Marketing rules every New Zealand business should know: advertising claims, spam and privacy

This is general information, not legal advice. For anything specific, talk to a lawyer or the regulator named below.

The short answer

Do not make claims you cannot back up, only send marketing messages to people who have agreed to receive them, and treat personal information carefully. Those three habits cover most of what the Fair Trading Act, the Unsolicited Electronic Messages Act and the Privacy Act 2020 ask of a typical business.

1. Advertising claims: the Fair Trading Act

Under the Fair Trading Act, businesses cannot make false or misleading statements about things such as price, quality, origin, uses, benefits or endorsements. The Commerce Commission enforces it and can warn or prosecute a business.¹

There is also a "reasonable grounds" idea. A claim you cannot back up with evidence can breach the Act even if it later turns out to be true.¹ In practice:

• Keep the evidence for any claim you publish: results, rankings, "best" or "number one", savings.
• Only publish testimonials and results that are real and that you can show.
• Be accurate when comparing yourself to competitors, and do not advertise fake discounts.

2. Emails and texts: the spam law

The Unsolicited Electronic Messages Act 2007 is New Zealand's anti-spam law, enforced by the Department of Internal Affairs. Businesses must make sure they do not send spam, and a failure to comply can mean a fine of up to $500,000.² The law is built around three obligations: consent, identifying who the message is from, and a working way to unsubscribe.²

• Only message people who have agreed to hear from you. Buying a list is not consent.
• Say clearly who the message is from.
• Include an unsubscribe option that works, and honour it.

3. Personal information: the Privacy Act 2020

The Privacy Commissioner says businesses and organisations that operate in New Zealand and collect personal information need to follow the Privacy Act, and that every agency must have a privacy officer.³ That includes sole traders, and it includes your website forms, your email list and your customer records.

• Collect only what you need, and say why you are collecting it.
• Keep it secure and do not keep it longer than you need to.
• Publish a privacy policy that matches what you really do. Mine is here, as an example of the level of detail to aim for.
• Let people see and correct their information if they ask.

A quick checklist

1. Can I prove every claim on my website and in my ads?
2. Does everyone on my email and text list know they are on it and why?
3. Does every marketing message identify me and let people opt out?
4. Do my forms say what I will do with the details?
5. Do I have a named privacy officer and a current privacy policy?

Where to go for help

The Commerce Commission covers advertising claims, the Department of Internal Affairs covers spam, and the Office of the Privacy Commissioner covers privacy. If you are unsure about a particular campaign, ask a lawyer before it goes out. If you want your ads and website checked for these basics as part of a wider plan, see my strategy work.

References

1. Misleading prices or advertising. Consumer Protection (NZ Government). Accessed 5 October 2026.
2. What anti-spam law means for businesses. Department of Internal Affairs. Accessed 5 October 2026.
3. Complying with the Privacy Act. Office of the Privacy Commissioner. Accessed 5 October 2026.