WASPA & POPIA SMS Compliance: A Practical Guide

Under POPIA Section 69, you may not send marketing SMS by electronic communication unless one of two things is true: the person has consented, or they are an existing customer and the message meets the conditions below. WASPA mirrors this — a member may only market to someone who has given consent (§16.9) or who falls under the existing-customer exception (§16.10); marketing on any other basis is not permitted (§16.11).

Consent means a voluntary, specific and informed agreement to receive the marketing (WASPA §16.1). Silence, pre-ticked boxes, or “we added you because you bought once” do not count as consent on their own — that second case is the separate existing-customer route, with its own conditions.

The existing-customer exception (§16.10): you may market to a person without fresh consent only if you obtained their contact details in the context of a sale, you are marketing your own similar products or services, and they were given a clear, free, no-hassle chance to opt out both when you collected their details and in every message since. Miss any part of that and you’re back to needing consent.

Under POPIA Section 69 you may also approach a person to ask for consent only once — if they decline or don’t respond, you can’t keep asking.

Practitioner takeaway: keep a record of how and when each recipient consented (or qualified as an existing customer). WASPA §16.13 lets a recipient demand to know where you got their number and proof of consent — you need to be able to produce it.

→ Not sure if your list qualifies? The compliance checker flags the mechanical issues in a draft; the consent question is one to resolve before you send.

This is the rule most often broken, and the one most likely to land a complaint.

You must offer a working opt-out. A recipient must be able to opt out of further marketing SMS by replying STOP (WASPA §16.15). If a reply-STOP isn’t technically feasible, clear opt-out instructions must appear in the body of every marketing message. Subscription, notification and other bulk SMS services must have a functional opt-out procedure including reply-STOP (§17.1).

You must honour the obvious variants. If someone replies END, CANCEL, UNSUBSCRIBE or QUIT, treat it exactly like STOP (§16.16). The same applies if you told them to use a different word (§16.16A), regardless of capitalisation — STOP, Stop, stop and sToP are identical (§16.16B). If the service runs in another language, the equivalent of STOP in that language must also work (§16.16C).

You can’t charge for it, and you must confirm it. You may not charge a fee to process an opt-out or block request (§16.7). Once someone opts out, you must send a free confirmation message naming the marketing they’ve left (§16.14).

You must respect existing blocks. You may not market to anyone who has submitted an opt-out request to you, or who has registered a pre-emptive block with a registry established by the National Consumer Commission or by WASPA (§16.5). Block only the marketing — not their transactional or commercial messages (§16.5A). If a block is limited to one service, you may apply it only there; if it isn’t clearly limited, treat it as covering all your marketing (§16.6).

→ The checker flags a draft that has no STOP/opt-out instruction.

If a recipient asks, you must — within a reasonable time — tell them where their contact details came from, and provide proof that they consented to receive the message, or proof that they gave you their details in the context of a sale of the same kind of product or service you’re marketing (WASPA §16.13). This is why the consent record in Section 1 matters: §16.13 is the moment you have to produce it.