Explainer
Is LinkedIn outreach legal in New Zealand? What the spam law and IPP 3A mean for your messages
7 days free. No card. Then US$79/mo · See pricing
By the Bingle team · Published 24 October 2026 · Researched from the sources listed below, drafted with AI help and checked against those sources
Short answer
Does New Zealand's spam law apply to LinkedIn messages?
The regulator says so: DIA's guidance states that messages sent through "LinkedIn Messaging" qualify as messages to an instant messaging address, so commercial ones need consent, a clear sender and a working unsubscribe, though that guidance dates from 2017 and no court has ruled on it. Deemed consent needs an address conspicuously published in a business capacity, and whether a LinkedIn profile counts is untested. Tools that keep a person in the loop fit these rules best: Bingle (made in Australia) holds each drafted message for your OK and stops when someone replies.
The rules at a glance
Two laws apply: the Unsolicited Electronic Messages Act 2007 (UEMA), enforced by DIA, and the Privacy Act 2020, overseen by the Office of the Privacy Commissioner (OPC). LinkedIn's own rules sit on top.
| What it covers | What to do on LinkedIn |
|---|---|
| UEMA scope | |
| Commercial electronic messages "sent to, from or within New Zealand". DIA names LinkedIn Messaging as an instant messaging address. One message can be spam. | Treat every sales DM to a New Zealander as covered, even a single one. |
| UEMA consent | |
| Express (an opt-in act), inferred from conduct and relationships, or deemed from an address conspicuously published in a business capacity. The sender has to prove it. | Message only where the offer fits the person's role, and keep a note of why you thought consent existed. |
| UEMA s10 (identify) | |
| The business responsible and how to contact it, accurate for 30 days. | Sign with your name and business, and a contact that will still work next month. |
| UEMA s11 (unsubscribe) | |
| Clear, free, easy, in the same medium, honoured within 5 working days, working for 30 days. | Offer an opt-out in the thread and stop as soon as someone uses it. |
| UEMA address harvesting | |
| Using harvesting software or harvested lists to send unsolicited commercial messages is prohibited. | Don't message from scraped address lists. |
| Privacy Act IPP 2 | |
| Collect from the person, unless an exception applies, such as publicly available information. | Know where each lead detail came from. |
| Privacy Act IPP 3A (since May 2026) | |
| When you collect from someone other than the person, take reasonable steps to tell them, subject to exceptions. | Say where you found them in your first message, and how to opt out. |
| LinkedIn User Agreement | |
| Bans third-party software that scrapes or automates activity; invitation limits apply to everyone. | Keep volumes modest; LinkedIn may restrict accounts it suspects of automation. |
What the Unsolicited Electronic Messages Act asks of a LinkedIn message
DIA's booklet Compliant Electronic Marketing (November 2017) is direct about it: "messages sent to another user's account using a social media messaging system (e.g. Facebook Messenger or LinkedIn Messaging), would qualify as sending messages to an instant messaging address. This means that if the messages sent to a social media account (that qualifies as an electronic address) are commercial in nature, then they must comply with the consent, unsubscribe, and identification requirements of the Act." A public post such as "a Facebook wall post or a blog post" is not captured.
Volume doesn't save you. DIA says "A single message may be spam. The message does not need to be sent or received in bulk." And a link can tip a message over: "providing a hyperlink to a company web page in the signature of an otherwise non-commercial email would make it a commercial electronic message." DIA's example is an email signature. It hasn't applied it to LinkedIn, but we would assume a website link in a LinkedIn sign-off works the same way.
Consent comes in three forms. Express consent "is always expressed as a positive 'opt-in' act", and "it is up to the sender to prove that consent exists". Inferred consent comes "from the conduct and the business and other relationships of the persons concerned". Deemed consent applies when an address "has been conspicuously published by a person in a business or official capacity", carries no statement refusing unsolicited messages, and the message "is relevant to the business, role, functions, or duties" of that person. DIA's examples of conspicuous publication are websites, print or TV advertising, brochures and trade directories.
DIA's FAQ answers the prospect research question almost word for word. Asked whether researching people "doing work that would benefit significantly from our software" or getting referrals counts as consent, it says: "Referrals from colleagues without the recipient's knowledge or consent cannot be defined as deemed or inferred consent. If your research identifies an electronic address or mobile number that is conspicuously published by the person in a business or official capacity (website, brochure or magazine) deemed consent may be possible." Swapping business cards supports inferred consent only for messages "specifically related to the relationship that had developed at the time".
