What does POPIA section 69 cover?
Section 69 covers direct marketing sent by electronic communication: email, SMS, fax, automatic calling machines and, in the Information Regulator's view, phone calls. If you use a person's details to promote your services to them through one of these channels, section 69 decides whether you may send it at all.
Two definitions in section 1 set the scope. "Direct marketing" means approaching a person, in person, by mail or by electronic communication, to promote or offer to supply goods or services in the ordinary course of business, or to ask for a donation. "Electronic communication" means "any text, voice, sound or image message sent over an electronic communications network" that is stored in the network or on the recipient's device until collected.
A WhatsApp message is a text, voice or image message sent over a network and held until the recipient reads it, so it fits that definition. The amended Regulations also list SMS and WhatsApp among the channels for requesting consent (regulation 6). The Regulator's Guidance Note goes further on voice calls: paragraph 7.1.1 says "telephone calling is electronic communication" because calls are now mostly carried digitally. It also lists push notifications and direct messages on Instagram or LinkedIn as examples. The Guidance Note is advisory, so treat its view on calls as the Regulator's position rather than a court ruling.
Marketing by post or in person is not covered by section 69. It falls under the general processing rules, including the right to object to direct marketing in section 11(3)(b).
Is an opt-out enough for POPIA marketing consent?
No, not where you are relying on consent. Regulation 6 of the amended POPIA Regulations, published in the Government Gazette on 17 April 2025, provides that for direct marketing through unsolicited electronic communications, an opt-out does not constitute consent under section 69(2). (We have paraphrased this from the amended Regulations rather than quoting the gazetted text.)
That matches the definition of consent in section 1: "any voluntary, specific and informed expression of will". A pre-ticked box, or a line saying "we will add you to our list unless you tell us not to", does not record an expression of will. The Guidance Note puts it plainly: "silence cannot mean consent". Section 11(2)(a) also puts the burden of proving consent on you, not on the recipient.
Be careful not to read this as "opt-out never counts". The existing-customer route in section 69(3) does run on an opportunity to object. The point of the regulation 6 rule is that you cannot use an opt-out mechanism to manufacture consent for people who are not your customers.
What are the two lawful routes for electronic marketing?
Section 69(1) allows electronic direct marketing to a person only if they have given consent, or if they are your customer and you meet every condition in section 69(3). If neither applies, you may not send it.
Route 1: consent under section 69(2)
For people who are not customers, the first message you send must be the request for consent, not the marketing. Section 69(2)(a) allows that approach "only once", and only to someone who "has not previously withheld such consent". Section 69(2)(b) requires the request to be made "in the prescribed manner and form".
Regulation 6 says written consent must be obtained on a form substantially similar to Form 4 or in any other expedient manner, free of charge and reasonably accessible, including by email, telephone, SMS or WhatsApp, fax or automated calling machine. Telephone requests must be recorded (Guidance Note paragraph 7.2.6).
Form 4 itself asks you to name the goods or services you intend to market, and asks the person to choose their preferred method of communication. The Guidance Note (paragraphs 7.2.4 and 7.2.5) says you may use an electronic version of Form 4 if it contains all the prescribed information, with "I give my consent" and "I do not give my consent" options, and that you must then stick to the channel the person chose.
Route 2: existing customers under section 69(3)
You may market electronically to a customer without separate consent only if all three conditions are met:
- you obtained their contact details "in the context of the sale of a product or service";
- the marketing is for your "own similar products or services"; and
- they were given a reasonable opportunity to object, free of charge and without unnecessary formality, both when the details were collected and in every marketing message, if they did not refuse at the start.
"Similar" matters. The Guidance Note's example is a clothing retailer: shoes and belts are similar products, funeral cover is not. If the customer objected when their details were collected, you may not market to them on this route at all.
Can a law firm send newsletters to existing clients?
Often yes, but it depends on what the newsletter is and how you got the client's details. Two questions decide it: is the newsletter direct marketing at all, and if it is, does the section 69(3) customer route apply?
