South Africa's opt-out registry is live. Your marketing list now expires every month.

On 7 October 2026 the National Consumer Commission launched South Africa’s National Opt-Out Registry. Almost every account of it is written from the consumer’s side. The consequential half is the duty it puts on the other end of the line.

If your business contacts South African customers or prospects by phone, SMS, email or a messaging app to promote something, you are a direct marketer under the Consumer Protection Act. You must be registered, you must submit your contact list for cleansing against the registry every month before you send anything, and a cleansed list is good for thirty days.

A marketing database used to grow more valuable as it grew larger. From 15 April 2027 it is closer to an inventory item: a shelf life, a carrying cost, a liability on every row.

What is happening?

The Consumer Protection Act Amendment Regulations, 2026 were gazetted on 15 April 2026 — Government Notice R.7380, Gazette No. 54521, made under section 11(6) of the CPA — and took effect on publication, with no grace period (Werksmans, 17 April 2026). A direct marketer must register before marketing at all and renew annually against a prescribed fee, must cleanse monthly against the registry and remove the data of every consumer holding a relevant block, and must identify itself in every communication.

The registry went live on 7 October 2026, launched in Pretoria by the Minister of Trade, Industry and Competition, Parks Tau, with Acting Commissioner Hardin Ratshisusu. The statement sets three phases: marketers register from 15 September to December 2026; cleansing runs from December 2026 to April 2027 at the Commission’s cost; and from May 2027 registered consumers can pre-emptively block. Enforcement begins on 15 April 2027 (gov.za, 7 October 2026). Tau: “This is not a ban on direct marketing.”

Five days earlier the NCC gazetted draft Guidelines for Compliance with the Opt-Out Registry Regulations — Gazette No. 55465, Notice No. 7981, 2 October 2026 — with comments closing on 17 October. They bind nobody, but the Commission, the Tribunal and the courts must take them into account — and they matter more than the registry mechanics.

Once a consumer registers a block, historical consent becomes invalid, and fresh consent does not override it unless the consumer lifts the block. A cleansed list is valid for one month. The duty sits with the business whose products are promoted even when an agency or call centre does the work, and it reaches branches and franchises. Service contact — statements, appointments, deliveries, complaints — sits outside the registry where there is no promotional intent, and becomes direct marketing the moment the call turns into a pitch (Moonstone, 8 October 2026; Werksmans, 9 October 2026). Non-compliance carries an administrative penalty of up to R1 million or 10% of annual turnover, whichever is greater, and criminal prosecution in serious cases.

Three things remain genuinely unsettled:

• What cleansing costs. The schedule prescribes a fee “per data entry” of R0.12 in 2026, rising to R0.18 by 2029. ENSafrica reads that as a charge on every entry submitted — the whole database, monthly (Legal 500, 26 May 2026). The Commission’s own example, one million records with twenty blocks costing R2.80 at the 2027 rate, charges only the matches (TechCentral, 9 October 2026).
• When consumers can block. The launch statement says May 2027; two days later the Commission told TechCentral that profiles have been open since July 2026 and blocks can be registered now.
• Whether business-to-business lists are caught. The CPA excludes transactions with larger juristic persons, but section 11 is a standalone right rather than a transactional protection, and we found no guidance resolving it. Assume your B2B list is in scope.

Why it matters economically

Three costs sit here, and the fee is the least of them.

The first is process. A cleansed list expires in thirty days, so campaign cadence is coupled to a compliance cadence: the opportunistic outbound burst stops being something a sales manager can simply do. The second is exposure, which follows the brand rather than the contractor, so outsourcing the dialling does not outsource the risk. Our view is that this makes bought lists and third-party lead inventory close to uninvestable: you carry the penalty for the provenance of records you did not collect.

The third is the carrying cost of list size, and that is the repricing that matters. Take an illustrative distributor holding 120,000 marketing records, one campaign a month — assumptions, not measurements. On the Commission’s narrow reading, with 0.3% blocked, cleansing costs about R43 a month. On ENSafrica’s reading of the same words it is 120,000 × R0.12: R14,400 a month, R172,800 a year, for the same list. Whichever survives, a record you cannot justify has stopped being free.

That advantages two things that were already cheaper: existing customers, whom POPIA treats differently under section 69(3), and non-promotional service contact, which the draft Guidelines put outside the registry entirely. The businesses that gain are those whose systems can tell a customer from a prospect, and a service message from a pitch.

What it means for African businesses

This is South African law and nothing more. A block registered in Pretoria has no standing against a Kenyan or Nigerian contact list. It does signal a direction several markets are moving in — Egypt now licenses the use of personal data and permits electronic direct marketing separately — and a business selling into more than one African market needs permission recorded per record with the market attached, not one global marketing flag.

Inside South Africa the reach is wide and sector-neutral: Werksmans lists retailers, insurers, financial institutions, estate agencies, vehicle dealerships and digital marketers. The obligation attaches to the promoting business across financial services and everywhere else, and to firms outside the country marketing electronically into it — the part foreign sellers tend to miss.

