Compliance
NZ business SMS rules: consent, opt-outs and what you can send
By Intact Media Last reviewed 8 min read
On this page
This guide is general information, not legal advice. For your specific situation, talk to a lawyer or check the Department of Internal Affairs guidance.
Which law covers business texts in NZ?
The Unsolicited Electronic Messages Act 2007 covers commercial electronic messages, including texts, emails and instant messages, sent from or to New Zealand. It is enforced by the Department of Internal Affairs.
The Act focuses on commercial messages: ones that market or promote goods, services, land or business opportunities. Purely factual messages about an existing transaction are treated differently.
What counts as marketing, and what doesn’t?
Usually not marketing (factual or transactional):
- “Sorry we missed your call, how can we help?” sent to someone who just rang you
- “Reminder: your appointment is tomorrow at 10:30 am”
- “Your technician is on the way”
- “Here is your quote as requested”
Usually marketing:
- “Book your winter heat pump service and get 10% off”
- “It’s been a year since your last clean, here’s a special rate”
- A newsletter or promotion sent to your whole list
Mixing a promotion into a reminder can turn it into a marketing message. Keep them separate.
What are the three rules for marketing texts?
- Consent. The person must have agreed to receive it. Consent can be express (they ticked a box or said yes), inferred from an existing relationship and conduct, or in limited cases deemed. Express consent is the clearest, so we recommend it.
- Identify yourself. The message must clearly say who sent it and how to contact you.
- Unsubscribe. Every marketing message needs a functional way to opt out, such as “Reply STOP to opt out”. You must honour it within five working days.
How should I collect consent?
- Add an unticked consent checkbox to your website forms: “Yes, send me occasional offers by text and email.”
- Ask at booking: “Can we text you about future specials? You can opt out any time.”
- Record it: when, how and what they agreed to. A good CRM stores this against each contact.
What does a compliant marketing text look like?
Ridgeline Plumbing: Winter hot water checks are now booking for July. Book online: [link] or reply BOOK. Reply STOP to opt out.
It names the business, is clearly an offer, gives a way to act and includes the opt-out.
What are the penalties?
The Act allows significant civil penalties for breaches, with higher maximums for organisations than for individuals. The Department of Internal Affairs can also issue warnings and formal notices. The reputational cost of annoying customers is often a bigger risk for a small business.
How does the Privacy Act fit in?
A mobile number is personal information, so the Privacy Act 2020 applies as well. Tell people why you’re collecting their number, use it for that purpose, keep it secure and let people access or correct their details.
How do we set this up in practice?
In the systems we build:
- Missed call text back and booking reminders are transactional and contain no promotions
- Marketing consent is a separate, unticked checkbox, stored with a timestamp
- “STOP” replies automatically unsubscribe the contact from marketing
- Every marketing template includes the business name and an opt-out
See workflow automation for how follow-ups and reminders are built, or missed call text back for the simplest place to start.