Is my email marketing legal?

A customer list is one of the most valuable things a small business owns. New Zealand's anti-spam law, the Unsolicited Electronic Messages Act 2007 (UEMA), sets the rules for using it. The good news: the rules are short and mostly common sense.

What counts as a commercial electronic message?

The Act covers electronic messages (email, text/SMS, MMS and instant messages) whose purpose is commercial: marketing or promoting goods, services, land or a business, or helping someone get money or goods. It applies to messages with a New Zealand link: sent from New Zealand, or sent to someone here.

Normal phone calls aren't covered, and neither are purely informational messages, such as a receipt or an update on an order the customer already made, provided they don't include marketing.

Do I need consent to send marketing?

Yes. You need the recipient's consent before you send a commercial message. The Act recognises three kinds:

• Express consent. They ticked a box, filled in a sign-up form or asked to hear from you. This is the gold standard. Keep a record of when and how they signed up.
• Inferred consent. It's reasonable to infer consent from your relationship with them and their conduct, for example an existing customer who has bought from you and gave you their email address in the process.
• Deemed consent. Someone publishes their work email address conspicuously (say, on their business website), doesn't say they don't want marketing, and your message is relevant to their business role.

If you're relying on inferred or deemed consent, be conservative. When in doubt, ask.

Do I have to say who I am?

Every commercial message must clearly identify who authorised it and give an accurate way to contact them. Your business name and a real email address or physical address is the practical minimum.

How easy does unsubscribing have to be?

Every commercial message must include a working unsubscribe facility, free of charge to use. When someone unsubscribes, you must honour it within five working days. "Reply STOP" for texts and a one-click link for email are the usual approaches.

What does the Act ban outright?

• Buying or using lists created with address-harvesting software, or harvested lists themselves.
• Sending commercial messages to people who haven't consented, even if their address was easy to find.

Who enforces the spam law?

The Department of Internal Affairs (DIA) enforces the Act and investigates complaints. Penalties can be serious: the courts can impose civil penalties of up to $200,000 for an individual and $500,000 for an organisation, and DIA can also issue formal warnings and infringement notices.

How do I check my list in five minutes?

1. Is every address on your list there by sign-up, a real customer relationship, or a relevant published work address?
2. Can you show when and how each person signed up?
3. Does every email and text name your business and give a real contact?
4. Does the unsubscribe link work, right now? Test it.
5. Are unsubscribes removed within five working days, including from any other tools you sync with?

Does the Privacy Act apply too?

Your list is also personal information under the Privacy Act 2020. Tell people what you're collecting and why, keep it secure, and only use it for the purpose you collected it for.

MySMB practises what it preaches: we only email people who sign up, and every issue has a one-click unsubscribe.