Every commercial message must identify the business responsible and how to reach it, with details "reasonably likely to be accurate for a period of 30 days" (s10). The unsubscribe facility (s11) must be "clearly presented, easy to use, free of charge and use the same medium of communication in which the original message was sent", and "You must honour a request to unsubscribe within five working days." For email, DIA says a line such as "reply with UNSUBSCRIBE in the subject line" is enough. It hasn't said what the LinkedIn equivalent is; asking people to reply in the thread is the closest match to "the same medium".
On enforcement, DIA says "Failure to comply could mean a fine of up to $500,000", with options running "from a formal warning to pursuing pecuniary penalties, compensation, and damages on behalf of victims through High Court action". A court judgment summary on vLex puts the cap for individuals at NZ$200,000 under s45. One housekeeping note: some DIA business pages still refer to the Privacy Act 1993, which the 2020 Act replaced.
What the Privacy Act 2020 adds, including IPP 3A
IPP 2 says to collect information from the person, with exceptions including where you believe on reasonable grounds "that the information is publicly available information" or "that compliance is not reasonably practicable". A public LinkedIn profile is the obvious candidate for the first exception, though how far it stretches is not settled.
IPP 3A is new: the OPC says "IPP3A came into force in May 2026." When you collect personal information about someone from a source other than them, you must take reasonable steps, "as soon as is reasonably practicable after the information has been collected", to make sure they know that it was collected and why, who will receive it, your agency's name and address, and their rights to access and correct it. The exceptions include where you reasonably believe "the information is publicly available information", where the person already knows, or where compliance isn't reasonably practicable.
The OPC's practical advice on contacting someone found in a public source is short. Yes, you can, "But, as a courtesy, and to avoid confusion, you should explain where you got the contact information from. You should also give a clear and easy way for the recipient to opt out of any further communications." On LinkedIn that is one sentence in your first message: what you saw, where, and how to say no thanks.
Being outside New Zealand doesn't take you out of the Act. The OPC says an overseas agency will be treated as "carrying on business in New Zealand" "even if it does not have a physical place of business here". In August 2023 the OPC also joined 11 other regulators in a statement that "Personal information that is publicly accessible is still subject to data protection and privacy laws in most jurisdictions". For Australian senders there is a second layer: Australia's Spam Act applies to messages sent from Australia wherever the reader is, which our Australia post covers.
What is still untested in New Zealand
DIA's guidance is clear on LinkedIn Messaging, but it is guidance, not a ruling, and it leaves gaps. We give no verdict on these.
- Whether DIA's 2017 view still matches the statute as it stands. We could not load the official reprint of the Act to check for later amendments.
- Whether a connection request note is a "message sent to another user's account using a social media messaging system". DIA's example names LinkedIn Messaging only.
- Whether a LinkedIn profile, or an Open Profile, is an address "conspicuously published … in a business or official capacity" for deemed consent. DIA's examples are websites, brochures, magazines and trade directories.
- How IPP 3A's publicly available exception applies to enriched data, such as an email address found by an enrichment service that isn't on the profile itself.
- Whether an Australian company messaging New Zealand buyers is carrying on business in New Zealand for the Privacy Act, in a given case.
When to message New Zealand buyers
LinkedIn's ad tools showed 3.30 million members in New Zealand in late 2025, 80.2% of people aged 18 and over, per DataReportal. Growth was 300,000 over the year but flat from July to October 2025, and these are registered accounts rather than active users. In a market this size we'd rather reach fewer people at the right moment, such as after a funding round or a new role, than work through a long list.
The business year is out of step with Australia's. Inland Revenue says "When you get an IRD number, your balance date is set to 31 March", so most companies run April to March, while some industries such as dairy, fishing and pip fruit use other dates. If you sell into both countries, your buyers' year-ends fall three months apart.
The national holidays coming up: Labour Day on Monday 26 October 2026, Christmas on Friday 25 December, Boxing Day on Saturday 26 or Monday 28 December, then New Year's Day on Friday 1 January 2027 and the day after on Saturday 2 or Monday 4 January. Waitangi Day is Saturday 6 or Monday 8 February 2027. Easter runs from Friday 26 to Monday 29 March, the King's Birthday is Monday 7 June, and Matariki is Friday 25 June 2027. Regional anniversary days split the country: Canterbury on Friday 13 November 2026, Wellington on Monday 25 January and Auckland on Monday 1 February 2027. Employment New Zealand warns its list "may contain unintentional errors".