A newsletter that promotes the firm's services or invites readers to instruct you is direct marketing under the section 1 definition. A purely informational update with no promotional content is arguably not, but most firm newsletters include some promotion, such as a "contact us about this" line or a services section. We are not aware of a Regulator decision drawing that line for law firm updates, so assume the newsletter is direct marketing unless an attorney has advised otherwise.
If it is direct marketing, a client whose email address you took when opening a matter will usually be the closest fit for section 69(3): their details were collected in the context of the sale of a service. The remaining conditions are where firms fall short:
- Similar services. A conveyancing client receiving property law updates is a closer match than the same client receiving a promotion for an unrelated practice area. Where a mailing covers very different work, the "similar" condition is a judgment call.
- The objection at collection. Section 69(3)(c)(i) requires the opportunity to object when the details were collected. If your intake form or engagement letter never offered it, take advice on whether the customer route is available for those clients.
- Enquirers are not clients. Someone who filled in your website contact form but never instructed you has not bought a service. Contacts from events, business cards and referrals are in the same position. For them, you need consent under section 69(2).
Client data in general is covered in how law firms should handle client data under POPIA.
How does the 2026 CPA opt-out registry interact with section 69?
It adds to section 69; it does not replace it. The Information Regulator's media statement of 21 April 2026 notes the Consumer Protection Act Amendment Regulations published in the Gazette on 15 April 2026, aimed at curbing unsolicited marketing including spam calls, and says compliance with POPIA "is still mandatory, irrespective of whether a consumer (data subject) is registered on the pre-emptive block, in the opt-out registry, or not."
In the Regulator's words, through its Chairperson, people who have not registered a block "are still protected by POPIA" and "by merely opting-out, a data subject cannot be regarded as having given consent". The Guidance Note says the same in paragraph 8.4: you cannot market to someone "simply because they (data subject) have not registered a pre-emptive block." The pre-emptive block itself comes from section 11 of the Consumer Protection Act.
So a person missing from the registry is not a person who has agreed to hear from you. Whether registering on the registry also counts as "previously withheld" consent under section 69(2), so that you may not even make your one approach, is an open question. We have not seen the Regulator or a court settle it. If you plan to ask cold contacts for consent, it may be prudent to check them against the registry, and worth taking advice on the point.
What should a sign-up form and a marketing message contain?
A sign-up form should ask for an active choice, say what you will send and how, and leave a record. Every marketing message should say who sent it and give a working way to stop. Most of this is visible on your website and in your email templates, so it is easy to check.
- Unticked boxes. The consent box must start empty. A separate box for marketing, not bundled with accepting your terms or submitting an enquiry.
- Specific wording. Name what you will send (for example, "legal updates on property and conveyancing, and invitations to our seminars") and the channel (email, SMS or WhatsApp). Form 4 asks for both.
- A record of consent. Store the date, the form or page, the exact wording shown and the channel chosen. Section 11(2)(a) puts the onus of proof on you.
- Sender identity and an exit. Section 69(4) requires every direct marketing message to identify the sender (or the person on whose behalf it is sent) and to give an address or contact details for asking that the messages stop. A one-click unsubscribe link meets the "free of charge" and "free of unnecessary formality" standard far better than "email us to be removed".
- A suppression list. When someone unsubscribes or refuses consent, keep the minimum details needed to make sure you do not contact them again, and record why you keep them.
Your privacy notice should explain marketing use and how to opt out. See what a law firm privacy notice must include. For tracking on the website itself, see cookie banners and POPIA.
What should you check before a year-end campaign?
Before you send, sort your list by how each contact got onto it, confirm the lawful route for each group, and check the message itself. The steps below take a few hours for most small firms and leave you with a record you can show if a complaint arrives.
- Export the list with its source. For each contact, record how and when the details were collected: matter intake, website form, newsletter sign-up, event, or purchased list. Contacts with no known source are the risk.
