A Pre-Ticked Box Is Not Consent: What POPIA Actually Requires for Direct Marketing

The campaign was already live when the compliance officer walked in. Forty thousand text messages queued, an email blast scheduled for noon, a call centre working from a spreadsheet labelled "opt-out list cleaned." The marketing lead was proud of it - every contact had been given the chance to unsubscribe and had not. On the sign-up form behind her, a small box sat pre-ticked, consenting to marketing. She called it consent. By every measure that matters under South African law, it was not consent at all. That gap is where the fines live.

Consent, word for word

Section 1 of the Protection of Personal Information Act 4 of 2013 defines consent as "any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information." Three qualities, and only three. Voluntary means real choice, free of coercion or a pre-ticked default that assumes agreement. Specific means tied to a defined purpose, not a blanket authorisation for anything an organisation might later dream up. Informed means the data subject understood what they were agreeing to before they agreed. What is not in that sentence is the word "unambiguous" - that belongs to the EU's General Data Protection Regulation, Article 4(11), and importing it into a POPIA analysis is one of the most common doctrinal errors in circulating commentary. Popia asks for voluntary, specific and informed. That is the whole test.

Consent is one basis, not the only one

Having fixed the definition, consent needs to be put in its proper place, because the second common error is treating it as a universal precondition for processing. Section 11(1) sets out six lawful bases, and consent is only the first: the data subject consents; processing is necessary to conclude or perform a contract with the data subject; it complies with a legal obligation; it protects the data subject's own legitimate interest; it is necessary for a public body's proper performance of a public-law duty; or it serves the legitimate interests of the responsible party or a third party the information is supplied to. Organisations often exhaust themselves chasing consent for processing that already rests comfortably on contract or legal obligation, then treat consent as a magic word that cures everything. It cures nothing it was not properly obtained for.

Withdrawal is not the same as objection

Consent, once given, is not a life sentence for the data subject. Section 11(2) gives the right to withdraw it at any time, and three things follow. Withdrawal takes effect going forward - it does not make prior processing retrospectively unlawful. It does not touch processing that rests on another lawful basis; withdrawing consent does not stop processing that also runs on contract or a legal obligation. And the lawfulness of the withdrawal is not conditional on the organisation's convenience. This is distinct from the separate objection right in section 11(3), which applies where processing rests on the legitimate-interest or public-duty grounds rather than consent, letting a data subject object on reasonable grounds relating to their situation. Withdrawal unwinds consent; objection challenges processing that never rested on consent in the first place.

Section 69 and the opt-in rule

Section 69 governs direct marketing by electronic communication, and the default is opt-in. An organisation may not send direct marketing by automated calling machine, fax, text message, or email unless the data subject has consented, or falls within the narrow existing-customer exception. "Electronic communication" has been read broadly - the Information Regulator's Guidance Note on Direct Marketing of 3 December 2024 treats a telephone call as electronic communication for these purposes, closing the gap some marketing teams exploited by treating live calls as outside section 69. A call centre working from an opt-out spreadsheet is squarely inside this regime, not outside it.

The existing-customer exception is narrower than it looks

Under section 69(3), a responsible party may market to a data subject without fresh consent only where it obtained the contact details in the context of a sale of a product or service, is marketing its own similar products or services, and gave the data subject a reasonable, free, no-formality opportunity to opt out - both at collection and on every subsequent communication. These conditions are cumulative. The exception does not license buying a list, does not license marketing an unrelated product, and does not survive a customer who has already opted out. Every marketing communication must carry a no-cost, no-formality means to opt out, and that obligation never switches off.

Opt-out is not consent

This is the hinge of the whole topic, and the error the opening scenario commits. The amended Regulation 6, under the POPIA Amendment Regulations (GN 6126, GG 52523, 17 April 2025), governs how consent to direct marketing must be captured - requested using Form 4 or a substantially similar form, obtainable in any expedient manner including recorded telephonic or automated-call consent. But the Regulation is explicit on the point that trips everyone up: an opt-out does not constitute consent. Silence is not consent. A pre-ticked box is not consent, because it is not a voluntary expression of will. An unsubscribe link left unclicked is not consent. A list built from people who simply had not opted out is a list of people who never consented - under the amended Regulation 6, that campaign is unlawful from the first message, and no clean-looking spreadsheet changes it.

Retention, destruction, and the paperwork underneath

Consent obtained is not consent kept forever. Section 14(1) anchors retention to purpose - records must not be retained longer than necessary for the purpose collected, unless a law requires or authorises retention, the responsible party reasonably requires the record for a related lawful purpose, a contract requires it, or the data subject has consented. When the purpose is spent, sections 14(4) and 14(5) require destruction in a manner that prevents reconstruction in an intelligible form - deleting a row while a backup preserves it is not destruction. On the paperwork itself, the amended Regulations define writing to include electronic documents that are subsequently accessible, consistent with the Electronic Communications and Transactions Act; an advanced electronic signature is only required where another law specifically demands one, so an ordinary electronic signature or the surrounding data message will generally do for consent capture.

Where enforcement has landed

None of this is theoretical. In February 2024 the Information Regulator issued its first direct-marketing enforcement notice, against F.T. Rams Consulting, for marketing without consent in contravention of section 69. In December 2024 it imposed a five-million-rand administrative fine on the Department of Basic Education for failing to comply with an enforcement notice. Since April 2024 the Regulator has run own-initiative compliance assessments. The consent architecture in an organisation is now a personal-liability question for its Information Officer, not a documentation exercise - the Regulator is asking whether consent was voluntary, specific and informed, whether an opt-out was genuine, and whether an opt-out was ever mistaken for a yes.

Rebuild the opening campaign properly: every message goes only to data subjects who gave voluntary, specific and informed consent captured on Form 4 or its substantial equivalent, or who genuinely fall within the section 69(3) existing-customer exception. The pre-ticked box comes off the form, because a default is not a voluntary expression of will. The opt-out list is retired, because not opting out has never been consent. Every message carries a free, no-formality opt-out. Get the consent right, and everything downstream stands. Get it wrong, and the cleanest spreadsheet in the building will not save you.