any of these lists must be suppressed before the send is queued. A number on the NCC registry suppresses even a previously consented contact.
Step 4: Build every message to comply with s69(4)
Each marketing text must include the sender's name (in the message body — not just the originator number), the purpose of the message, and an opt-out instruction. For WASPA compliance the opt-out should include a STOP reply instruction. Keep messages concise: a 160-character window is tight, and every character used for legal boilerplate is a character not spent on the offer.
Step 5: Process opt-outs immediately and confirm
When a STOP (or equivalent) is received, suppress the number within your platform, move it to your suppression database, send an opt-out confirmation, and stop all further marketing sends. The WASPA Code requires honouring opt-outs across channels — if someone calls your office to opt out, that number must be suppressed from SMS sends too.
What SA's First Direct-Marketing Enforcement Action Tells You
In February 2024, the Information Regulator issued its first enforcement notice for a direct marketing violation — to FT Rams Consulting, for persistent unsolicited email marketing with repeated opt-out requests ignored. The company was ordered to cease sending, to use the prescribed consent form, and to build a withheld-consent database. When the notice was not complied with, a R100,000 administrative fine followed, with court recovery proceedings underway.
The Information Regulator's December 2024 guidance note signalled a material shift toward active enforcement of direct marketing obligations. The FT Rams case was an email case; the Section 69 provision it enforced applies identically to text campaigns. For broader POPIA marketing compliance, the same enforcement trajectory applies across all electronic channels.
Why South African Businesses Choose Growth Pulse Media for Compliant Digital Marketing
Growth Pulse Media was built by someone who has run and scaled a South African ecommerce operation — which means POPIA compliance is not an abstraction. It shapes how we structure consent flows, how we manage list hygiene, and how we design the digital touchpoints that feed a campaign list.
When a business asks us to set up or audit a text marketing programme alongside their web design project, we approach it as an operator who has made the same choices: what consent mechanism to use, how to structure opt-out confirmation, how to document the database for an audit.
We work with a deliberately limited number of clients so that senior attention goes to every campaign — not a junior team member learning the WASPA Code for the first time on your budget. If you use Omnisend or Klaviyo for your SA store, we are a certified partner for both and understand how their SMS features interact with the POPIA s69 requirements. See how POPIA operator agreements affect your SMS platform relationship, and what to check before you sign.
Who This Is NOT For
Businesses that want to use purchased contact lists. Buying a database of South African mobile numbers and sending promotional texts to it is not compliant under POPIA s69. The contact details were not obtained in the context of a sale to you, consent was not given to you, and there is no existing-customer relationship. No amount of opt-out language in the text resolves this — s69 consent must precede the first message.
Businesses that treat "unsubscribe available" as equivalent to consent. The April 2025 Regulation amendments explicitly state that providing an opt-out option does not constitute consent. If your current sign-up process assumes that giving people the ability to unsubscribe satisfies the consent requirement, that assumption is legally incorrect and needs to be rebuilt.
Businesses sending partner-brand promotions through their own customer list. The existing-customer exception under s69(3) only covers marketing for the responsible party's own similar products or services. Using your customer list to send affiliate or third-party offers — even to customers who purchased from you — takes you outside the exception and requires consent for that specific marketing purpose.
Businesses that need to reach entirely cold audiences at scale without a consent-building strategy. POPIA SMS compliance and cold-audience reach are structurally incompatible unless you build a consent channel first. The one-approach rule means a single unsuccessful request closes that door permanently. If your growth model depends on mass unsolicited text campaigns, a different channel — or a consent-building programme — is the right starting point, not SMS. For alternatives, see POPIA-compliant lead generation approaches.
Need a website that captures SMS consent the right way from day one?
We'll review your current sign-up flows and show you what a Form 4-compliant consent mechanism looks like in practice — no obligation, and we get back to you within 24 hours.
Request a Free AuditFrequently Asked Questions: Direct Text Marketing Compliance
Does POPIA Section 69 require consent for every marketing SMS I send?
Section 69 governs direct marketing by electronic communication specifically — it does not apply to transactional texts such as OTPs or order confirmations, where other processing bases under Section 11 can apply. For POPIA SMS direct marketing, Section 69 requires either documented opt-in consent or the existing-customer exception under s69(3).
The exception requires that the customer's contact details were obtained during a transaction with you, that you are marketing your own similar products, and that an opt-out was available both at collection and in every message sent since. If any of those three conditions is not met, opt-in consent is required before you send.
Can I send SMS marketing to a customer who never explicitly opted in?
Yes, under the s69(3) existing-customer exception — but only if all three conditions are met simultaneously: their number came from a transaction with your business, the texts promote only your own similar products or services, and you provided a free opt-out at the time of collection and in every subsequent message. If any condition is missing, you need explicit opt-in consent before the first text.
What happens if someone does not reply to my POPIA SMS consent request?
Silence is not consent. If you send a consent-request text and receive no reply, you have used your one permitted approach under Section 69(2). You cannot send a follow-up consent request to that number. The person can be contacted again only if they subsequently initiate contact with your business or enter into a transaction that creates the s69(3) existing-customer relationship.
How does the 2026 CPA opt-out registry interact with my existing consent database?
The CPA registry, which became operational from July 2026, requires registered direct marketers to cleanse their databases against it monthly. If a consumer registers a pre-emptive block on the registry, that block overrides any prior consent you hold — meaning you must suppress that number from marketing sends even if they previously opted in. The conflict-of-laws principle means the stricter protection (POPIA opt-in combined with CPA block) governs. Implementation is being phased by the National Consumer Commission, so check NCC guidance for current operational requirements.
What are the WASPA sending-time rules for SMS marketing in South Africa?
The WASPA Code restricts marketing texts to Monday–Friday 08:00–20:00, Saturday 09:00–13:00, and prohibits marketing texts entirely on Sundays and public holidays. Transactional messages — order confirmations, OTPs, delivery notifications — are not subject to these windows and can be sent at any time. Sending outside permitted windows without explicit recipient consent for after-hours contact is a WASPA Code violation, regardless of POPIA compliance status.
Need a POPIA-Compliant Digital Setup That Supports SMS and Email Capture?
Growth Pulse Media designs and builds SA websites with POPIA-compliant consent flows built in — not bolted on after the fact. We are a registered Shopify Partner and Omnisend Certified Partner, so we understand how your store platform's SMS tools interact with the Section 69 requirements. Tell us what you're working with and we'll come back with a clear picture of where you stand. No obligation — we'll get back to you within 24 hours.
Get Your Free Compliance Consultation