- Split clients from everyone else. Clients whose details were taken when you provided a service may fit section 69(3). Enquirers, event contacts and bought lists need consent under section 69(2).
- Check the evidence of consent. For the consent group, find the form wording, date and channel. An opt-out, an unticked default or silence is not consent under regulation 6. Drop anyone you cannot show consented.
- Check the customer conditions. For the client group, confirm they were offered a chance to object when their details were collected and that the content is for similar services. Remove anyone who objected.
- Apply your suppression list. Remove everyone who has unsubscribed or refused consent across every tool you use, including the email platform, the practice management system and any WhatsApp broadcast lists.
- Check the message. Confirm the firm's name appears as sender and that a working unsubscribe link or contact address is in every message, as section 69(4) requires. Test the link.
- Do not use the campaign to ask for consent twice. If you send a consent request to non-clients, remember section 69(2) allows one approach. Record who received it and who declined, and do not ask them again.
Breaches of POPIA can lead to complaints, enforcement notices and administrative fines; see how POPIA fines work and our wider POPIA compliance guide for 2026. Objections and complaints about marketing usually land with the firm's Information Officer; see how to register your Information Officer. For what the LPC allows in advertising itself, see the LPC Code on reviews, ads and testimonials.
Frequently asked questions
Is an opt-out enough for POPIA marketing consent?
No. Regulation 6 of the amended POPIA Regulations says that for direct marketing through unsolicited electronic communications, opt-out does not constitute consent under section 69(2). The existing-customer route in section 69(3) works differently and does rely on an opportunity to object.
Can a law firm send newsletters to existing clients without consent?
Possibly, under section 69(3), if the client's details were obtained in the context of providing a service, the newsletter markets similar services, and the client was offered a chance to object at collection and in every message. Enquirers who never instructed the firm are not customers. Take advice where the conditions are unclear.
Does section 69 apply to WhatsApp messages and phone calls?
A WhatsApp message fits POPIA's definition of electronic communication, and the Regulations list WhatsApp as a channel for consent requests. The Information Regulator's Guidance Note says ordinary telephone calls are also electronic communication. The Guidance Note is advisory, but it shows how the Regulator reads the Act.
What is Form 4 and do I have to use it?
Form 4 is the prescribed form for requesting consent to electronic direct marketing. Regulation 6 allows a form substantially similar to it, or any expedient manner, including email, phone, SMS or WhatsApp, provided consent is in writing or, for calls, recorded. An online form can work if it carries the same information.
How does the CPA opt-out registry affect my mailing list?
It adds a layer. The Information Regulator said in April 2026 that POPIA compliance is mandatory whether or not a person is on the opt-out registry. A person not on the registry has not consented. Whether registration counts as withholding consent under section 69(2) is not settled.
Can I email someone once to ask for consent?
Section 69(2) allows one approach to request consent, to a person who has not previously withheld it, in the prescribed manner and form. The request must not itself be the marketing message. If they decline or do not answer, you may not ask again.
Check your own forms
Most section 69 problems start on the website: a newsletter box that is ticked by default, a contact form that quietly adds enquirers to a mailing list, or no record of what people agreed to. Our law firm assessment checks your public forms, consent behaviour and privacy notice from the outside. If you are building a new site, Forge includes POPIA-ready forms from the start. getohdit is not a law firm and this article is not legal advice; for the customer exception and the registry question in particular, check your position with an attorney.
Primary sources
- Protection of Personal Information Act 4 of 2013 (sections 1, 11 and 69)
- Information Regulator: POPIA forms (Form 4)
- Information Regulator: Government Gazettes (POPIA Amendment Regulations, GN 6126, Government Gazette of 17 April 2025, regulation 6)
- Information Regulator: Guidance Note on Direct Marketing (December 2024; paragraphs 7, 8 and 11)
- Information Regulator media statement on the CPA Amendment Regulations 2026 (21 April 2026)