A consumer ticked a box on somebody else's website. You bought the record. Under the Unsolicited Electronic Messages Act, that consent may not be yours to rely on.
The question sounds technical and decides something practical: whether you can email or text a lead you just bought. The answer turns on a feature of the Act that is easy to miss, which is that consent is given to somebody.
This describes how the Act treats consent on transferred data. It is not legal advice, and the position on any particular consent wording is a question for your own adviser.
The Unsolicited Electronic Messages Act 2007 governs commercial electronic messages sent to a New Zealand address. Three requirements apply to every such message.
| Requirement | What it means in practice |
|---|---|
| Consent | The recipient consented, expressly or by inference from the circumstances |
| Sender identification | The message accurately identifies who sent it and how to contact them |
| Unsubscribe | A functional facility to opt out, honoured promptly |
The Department of Internal Affairs enforces the Act and publishes guidance on how it interprets these. The second and third are mechanical. The first is where purchased data creates difficulty.
Because consent is a permission given by a person to a sender for a purpose. When a consumer ticks a box on a comparison site agreeing to be contacted about their enquiry, the natural reading is that they agreed to hear from that operator, and from whoever that operator told them the enquiry would go to.
If the form told the consumer their enquiry would be passed to a licensed adviser who would contact them, a subsequent message from that adviser sits within what the consumer agreed to. If the form said nothing about onward supply, the position is much weaker, and a broker relying on it is relying on somebody else's wording that they have never read.
The practical test: Read the consent wording on the live form. If a reasonable consumer reading it would expect a message from a broker they have never heard of, you are on solid ground. If they would be surprised, the tick box is not doing the work you need it to do.
Express consent is a positive, specific act: a consumer says yes to receiving messages, in terms that cover the sender and the purpose. It is the strongest basis and the easiest to evidence.
Inferred consent arises from the circumstances, including an existing business relationship and the conspicuous publication of an address. It is a genuine basis, and it is fragile in a lead-buying context, because the circumstances being relied on are ones that arose between the consumer and a third party rather than between the consumer and you.
Australia handles the same problem with more explicit machinery, which is worth knowing if you operate in both markets. The Spam Act 2003 governs commercial electronic messages there, and ACMA has published detailed expectations for consent records: the method used to give consent, the terms of that consent, and the date and time it was obtained. ACMA can require production of those records on complaint.
ACMA also names specific practices as non-compliant, including relying on old consent and inferring consent from a one-off purchase. New Zealand has no equivalent published expectations at that level of detail, which means the practical burden falls on the parties to be able to show what was agreed.
Businesses remain responsible for reliable and well-maintained consent records that should include the method used to provide consent, the terms of consent, and the date and time consent was obtained.
ACMA, consent expectations for businesses using direct marketing
The Act covers electronic messages, meaning email, SMS and similar. A voice call is outside it, and New Zealand has no do-not-call register, so calling a consumer who submitted an enquiry does not raise the same question.
That does not make the call unregulated. IPP 3A of the Privacy Act 2020 still requires you to take reasonable steps to make the person aware that you hold their information and why, and the Code of Professional Conduct governs the advice once the conversation becomes regulated financial advice.
How Lead Foundry answers this: The consumer is told on the form that their enquiry goes to a licensed adviser who will contact them, which is the wording that makes your first message an expected one. Enquiries reach you within minutes of submission, so the consent you are relying on is fresh rather than historic.
Not automatically. Under the Unsolicited Electronic Messages Act 2007, consent is given by a person to a sender for a purpose. Whether a consent given on a supplier's form covers a message from you depends on what that form told the consumer. If it disclosed that the enquiry would be passed to a licensed adviser who would contact them, your message sits within what was agreed. If it said nothing about onward supply, the basis is much weaker.
Only where you have a consent basis covering you as the sender, and where the message accurately identifies you and carries a functional unsubscribe. The safest position is buying from a supplier whose form expressly told the consumer their enquiry goes to a broker or adviser, and asking to see that wording on the live page before you commit.
The Unsolicited Electronic Messages Act covers electronic messages rather than voice calls, and New Zealand has no do-not-call register, so a call to a consumer who submitted an enquiry does not raise the same consent question. IPP 3A of the Privacy Act 2020 still requires reasonable steps to make the person aware you hold their information and why, and the Code of Professional Conduct applies to the advice.
Express consent is a positive, specific agreement covering the sender and the purpose. Inferred consent arises from circumstances such as an existing business relationship. In a lead-buying context inferred consent is weak, because the circumstances being relied on arose between the consumer and your supplier rather than between the consumer and you.