Your WhatsApp broadcast list is now a regulated activity
Since 15 April 2026, customer consent is no longer the whole answer to direct marketing in South Africa. Here is what changed, what it costs, and what to fix this month.
Thandi runs a skincare brand from a small studio in Randburg. She has 1 800 customers on a WhatsApp broadcast list and another 3 000 on an email list built from her online checkout. Every one of them ticked a box agreeing to hear from her. She has a privacy policy. She thinks she is covered.
Six months ago, she would have been close. Today, she is not.
What changed
On 15 April 2026, the Minister of Trade, Industry and Competition published the Consumer Protection Act Amendment Regulations, 2026. They came into effect the same day. The regulations give practical effect to a right that has sat in section 11 of the Consumer Protection Act since 2011: the right of any person to refuse unwanted direct marketing.
The mechanism is a national opt-out registry, run by the National Consumer Commission (NCC). Any person can now register a "pre-emptive block" against unwanted electronic direct marketing. They can block everything, or be selective: a particular company, a whole industry, a channel such as SMS or WhatsApp, or a period of time.
For businesses, the regulations create three standing obligations. You must register with the NCC as a direct marketer before you market. You must renew that registration every year. And every month, before you run a campaign, you must check your marketing database against the registry and remove anyone who has registered a block.
Consent is no longer the whole answer
This is the part most founders will miss.
Under POPIA, electronic direct marketing generally needs the recipient's consent, or must fall within the narrow "existing customer" exception. Most businesses built their marketing around that rule, and they were right to.
The registry adds a second layer on top. The NCC has clarified that a registered block overrides earlier marketing consent. If one of Thandi's customers ticked the box at checkout in March, then registered a block in September, Thandi may not market to that customer until the block is removed through the registry. The tick box does not save her.
So the question is no longer only "did they agree?". It is also "have they since told the registry no?".
What it costs
The 2026 fees are modest on their own, but they are recurring:
Registration as a direct marketer: R2 574
Annual renewal: R1 930,50
Monthly database cleansing: 12 cents per record
For Thandi's 4 800 contacts, the monthly cleanse comes to R576. Over a year, cleansing alone is R6 912, before registration and renewal. That is not a reason to stop marketing. It is a reason to know exactly who is on your lists and why, because every stale contact now costs money every month.
The cost of getting it wrong is higher. The Consumer Protection Act allows administrative fines of up to R1 million or 10% of annual turnover, whichever is greater.
Who this catches
The regulations define a direct marketer broadly, regardless of channel. SMS, email, WhatsApp, telephone campaigns and outsourced call centres are all in scope.
If you sell to other businesses, do not assume you are outside it. There is a respectable argument that the opt-out protection extends to all juristic persons, including large companies on the receiving end of B2B marketing. That point is not settled, but a B2B founder who ignores it is betting on the narrower reading.
What is still unclear
The regulations are in force, but the machinery is still catching up. The NCC has said further implementation guidance is coming, and at the time of writing it had not announced a firm registration or compliance deadline. Commentators are also still debating how enforcement will work in practice.
None of that is a reason to wait. The obligations exist now. The businesses that will find the transition easy are the ones that tidy their lists before the deadline arrives, not after.
What to do this month
List every list. WhatsApp broadcasts, email platforms, CRM exports, the spreadsheet from last year's expo. If you market to it, it counts.
Record where each contact came from. Note how and when each person agreed to hear from you. POPIA still applies, and the registry does not replace it.
Identify yourself in every message. Your business name, physical address, email address and contact number should appear on every marketing communication.
Check the NCC eServices portal and register as a direct marketer as soon as registration is available to you.
Put the monthly cleanse in your campaign calendar. No campaign goes out until the list has been checked that month.
Update your privacy policy and consent wording. Customers should be told how you use their details for marketing and how they can opt out, both with you directly and through the registry.
Put it into practice
Step 6 starts with your privacy policy. It is where your customers learn how you use their details and how to stop you. Our Privacy Policy & Cookies Policy Template (POPIA-Compliant) gives you a South African-drafted starting point you can adapt today.
This article is legal information, not legal advice. It reflects the position as at 1 October 2026. If you need advice on your specific marketing practices, speak to a qualified legal practitioner.
Comments