New Zealand’s anti-spam law is the Unsolicited Electronic Messages Act 2007, enforced by the Digital Messaging and Systems team at the Department of Internal Affairs. It is modelled on Australia’s Spam Act 2003 but written more simply, with broader definitions and fewer specific exceptions.
It reduces to three obligations the DIA itself calls the three steps: consent, identify, unsubscribe. The detail underneath them is where most senders get caught.
Does the Act apply to you?
It applies to any commercial electronic message with a New Zealand link — meaning the message is sent to, from, or within New Zealand. Your domain does not need to end in .nz. A US company emailing a New Zealand address is in scope.
A message is commercial if it markets or promotes goods, services, land, a business or an investment opportunity. Note that the goods being free does not make the message non-commercial — promoting a free product still counts.
Step 1 — Consent, and its three forms
New Zealand recognises three kinds of consent, and the differences matter more here than in most jurisdictions.
Express consent
The person actively agreed. Ticking a box, filling a form, saying yes. Verbal consent is valid under the Act — but keep a record, because of the burden-of-proof rule below.
Inferred consent
Reasonably inferred from an existing relationship. The DIA’s worked example is a business-card exchange: swapping cards at a meeting infers consent for messages relating to that relationship, not for general marketing.
The trap most senders fall into: you cannot infer consent from a single transaction. The DIA is explicit — if someone bought from you once, that alone does not entitle you to send them promotional email. You must seek express consent. A customer-satisfaction email two weeks after purchase is a commercial message needing consent, not a transactional follow-up.
Deemed consent
Applies where an address is conspicuously published by someone in a business or official capacity, the publication carries no statement refusing unsolicited messages, and your message is relevant to that person’s role, functions or duties. Trade directories and business websites qualify. It does not entitle you to send anything unrelated to their job.
The burden of proof sits on you
Section 9(3) puts the onus of proving consent on the sender. If a complaint is made, you must produce the evidence. This is the single most practical reason to keep source, timestamp and method against every address on your list.
What does not count as consent
- Emailing your database asking people to unsubscribe if they object. The DIA addresses this directly: silence is not consent, and the “click here to unsubscribe” email cannot establish it.
- Referrals from colleagues without the person’s knowledge.
- A third party’s business card handed to you by someone else. Phoning to ask is fine; emailing is not.
- Addresses gathered with harvesting software — separately prohibited by the Act.
Step 2 — Identify yourself
Every commercial message must clearly identify who authorised it and give accurate contact details so the recipient can reach you. Abbreviations are acceptable where they identify the business unambiguously.
Step 3 — The unsubscribe facility
The Act requires a facility that is:
- Clear and conspicuous
- Free to use
- Functional for at least 30 days after the message was sent
- Usable by the same method the original message was sent by — an email unsubscribe for email, a text unsubscribe for text
It does not have to be a button. The DIA confirms that a line such as “reply with UNSUBSCRIBE in the subject” satisfies the Act, provided the request is actioned in time.
The five working days, and when the clock starts
Unsubscribe requests must be actioned within five working days. The DIA is specific about the start point: the clock begins the day after the recipient uses the unsubscribe facility.
Two useful consequences. A “thanks for unsubscribing” confirmation is fine if sent inside the five days. So is an exit-survey email — but only within that window, because after it you no longer have consent to email them at all.
Once someone leaves, they are gone
The DIA’s gym example is worth internalising: a member who cancelled and unsubscribed cannot be sent win-back marketing a year later. You need fresh consent, and a re-engagement campaign to a lapsed New Zealand subscriber who unsubscribed is a breach. Compare that with the approach in our re-engagement email templates, which target dormant-but-still-subscribed contacts — a different group entirely.
Transactional messages — and a real difference from US law
A message that facilitates, completes or confirms a commercial transaction the recipient previously agreed to is not a commercial electronic message. Order confirmations, payment receipts and delivery notifications sit outside the Act.
Here is where New Zealand diverges from the United States in a way worth knowing. Under CAN-SPAM, loading a receipt with promotion can flip its primary purpose and cost you the exemption. The DIA takes a different line: you can attach promotional material to a genuine transactional message and it remains outside the Act.
That is a genuinely more permissive position, and it makes order confirmations a legitimate place to ask for consent for future marketing. See our order confirmation email templates — though if you also send to the US, build to the stricter CAN-SPAM standard and you are compliant in both. Background in CAN-SPAM explained.
Who is exempt
Messages about goods or services offered by a government body, court or tribunal are not commercial electronic messages. “Government body” is defined widely and includes Crown entities — which is why tertiary institutions emailing enrolled students fall outside the Act.
The exemption attaches to the content of the message, not the organisation. It is not a blanket licence covering everything a Crown entity sends.
Viral and refer-a-friend campaigns
If your company sends the message to the friend, it is unsolicited and you do not have their consent — that is spam. If your subscriber forwards your email themselves, that is generally fine, and the consent question sits between them and their friend.
The distinction is who does the sending. Campaigns that collect a friend’s address and email them on your behalf are the non-compliant version. The DIA also notes that a campaign encouraging people to forward to a hundred friends would not be reasonable.
Enforcement and penalties
The DIA investigates complaints and can issue formal warnings, seek enforceable undertakings, or apply to the High Court for civil penalties. The Act provides for penalties up to NZ$200,000 for an individual and NZ$500,000 for an organisation.
One feature that distinguishes New Zealand from the United States: an individual recipient can take independent action seeking compensation and damages, without going through the DIA. CAN-SPAM has no private right of action; New Zealand effectively does.
A practical compliance checklist
- Record source, timestamp and method for every address — the burden of proof is yours
- Never treat a single purchase as consent for marketing
- Ask for express consent inside your transactional emails, which is permitted here
- Keep the unsubscribe live for at least 30 days after each send
- Action unsubscribes within five working days, counting from the day after
- Never re-market to someone who unsubscribed, however long ago
- Use double opt-in where you can — the DIA recommends it. See double opt-in explained
- If you also send to Australia, the UK or the US, build to the strictest of them
Frequently asked questions
Does the UEM Act apply to overseas senders?
Yes. The Act covers messages with a New Zealand link — sent to, from, or within New Zealand. An overseas company emailing New Zealand addresses is in scope regardless of domain.
How long do I have to honour an unsubscribe in New Zealand?
Five working days, starting the day after the request. The unsubscribe facility must also stay functional for at least 30 days after the message was sent.
Can I email business addresses I found in a directory?
Often yes, under deemed consent — if the address was conspicuously published in a business capacity, carries no refusal statement, and your message is relevant to that person’s role. Unrelated marketing is not covered.
Is B2B email exempt in New Zealand?
No. There is no blanket B2B exemption as there is under UK PECR for corporate bodies. Business addresses are covered, though deemed consent frequently applies where the address is published.
Can I send a win-back email to someone who unsubscribed?
No. Once consent is withdrawn you may not send further commercial messages until you have fresh consent. The DIA is explicit on this point.
Related reading
- Email marketing services in New Zealand — platforms, NZD billing and local comparison
- Email marketing rules by country — how New Zealand compares to eight other markets
- CAN-SPAM explained — the United States
- CASL explained — Canada, and much stricter
- GDPR and email marketing — the EU and UK
Verified against Department of Internal Affairs guidance and the Unsolicited Electronic Messages Act 2007, September 2026. This is general information, not legal advice.
Bluey Email includes consent capture, one-click unsubscribe and suppression handling on every plan including the free tier — the mechanics the Act requires, without a compliance upgrade. Start free.