New Zealand

Is cold email legal in New Zealand?

Yes, business-to-business cold email is lawful in New Zealand, provided you meet the conditions in the Unsolicited Electronic Messages Act 2007. The Act is more permissive than European rules and stricter than many people assume — the obligations are specific, and the Department of Internal Affairs does enforce them.

This is not legal advice. It is a plain-language summary of publicly available legislation, written to help you ask better questions. Rules change, enforcement practice varies, and your circumstances may differ. If cold outreach is material to your business, have a lawyer in the relevant jurisdiction review what you are doing.

What the Act requires

A form of consent. The Act recognises express consent, and also inferred consent — which is where most legitimate B2B outreach sits. Consent can be inferred where a business has conspicuously published a work-related address without a statement that it does not want unsolicited messages, and your message is relevant to that person's work.

Accurate sender identification. The message must clearly identify who sent it and include accurate contact details. Anonymous or disguised outreach is prohibited outright.

A functional unsubscribe facility. Every commercial electronic message must include a working way to opt out, and requests must be honoured — the Act requires this to be actioned promptly.

No address-harvesting software. The Act specifically prohibits using automated harvesting tools and harvested-address lists. This matters directly: it makes how you sourced the list a legal question, not just a quality one.

The part that catches people out

Inferred consent is not a blank cheque. It depends on the address being conspicuously published and on your message being relevant to the role of the person it reaches.

Writing to admin@ at a plumbing company about plumbing software is a reasonable reading of relevance. Writing to a published address about something unrelated to that person's work is not, and neither is writing to an address you obtained from a harvested list rather than from the business's own publication.

Penalties

The Act provides for civil pecuniary penalties, with the maximum figure for an organisation substantially higher than for an individual. The Department of Internal Affairs investigates complaints and has publicly reported enforcement action and settlements. Complaints from recipients are the usual trigger — which is another reason a single spam complaint deserves attention rather than a shrug.

Practical compliance

Source addresses from the business's own published material — their website, a directory they listed themselves in, a trade register. Not from purchased or harvested lists.
Write to the role. Relevance to that person's work is part of the legal basis, not just good manners.
Identify yourself properly — real name, real business, real reply address, and a way to verify you exist.
Include a plain opt-out in every message. A clear sentence is sufficient; it does not need to be a styled button.
Honour opt-outs permanently and globally, across every campaign, forever.
Keep records of where each address came from and when. If a complaint arrives, that record is your position.

New Zealand's Privacy Act 2020 also applies where you hold personal information, including named business email addresses. It governs how you collect, store and use that information, and gives individuals rights to access and correct it. The two regimes work together: the Unsolicited Electronic Messages Act governs the sending, the Privacy Act governs the data.

Common questions

Do I need explicit permission to send a cold email in New Zealand?

Not necessarily. The Act recognises inferred consent, which can arise where a business has conspicuously published a work-related address without indicating it does not want unsolicited messages, and your message is relevant to that person's work. That is the basis most legitimate B2B outreach relies on — but it depends on both conditions holding.

Can I email addresses I found on a company website?

Generally yes, where the address is conspicuously published, there is no statement declining unsolicited messages, and your message is relevant to that person's role. This is precisely the situation inferred consent is designed for. Sourcing from the company's own publication also keeps you clear of the Act's prohibition on harvested lists.

What must every cold email include?

Clear and accurate identification of who is sending it, accurate contact information, and a functional unsubscribe facility that you honour promptly. Those are requirements of the Act rather than best practice, and a message missing any of them is non-compliant regardless of how relevant it is.

Does the Act apply if I am sending from outside New Zealand?

The Act covers messages with a New Zealand link, which includes messages sent to an address in New Zealand. Sending from overseas does not remove the obligation when your recipients are here.

Keep reading

Cold email law in Australia Finding business emails ethically The deliverability checklist