Texting customers in NZ: what the law says

General information, not legal advice. This guide is a plain-English summary. For your own situation, read the Acts themselves or talk to a lawyer.

Which laws apply when you message customers?

• The Unsolicited Electronic Messages Act 2007, New Zealand's anti-spam law. It covers commercial electronic messages, including email, text messages and instant messages like WhatsApp.
• The Privacy Act 2020, which covers how any business collects, stores, uses and shares personal information, including names, numbers and job details.

If you use WhatsApp, Meta's own business rules apply as well. See our guide to WhatsApp Business for tradies.

What counts as a commercial electronic message?

Broadly, a message whose purpose includes marketing or promoting goods or services: a special offer, a "we're running a winter deal" text, or a newsletter.

The Act treats some messages differently. Messages that only provide a quote or estimate the person asked for, or that confirm a transaction they've already agreed to, are generally not treated as commercial electronic messages. Replying to someone's enquiry about a job is very different from sending them a promotion.

Do you need consent?

For commercial electronic messages, yes. The Act recognises three kinds of consent:

• Express consent: the person clearly said yes, for example by ticking a box or asking to hear from you.
• Inferred consent: it's reasonable to infer from their conduct and your business relationship that they're happy to hear from you.
• Deemed consent: in limited cases, where someone has published their address conspicuously for business purposes, without saying they don't want messages, and your message is relevant to their role.

If you're not sure you have consent, don't send the marketing message.

What must every message include?

• Who it's from. Accurate information about the business that sent it and how to contact you.
• A way to unsubscribe. A working unsubscribe option, like replying STOP, that's free and easy to use.
• Action on unsubscribe requests. Once someone unsubscribes, you must stop. The Act requires this within five working days.

Can you buy a list of numbers?

Don't. The Act prohibits using address-harvesting software, or lists made with it, to send unsolicited commercial messages. Bought lists also tend to get WhatsApp accounts reported and restricted.

What does the Privacy Act 2020 require?

The Privacy Act sets out 13 information privacy principles. For a business messaging customers, the key ones in practice are:

• Only collect what you need for a lawful purpose connected to your business.
• Tell people why you're collecting their information and what you'll do with it.
• Keep it secure against loss and misuse.
• Let people see and correct the information you hold about them.
• Use it for the reason you collected it, and don't hand it to others without a good reason.
• Take care sending it overseas. The Act has rules for disclosing personal information outside New Zealand.

If a privacy breach is likely to cause someone serious harm, you must tell the Privacy Commissioner and the affected people as soon as practicable. Every business must also have someone acting as its privacy officer.

Who enforces these laws?

The Department of Internal Affairs enforces the Unsolicited Electronic Messages Act. The Office of the Privacy Commissioner oversees the Privacy Act and has guidance for small businesses.

How does Conversiq handle this?

We built Conversiq around six house rules, including:

• It only messages people who contacted your business first. No cold lists or blasts.
• Every message comes from your verified WhatsApp Business profile, under your name.
• Replying STOP ends messages on SMS and WhatsApp, and only the customer can opt back in.
• Your data is never sold, shared or used to train shared AI models.

Conversiq is designed to comply with both Acts. Read all six house rules.

Keep reading