We’ve all been there. You’re having a perfectly good Tuesday, and suddenly your phone rings. It’s an ‘087’ number. You answer, and a very enthusiastic stranger named “John” wants to know if you’ve thought about your funeral cover. Or maybe you wake up to an AI-generated WhatsApp voice note from a company you’ve never heard of, offering 10% off car parts. You don’t even own a car.
South Africans are gatvol of unwanted marketing. But here is the good news: under the Protection of Personal Information Act (POPIA), you hold all the cards. Here is how companies are breaking the law, and exactly how you can shut them down.
How a Company Breaks POPIA (The “Don’ts”)
From a legal perspective, here are the most common ways companies are stepping on your privacy:
- AI-Generated WhatsApp & Voice Notes
The Breach: Blasting automated voice notes or messages to your WhatsApp without your opt-in.
Why it’s illegal: WhatsApp is electronic communication. Sending automated marketing to a “cold” number without prior, express consent is a massive violation. - The “Cold” Email Hammering
The Breach: Sending you “just checking in!” emails when you have never done business with them.
Why it’s illegal: POPIA allows a company to reach out to you exactly once to ask for your consent to market to you (the “One-Strike Rule”). If you ignore them or say “No,” and they keep hammering your inbox, they are breaking the law. - Buying “Leads” Lists
The Breach: Buying a database of names, numbers, or emails from some shady third party.
Why it’s illegal: You did not give consent for their specific company to use your data. Scraping LinkedIn or websites for your email to add you to a newsletter is also a massive no-no. - “Soft Opt-In” Abuse
The Breach: You WhatsApp a business to ask, “What are your prices?” Suddenly, you are subscribed to their weekly newsletter until the end of time.
Why it’s illegal: Consent must be specific. Asking a question does not mean you consented to a lifetime of marketing spam. - The Missing “Unsubscribe” Button
The Breach: Sending marketing material that doesn’t have a clear, free, and easy way to opt out.
Why it’s illegal: Every single marketing communication must provide a way for you to object. If you have to jump through hoops to leave, they are in breach.
FAQ: The “Public Domain” Myth & The “Panic Delete”
“But my number is on my company’s Google page! Doesn’t that mean they can call me?”
Absolutely not. Having your number in the public domain is not a blanket license for spam. Under Section 13 of POPIA, information must be collected for a “specific, explicitly defined” purpose. You put your number on Google so clients can call you for quotes—not so a random agency can pitch you SEO services. Furthermore, the Information Regulator confirmed in December 2024 that telemarketing calls are treated as “electronic communications.” They still need your consent.
“What if they ‘Delete for Everyone’ on WhatsApp after I threaten them with POPIA?”
Ah, the classic panic delete. They realized they were on thin ice. Deleting the message doesn’t erase the infringement. If you want to put the final nail in the coffin:
- Keep the receipts: Take screenshots before they delete. Your phone’s call logs also prove the “hammering.”
- The Right to be Forgotten: Reply with this exact phrase: “I see the messages have been deleted. Pursuant to Section 24 of POPIA, I am formally requesting that you permanently delete all my personal information from your database using Form 2, and confirm in writing that I am on your ‘Do Not Contact’ list.”
- The Mic Drop: If they bother you again, do not engage. Go straight to the Information Regulator’s website and lodge a Form 5 complaint. It’s free, and it forces the company to answer to the government. (Fines can reach up to R10 million, which usually sobers them up real quick).
Pro-Tip: If a telemarketer won’t stop talking, just say:
“Please provide me with your Information Officer’s details and tell me how you obtained my personal information.” Watch how fast they hang up.