A boutique owner we work with in Woodstock sent a WhatsApp broadcast to 2,400 numbers on a Friday afternoon last winter. The message was a 20% long-weekend voucher. By Monday she had cleared two months of stock and received four replies that were variations on "take me off this list, I don't know who you are". One of those four found the Information Regulator's complaint form before lunch.

She had bought every one of those numbers from a trade-show organiser in 2022. She had always meant to go through them properly. The broadcast was the first thing she had ever actually sent.

This is the shape of most POPIA marketing problems in South Africa. Not malicious. Not reckless. Just the quiet gap between what the Act actually requires and what everyone assumes it requires. If you are an SA owner running WhatsApp broadcasts, email campaigns on Everlytic or Mailchimp, or SMS blasts through BulkSMS, the rules below are the ones that matter in practice. The rest is noise.

The one section that governs marketing

POPIA has 115 sections. For marketing purposes you need to read one of them properly: Section 69. It applies to electronic communication, meaning SMS, email, automated calling, and in practice WhatsApp. Section 69(1) says you may not send someone an electronic marketing message unless one of two conditions holds.

The first: they consented, in the prescribed form, to receive that kind of message from you.

The second: they are an existing customer, you got their contact details in the context of a sale, you are now marketing a similar product or service of your own, and they have had a reasonable opportunity to object both at the point of collection and on every single message since.

That is the whole legal framework. Everything else, including the Information Regulator's guidance, the Form 4 debates and the WhatsApp Business API rules, sits on top of these two paths. Figure out which path each contact of yours is on, and you have ninety percent of the compliance work done.

"They gave me their number, so I can message them, right?"

No.

This is the single most common misunderstanding we see in SA SMEs. A phone number entering your database is not consent to be marketed to. A business card dropped in a fishbowl at a Hyde Park launch is not consent. A delegate list bought from a conference organiser is not consent. A WhatsApp enquiry about one specific service from a prospective customer is not consent to be swept into your Friday promotions broadcast.

Consent under POPIA Section 11 read together with Section 69 has to be voluntary, specific and informed. In practice that means a clear statement at the point of collection of what you are capturing the contact for, a separate marketing action that is not bundled with "I accept the terms", and a stored record of what the person actually agreed to, including the wording they saw and the date. If you cannot produce those three artefacts for a given number on your list, you are standing on the second path, not the first. And the second path is narrower than most owners think.

The "existing customer" path, read carefully

Section 69(3) is the lifeline for small businesses that have been running on customer relationships for years without a formal marketing opt-in. It is also where people over-reach.

The subsection permits marketing to an existing customer only when three things are true together: the contact details were obtained in the context of a sale, the marketing is for a similar product or service of your own, and the customer has been given a reasonable opportunity to object, free of charge, when their details were first collected AND on every subsequent communication.

Read that last point again. Every single communication must carry a free, easy way to say stop. In email that is the unsubscribe link, and nobody argues about it. In WhatsApp it is harder, because you have to put the opt-out in the message body itself, not hide it in a status update. "Reply STOP to opt out" at the end of every broadcast is not optional. It is the price of staying on the customer exception.

A Pretoria boutique I know sends an opt-out line in every third broadcast. The thinking was that it felt aggressive to put it in every single one. The law does not care how it feels. Every single message. No exceptions.

WhatsApp: Meta's rules sit on top of POPIA

If you are using the WhatsApp Business API through a provider like 360dialog, Infobip or Clickatell, you have a second rulebook layered on top of POPIA: Meta's own commerce policies. The two overlap but are not identical. Three practical consequences follow.

First, the twenty-four-hour customer-service window. If a customer messages you first, you have twenty-four hours to reply freely without using a pre-approved template. Outside that window every proactive message you send must be an approved template, categorised at creation as utility, authentication or marketing. Marketing templates require the recipient to have opted in to marketing content under Meta's own rules, which is already a stricter test than Section 69.

Second, Meta explicitly requires an opt-out option in marketing template messages. It will throttle or ban numbers that generate repeated "block" events from recipients. If POPIA will accept "Reply STOP", Meta prefers that plus a formal opt-out button on the template. In my experience the Meta policing of this is tighter than the Information Regulator's.

Third, the WhatsApp Business App, the free phone-based app that is not the API, has no templates but also no scale. It caps a broadcast list at about 256 contacts. If your "WhatsApp marketing" is a copy-paste broadcast from the Business App to 1,500 saved contacts, you are breaking the terms of service of the app you are using before POPIA even enters the room. We see this constantly with owner-run salons, bakeries and small clothing brands who have grown past the limit without noticing.

What you cannot do, in plain language

The following are specifically outside the law, regardless of what the dashboard lets you click.

Buying a list of numbers from a lead-generation service and messaging them, even once, with marketing content. The one-shot consent request allowed under Section 69(2) must be in the prescribed Form 4, a legal form, not a WhatsApp message with a smiling emoji.

Importing an old Mailchimp list of 8,000 contacts from 2019, where you cannot locate the original opt-in records, into Everlytic or Zoho Campaigns and continuing to mail them. The export of the list did not fix anything about the state of the consent beneath it.

Scraping LinkedIn profiles for professionals in a target industry and running a WhatsApp "introduction" sequence against the numbers you found elsewhere. The fact that the profiles are public does not make Section 69 go away. Section 69 is about the sending, not the sourcing.

Treating a customer's enquiry about a bedside table as consent to receive weekly furniture promotions, lifestyle content and a Christmas discount campaign. The sale of a bedside table is not consent to be in a general marketing database.

What you can do without new consent

Not everything requires a fresh opt-in. Transactional and service communication sits outside Section 69 entirely. A payment confirmation, a delivery notification, an appointment reminder, a WhatsApp order status update from a Takealot seller, an invoice follow-up: these are not marketing. The customer is being contacted because of a current transaction with you, not solicited to buy more.

The line between service and marketing gets blurry quickly. A reminder that your car service is due at 10,000km is service. A reminder that your car service is due, and by the way we are also running winter tyre specials this month, is a marketing message dressed in service clothing. Keep them separate, even when the system lets you combine them.

Review requests after a transaction are generally defensible as service, provided they are triggered by the transaction and happen once. A "please rate us" sent 72 hours after the Yoco payment went through sits on the service side. The same request repeated weekly until the customer responds has become marketing by volume.

A database you can actually defend

Here is the posture most of our SA SME clients end up at. It is not legally watertight, only a lawyer can tell you that for your specific business, but it survives the first Information Regulator letter in a believable form.

Every contact in your marketing database has a source field: web form, WhatsApp enquiry, walk-in, existing customer, trade-show opt-in. Every source has a stored copy of the exact wording the person saw before their details were captured. Every marketing message has a working unsubscribe mechanism in the message itself, not in a privacy policy linked from the footer.

Legacy numbers you cannot source, the Excel sheet from 2019, the trade-show scrape, the Woodstock boutique's bought list, do not go into your broadcast tool at all. They either get a one-time Form 4-compliant consent request through a non-electronic channel, or they stay unused. The decision to delete them is cheaper than the decision to use them and defend it later.

Honest take: the SA businesses that handle this well treat their marketing database as an asset that needs auditing once a year, like a stock take. The ones that have problems treat it as an archive that only grows. Which approach you take is the single biggest predictor of whether your Friday broadcast is a sale generator or a complaint generator.

The Woodstock client, by the way, now runs a 1,900-person opt-in list. It generates more revenue per broadcast than the 2,400-row list ever did. The Regulator complaint went nowhere because she answered the letter within the window, deleted every unsourceable number, and could show the new consent flow.

That is the shape of these stories, when they end well.