Cold email laws
POPIA (South Africa): What It Means for Cold Email
Only with consent. POPIA section 69 bans direct marketing by email without consent, and it covers companies as well as people. You may send one consent request to someone who has not refused before, and an unsubscribe link is not consent. Fines reach ZAR 10 million.
Not Legal Advice
Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer.
Can You Send B2B Cold Email Under POPIA?
In short Only with consent: you may send one email to ask for consent, without a pitch, to someone who has not refused before, and POPIA protects companies as well as people, so B2B is covered.
Section 69(1) bans direct marketing by any form of electronic communication, including email, unless the data subject consented or is an existing customer. You may approach a person who is not a customer only once to ask for consent, and only if they have not withheld it before (section 69(2)(a)). Every message must identify the sender and give an address where the recipient can ask you to stop (section 69(4)).
There is no B2B exemption. POPIA defines a person as a natural or a juristic person, its personal information covers identifiable existing juristic persons and includes email addresses, and section 69 speaks of his, her or its consent. The Information Regulator's Guidance Note on Direct Marketing (December 3, 2024) has no B2B carve-out and lists Instagram and LinkedIn direct messages as unsolicited electronic communication.
Opt-out is not consent. The amended regulations say an opt-out does not count as consent under section 69(2) (regulation 6.4), and in its 2024 enforcement notice against FT Rams Consulting the Regulator held that an opt-out link did not cure sending without consent.
What Do You Need to Do Under POPIA?
In short 7 rules apply to a cold email program under POPIA.
| Requirement | What it means | How to do it | Section |
|---|---|---|---|
| Consent before marketing | The Guidance Note says the first communication must be a request for consent. | Make the first and only cold email a consent request with no pitch, and market only to contacts who say yes. | POPIA s 69(1)(a); Guidance Note para 7.2.1 |
| One request only | You may ask only once, and only people who have not previously withheld consent. | No follow-up sequences. Suppress anyone who does not answer or who declines. | POPIA s 69(2)(a) |
| Prescribed form | Ask in a form substantially similar to Form 4, or in any other expedient manner. | Include your identity, the specific goods or services, a give or do not give consent choice and a preferred channel, and store the replies. | POPIA s 69(2)(b); Regulations reg 6.1 (2025) |
| Burden of proof | The responsible party must prove the data subject's consent. | Keep timestamped consent records. | POPIA s 11(2)(a) |
| Identity and opt-out in every message | Every message needs the sender's identity and an address or other contact details where the recipient can ask you to stop. | Include your company name, the sender and a working reply or unsubscribe address in every email. | POPIA s 69(4) |
| Lawful sourcing and notice | Collect directly from the person unless an exception applies, such as information they deliberately made public, and tell them the source, your identity, the purpose and their right to object. | Log the source of each address and put a short notice in the consent request. | POPIA s 12 and 18(1) |
| Suppression list | Never contact again anyone who withheld consent or objected. | Keep a permanent do-not-contact list synced across every tool. | Guidance Note para 7.3.5 |
What Are the Penalties Under POPIA?
In short Maximum penalty: ZAR 10 million fine; up to 10 years in prison for ignoring an enforcement notice.
| Penalty | Maximum | In USD | Section |
|---|---|---|---|
| Administrative fine (infringement notice) | ZAR 10,000,000 | about USD 608,500 | POPIA s 109(2)(c) |
| Failing to comply with an enforcement notice (offence) | A fine, imprisonment of up to 10 years, or both | Not a fixed amount | POPIA ss 103(1) and 107(a) |
| Civil damages | Awarded by a court on a data subject's claim, whether or not there was intent or negligence | Not a fixed amount | POPIA s 99(1) |
USD amounts are approximate, converted at the European Central Bank reference rates of 2026-10-16.
Anyone can complain to the Information Regulator (section 74). The Regulator issues enforcement notices (section 95) and infringement notices with fines (section 109), and ignoring an enforcement notice is an offence. A data subject, or the Regulator at their request, can sue for damages (section 99).
What Enforcement Has There Been Under POPIA?
In short One case from regulator and court records, newest first.
This is the only direct marketing enforcement notice we found on the Information Regulator's site. We found no administrative fine against a company on the Regulator's site; the only fine we found, ZAR 5 million in 2023, was against a government department for a security failure.
| Date | Company | What happened | Outcome | Source |
|---|---|---|---|---|
| 2024-02-21 | FT Rams Consulting | A training company sent repeated course and webinar marketing emails without first asking for consent, to an address it did not collect from the person. | Enforcement notice: stop, use Form 4 and keep a suppression list; no fine | Information Regulator enforcement notice |
Cold Email Checklist for POPIA
- Make the first cold email a consent request with no pitch, and send it once.
- Send it only to people who have not refused consent before.
- Follow Form 4: your identity, the goods or services, a give or do not give consent choice and a preferred channel.
- Market only to people who said yes, and store their replies with timestamps.
- Put your identity and a working opt-out address in every message.
- Log where each address came from and include a short notice in the consent request.
- Keep a permanent do-not-contact list of everyone who refused or objected.
How Ken Helps
In short Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility.
- Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3).
- Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it.
- Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits.
- You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2).
- Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6).
- Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under POPIA, that includes the one-time consent request and proof of every yes.
FAQ
Does POPIA apply to B2B cold email?
Yes. A person includes a juristic person, personal information includes an email address and information about an existing juristic person (section 1), and section 69 covers his, her or its consent. Neither the Act nor the 2024 Guidance Note exempts B2B.
Can I send one cold email to ask for consent?
Yes, once, and only to someone who has not previously withheld consent (section 69(2)(a)). Since 2025, regulation 6.1 allows the request in any expedient manner, substantially in line with Form 4.
Is an unsubscribe link enough under POPIA?
No. Regulation 6.4 says an opt-out does not count as consent, and in the FT Rams Consulting notice the Regulator held that an opt-out link did not cure a breach of section 69(1).
Can I email someone who has not registered an opt-out block?
Not without POPIA consent. The Guidance Note (para 8.4) says you cannot contact a data subject simply because they have not registered a pre-emptive block.
What is the maximum POPIA penalty?
An administrative fine of up to ZAR 10 million (section 109(2)(c)). Ignoring an enforcement notice can bring a fine, up to 10 years in prison, or both (sections 103(1) and 107(a)), and data subjects can sue for damages (section 99).
The new Ken opens to the waiting list in batches.
Related
- Cold email laws by country
All 12 laws compared
- UWG Section 7 (Germany): What It Means for Cold Email
Not allowed without prior consent
- GDPR: What It Means for Cold Email
Legitimate interest; consent rule varies by country
- LGPD (Brazil): What It Means for Cold Email
Allowed on legitimate interest, opt-out
- Ken anti-spam policy
Sources
Changelog
- Page published.