South African travel businesses that market their services directly to consumers will need to review how they manage their customer databases under the National Consumer Commission’s (NCC) new National Opt-Out Registry.
Businesses will be required to register as direct marketers, check their marketing databases against the Registry monthly and pay applicable fees.
“Until now, a consumer had to opt out one business at a time, usually after the unwanted call or message had already arrived. Consumers can now register a ‘pre-emptive block’ with the NCC before any contact is made. They can block all electronic direct marketing, or tailor the block by marketer, industry or channel,” said Ahmore Burger-Smidt, Head of Regulatory at Werksmans Attorneys.
Under Section 11 of the Consumer Protection Act (CPA), consumers have the right to refuse, stop or pre-emptively block approaches or communications intended to promote or offer goods and services.
The amendments specifically limit the pre-emptive block to unwanted electronic communications. This includes sales calls, SMSs, marketing emails, WhatsApp messages and other direct electronic messages sent to an individual’s phone number or email address.
“A consumer who has registered a block cannot use it to stop seeing a company’s public Instagram feed, because that content is not sent to them as an individual. The test is whether the business has reached out to a particular person,” said Burger-Smidt.
However, there are some grey areas. For example, a promotional direct message sent to a specific user’s social media inbox or a promotional message sent through a platform’s messaging function would be treated as direct marketing.
The NCC’s draft guidelines also warn that a routine customer communication used to promote additional goods or services may amount to direct marketing. It is therefore important to separate marketing from service messages.
“Booking confirmations, itinerary changes, flight delay notices and similar transactional communications are not direct marketing. Businesses should be careful about attaching promotional content to them.”
What travel businesses must do
Travel businesses that market directly to consumers will have three main obligations under the Registry. They must register with the NCC as direct marketers, cleanse their marketing databases against the Registry every month before running campaigns, and pay the applicable registration and database-cleansing fees.
“Direct marketing to individuals therefore becomes a regulated, auditable activity. It can no longer be treated as an informal sales function,” said Burger-Smidt.
Every travel business that promotes its offering by phone, SMS, email, WhatsApp or other electronic channels will be affected, including travel agencies and tour operators, online travel platforms, hotels, lodges and guesthouses, car-rental companies, airlines, cruise lines, travel insurers and loyalty and membership programmes.
Third-party call centres and digital agencies marketing on behalf of travel brands are also included.
According to Burger-Smidt, international airlines, hotel groups and booking platforms targeting South African consumers should also expect to fall within the Registry's scope, as the CPA applies to businesses promoting goods and services in South Africa.
POPIA requirements remain
The new Registry does not replace POPIA, which continues to regulate electronic direct marketing.
Section 69 of POPIA still requires prior consent before sending electronic marketing to people who are not existing customers. For existing customers, it allows marketing only for similar products or services, and each message must offer an opportunity to opt out.
Businesses therefore need to meet two requirements: establish whether they have a lawful basis to market to a consumer under POPIA, and check whether that consumer has registered a block against the business, its industry or the communication channel under the CPA.
An additional consideration is whether businesses can rely on consent obtained before or after a consumer registered a block.
“The NCC’s draft guidelines say that ‘fresh consent does not override a pre-emptive block, unless the consumer has removed such pre-emptive block’ on the Registry,” said Burger-Smidt.
Consent captured at a booking or during a sign-up would then not entitle a travel business to market to someone who later registers a block.
The implementation process is being phased in. Phase one, covering direct marketer registration, runs from September 15 to December 2026. Phase two, involving the cleansing of marketing databases at no cost, is scheduled to run from December 2026 to April 2027.
“The guidelines are still in draft, so businesses should watch for the final text. The prudent course in the meantime is to treat a registered block as overriding earlier consent.”
