An opt-out registry check does not establish marketing consent

The Information Regulator’s April 2026 clarification, reaffirmed in its August enforcement briefing, is specific: absence from an opt-out registry does not remove POPIA’s consent requirements, and does not on its own satisfy the conditions of the existing customer exception for unsolicited electronic marketing.

That distinction matters because many businesses treat the registry check as the compliance step, when it is only ever part of the picture.

The Information Regulator’s August 2026 briefing marks its tenth year as a regulator, and five years since POPIA’s enforcement provisions commenced. It reported continuing direct marketing complaints, broader compliance concerns, and the overlap between the Consumer Protection Act and POPIA.

Two direct marketing matters, involving MTN and OUTsurance, have been referred to the enforcement committee concerning section 69 of POPIA, the provision governing unsolicited electronic marketing.

POPIA’s existing customer exception lets a business market similar products or services to someone who has already bought from them, without fresh consent, but only within defined conditions.

Treating any past transaction as a licence to market indefinitely, without checking those conditions still hold, is exactly the assumption the Regulator’s clarification is correcting.

Require lead suppliers and martech providers to produce evidence of the specific permission relied on for each contact, whether that is consent or the existing customer exception, rather than a general compliance assurance.

Require suppression records to be synchronised between supplier and buyer systems, so an opt-out recorded on one side is actually honoured on the other.

• Permission evidence per contact, not a blanket compliance statement.
• Synchronised suppression across every system that touches the list.
• Audit rights so you can verify the supplier’s claims independently.
• Remediation responsibility allocated before a complaint arrives, not after.

Marketing and data supply agreements should include warranties on the specific permission basis for each lead, audit rights letting you check the supplier’s compliance directly, and clear allocation of who bears investigation and remediation costs if a complaint follows.

Given that two enforcement referrals are already live over exactly this issue, treating this as a documentation exercise rather than a live commercial risk is no longer a safe assumption.