Lize de la Harpe, Senior Legal Advisor at Sanlam
The Consumer Protection Act (CPA) Amendment Regulations, 2026, gazetted on 15 April 2026, introduced a mandatory national Opt-Out Registry to curb unsolicited direct marketing.
Comment has now been invited on draft Guidelines for Compliance with the Opt-Out Registry’s Regulations as published on 2 October 2026.
Let’s unpack.
Recap
Section 11(3) of the CPA provides that the National Consumer Commission (the Commission) may establish a registry in which any person may register a pre-emptive block, either generally or for specific purposes, against any communication that is primarily for the purpose of direct marketing.
Section 11(6) of the CPA empowers the Minister of Trade, Industry and Competition to prescribe regulations for the operation of such a registry as contemplated in section 11(3).
Section 120 in turn provides a broader regulation making framework, including the provisions relied upon for regulations expressly authorized or contemplated by the CPA, procedural and administrative matters concerning Commission functions and ancillary matters.
The Opt-Out Registry regulations published earlier this year mainly amended Regulation 4 of the CPA Regulations published in 2011, which dealt with mechanisms to block direct marketing communications. In essence, it operationalized the Opt-Out Registry and introduced new registration requirements for direct marketers, compulsory database cleansing and compliance with pre-emptive blocks (among other things).
As of 15 April 2026, where a communication constitutes direct marketing and the consumer has registered a pre-emptive block on the Opt-Out Registry applicable to that communication, the direct marketer must respect the block. Direct marketers also have the duty to “cleanse” their consumer contact lists every month when it has planned or intends to do direct marketing during that month against this Opt-Out Registry.
“Cleansing” refers to the process by which a direct marketer removes from its database all consumers who have opted out of receiving direct marketing, thereby ensuring that such consumers are no longer contacted.
The draft Guidelines
The draft Guidelines provide practical guidance on compliance with the amended regulations governing the National Opt-Out Registry. It applies to all goods and services that a direct marketer wants to market directly to consumers, irrespective of the industry under which such direct marketer falls. As such it equally applies to insurers, financial institutions, and any other person promoting goods or services directly to consumers.
In terms of the amended regulations every direct marketer must register with the Opt-Out Registry before conducting direct marketing. Albeit mandatory, this registration is purely an operational requirement; it is not a professional or business license being granted.
Registration will give the direct marketer access to the Opt-Out Registry thereby enabling it to cleanse its customer database. With regards to the “cleansing” process, a direct marketer is required to submit its lists of consumer databases (as in, the lists of consumers that it intends to do direct marketing to during the month that it intends to do direct marketing). The system will then automatically cross-check the list with the Opt-Out Registry and identify consumers who have registered a pre-emptive block against a direct marketer. The direct marketer must a pay cleansing fee of 12 cents per entry/name of a consumer who has registered a pre-emptive block, and after payment, a cleansed list will be provided showing consumers who have registered pre-emptive blocks. The direct marketer must then remove all blocked consumer names from its marketing lists. These cleansed lists will remain valid for 30 days.
It is worth noting that the registering of a pre-emptive block by a consumer does not automatically mean a blanket prohibition. The scope of the prohibition must be determined with reference to the type and purpose of the block registered by the consumer. There are two types of pre-emptive blocks:
- A general pre-emptive block by which a consumer indicates that the consumer does not wish to receive direct marketing in general, and
- A specific pre-emptive block that is limited to a specified purpose, category, marketing channel, or marketer, and includes a sector specific pre-emptive block.
Can previous consent override a pre-emptive block?
The moment a consumer registers a pre-emptive block, any previous consent to direct marketing becomes invalid. Conversely, fresh consent does not override an existing pre-emptive block. A direct marketer should therefore not assume that previous or fresh consent automatically permits direct marketing contrary to a registered block.
POPIA vs CPA
In terms of the Protection of Personal Information Act, 2013 (POPIA) responsible parties are required to ensure that all processing of personal information is lawful – and in order to be lawful, it must comply with the conditions as set out in POPIA.
POPIA defines “direct marketing” as approaching a data subject, either in person or by mail or electronic communication, for the direct or indirect purpose of promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject or requesting the data subject to make a donation.
When direct marketing is conducted by means of unsolicited electronic communications, additional rules apply – these are set out in section 69. In essence, section 69(1) prohibits direct marketing by means of unsolicited electronic communications unless certain conditions are met.
These conditions are as follows:
1. Where the data subject has given consent, or
2. Where the data subject is a customer of responsible party if:
a. the responsible party obtained the contact details of the data subject in the context of the sale of a product or service; and
b. for the purpose of direct marketing of the responsible party’s own similar products or services; and
c. the data subject has been given a reasonable opportunity to object free of charge.
“Consent” in the context of POPIA is a specifically defined concept. For such consent to be valid, it must be an expression of will, given voluntary, be specific, and be informed.
Whilst the CPA and POPIA regulate different but related aspects of direct marketing and the protection of consumers’ personal information, one could argue, however, that the amended regulations which implies an opt-out of direct marketing is in conflict with section 69 of POPIA in terms of which you need a data subjects’ consent (opt-in) to direct market to them by means of unsolicited electronic communication (unless they are an existing customer).
Nevertheless, the Commission believes these two frameworks are complementary and should, where applicable, be interpreted harmoniously.
Comments have been invited on the draft Guidelines on or before 19 October 2026.
Conclusion
The way businesses conduct direct marketing has significantly shifted. Registering on the opt-out registry is merely the first step in complying. Further steps include reviewing direct marketing strategies, updating customer documentation, cleansing customer data lists and reviewing existing lead referral arrangements, to name a few.
Businesses conducting direct marketing cannot afford to drop the ball on this – non-compliance with the provisions of the CPA have serious consequences, including criminal prosecution.
ENDS