One operating condition deserves naming, as a design constraint rather than a complaint. Many South African businesses trade under names that differ from their CIPC registration, and consumers will block the brand they recognise; the Commission is reported to be working with CIPC on the mismatch (Moonstone, 8 October 2026). If several trading names sit under one registration, mapping what a consumer blocks to what your systems suppress is yours to get right.

Technology and AI implications

Most of this is unglamorous data architecture, and that is the point.

A customer system that survives April 2027 holds permission as structured data: the lawful basis for each record, when and where it was obtained, the channels it covers, and the block status with the date of the cleanse behind it. It gates sending, so a campaign refuses to run on a cleanse older than thirty days. It logs what was sent to whom on what basis. And it resolves identity — deduplicated records, mapped from each trading name to the registered marketer. That last task is the one narrow place machine assistance earns its keep: merging duplicates before submission, with a person approving the merges. Identity resolution, not prediction.

Where technology does not help deserves saying as plainly. No system creates permission, and no model infers consent: the Information Regulator was explicit on 21 April 2026, quoting Advocate Tlakula, that “by merely opting-out, a data subject cannot be regarded as having given consent.” There is no technical route around a registered block, and automation that scales outbound contact scales the exposure. Whether a message is service or promotion is a judgement call with a penalty attached; it belongs to a named person, not a classifier.

One architectural objection is worth carrying into the consultation. The scheme asks every marketer to upload its customer database to a state platform monthly. Werksmans argues this may itself be an information matching programme under POPIA, and that the draft says nothing about safeguards, retention or breach response. A published suppression list, downloaded and applied locally, would do the same job without the transfer.

Practical business implications

1. Decide whether you are a direct marketer, in writing. Promotional electronic contact with South African consumers or small juristic persons is the test. If the answer is yes anywhere in the group — a franchise, an agency acting for you — register before December 2026.
2. Comment by 17 October 2026. The fee reading, the thirty-day validity, the treatment of current consent and the upload model are all still open.
3. Audit the list before you ever submit it. Find the duplicates and the records with no recorded basis and no plausible value, and delete them. The cheapest record is the one you no longer hold.
4. Build the monthly cycle during the free phase. From December 2026 to April 2027 cleansing costs nothing — the window to learn how the interface behaves and where your customer and campaign systems need new fields.
5. Rewrite the agency and lead-vendor clauses. You are liable for marketing done on your behalf. Require registration status, cleanse dates and the basis for each record.

RevenueStack perspective

Our reading is that this is not primarily a compliance story. It is the repricing of an input most businesses have treated as free.

A contact list has always had costs — collection, storage, goodwill spent on people who did not want contact — that appeared nowhere a manager could see. The Regulations make part of that visible and attach a penalty to the rest. When an input gets priced, the rational response is not a tool that makes it cheaper to hold; it is to ask how much of it you need, and where demand could come from instead. For most businesses we work with, much outbound contact was never earning its keep, and the durable channels are the ones a business owns: a site that converts, an existing customer who hears from you because they asked to, a messaging conversation the customer started. Those are also the channels least affected here — the law is tracking the difference between demand you have earned and attention you have taken.

What this requires, then, is not a marketing platform. It is a customer record in which permission is a field with a basis, a date and a scope, sitting in the same system as the orders and the conversations — so nobody reconciles three spreadsheets to answer whether a person may be contacted this month.

Conclusion

South Africa has not banned direct marketing. It has made it a registered, metered activity with a monthly expiry and a penalty that scales with turnover. Comment by 17 October 2026, register by December, rehearse the cleansing cycle while it is free, and expect enforcement from 15 April 2027. The businesses that come through comfortably will not be the ones with the biggest lists, but the ones that can say, for any contact, exactly why they are allowed to make it.

Sources

1. National Consumer Commission launches National Opt-Out Registry — Government of South Africa, 2026-10-07
2. NCC launches the national Opt-Out Registry to curb unwanted direct marketing — National Consumer Commission, 2026-10-07
3. NCC welcomes regulations to curb spam calls — National Consumer Commission, 2026-04-17
4. Media statement: Regulator notes published gazette of the Consumer Protection Act Amendment Regulations 2026 — Information Regulator of South Africa, 2026-04-21
5. Do not call me I'll call you — South Africa's 2026 CPA Amendment Regulations: operationalising the national opt-out regime for direct marketing — Werksmans Attorneys, 2026-04-17
6. Blocking growth? Why the NCC's draft Opt-Out Registry Guidelines need revisiting — Werksmans Attorneys, 2026-10-09
7. Cleanse or consent? The ZAR0.12 question every South African direct marketer must answer — ENSafrica, via Legal 500, 2026-05-26
8. Opt-out rules bring financial services into the compliance net — Moonstone, 2026-10-08
9. How to tell telemarketers to get lost – officially — TechCentral, 2026-10-09
10. NCC launches national opt-out registry to address unwanted direct marketing — Engineering News (Creamer Media), 2026-10-07
11. New system to curb unwanted direct marketing — SAnews (GCIS), 2026-10-06
12. Direct marketing under the Consumer Protection Act — Ellipsis Regulatory, 2026-04-27