Daylight saving started on 27 September 2026 and ends at 3am on Sunday 4 April 2027. NSW started a week later, so from 27 September to 3 October Auckland was three hours ahead of Sydney instead of the usual two. Through the New Zealand summer, our arithmetic puts Auckland three hours ahead of Brisbane and five ahead of Singapore: 9am in Auckland is 4am in Singapore. If you work from Australia, a New Zealand list wants an early start on your side.
Using Bingle for LinkedIn outreach in New Zealand
We didn't find a New Zealand-founded LinkedIn outreach or signals tool. Bingle, ours, is made in Australia; the facts below come from its own pages on 24 October 2026, so weigh them with that in mind.
Bingle looks for people showing buying signals on LinkedIn: engagement with competitors' and influencers' posts, engagement with your posts, profile views, job changes, hiring, funding and events. It ranks them by fit and timing with the reason shown, and drafts each message in your voice. Drafts wait for your OK unless you turn review off for that sequence, which is where you check that the message says who you are, where you found the person (for IPP 3A) and how to opt out. A reply stops the sequence. Bingle sends from your own LinkedIn inside its daily limits, and each sequence's send window sets its own hours, days and timezone, so a New Zealand sequence can run on Auckland time while you sit in Sydney. It never sees your LinkedIn password. After 7 free days with no card, plans start at US$49 a month; see pricing.
Parts of Bingle were built with New Zealand sellers in mind:
- Your LinkedIn signs in from New Zealand. When you connect your account, Bingle pins its connection to the country you connected from, so LinkedIn doesn't see your login suddenly coming from the US or Europe, a common cause of security checks.
- It reads New Zealand business news. When your ideal customer is in New Zealand, company news comes from Google News' New Zealand edition, so the reasons it gives you to write are local ones.
- It knows New Zealand places: "Auckland", "Wellington", "Christchurch" or "Aotearoa" on a profile reads as New Zealand, and "ANZ" or "Australasia" in your ideal customer covers both countries.
- LinkedIn voices to watch are ranked by how close they are to your market: people based in New Zealand first, then Australia.
- Your leads and messages are held in Sydney, across the Tasman rather than in the US or Europe. Some services, the AI providers included, may process data elsewhere.
Bingle's limits: LinkedIn only, with no email, contact database or phone numbers, and visits, likes and blank invites go out without review. LinkedIn's User Agreement doesn't permit third-party software that automates activity on the site, so automatic sending carries some account risk with any tool. You can switch it off in Bingle and send each step yourself from a Today's sends list.
For the questions to put to any vendor, see how to choose a LinkedIn outreach tool in Australia; the ones on price, data location and message approval apply to New Zealand buyers too. Selling into Singapore too? The rules there work very differently; see LinkedIn outreach in Singapore.
Questions
Is a LinkedIn connection request covered by New Zealand's spam law?
Untested. DIA's guidance names "LinkedIn Messaging", and a connection note may or may not count as a message sent through a social media messaging system. If the note promotes what you sell, assume the consent, identification and unsubscribe rules could apply.
Can I rely on deemed consent for someone I found on LinkedIn?
Nobody has tested whether a LinkedIn profile is "conspicuously published" in a business capacity; DIA's examples are websites, brochures, magazines and trade directories. If the same person publishes a work address on their company website, DIA says deemed consent "may be possible" for messages relevant to their role.
How quickly must I act on an unsubscribe in New Zealand?
Within five working days, and the facility must keep working for 30 days. It must be free and use the same medium as the original message.
Does New Zealand law apply to an Australian company messaging NZ buyers?
The UEMA covers messages "sent to, from or within New Zealand", and the OPC says an overseas agency can be carrying on business in New Zealand without a physical place of business there. Australia's Spam Act applies to the same message if it is sent from Australia.
What is the fine for spam in New Zealand?
DIA says up to $500,000. A court judgment summary puts the cap for an individual at NZ$200,000 under s45.
Sources
- Department of Internal Affairs, Compliant Electronic Marketing: Guidance for New Zealand Businesses. November 2017; read 24 Oct 2026
- Department of Internal Affairs, NZ spam law for businesses. read 24 Oct 2026
- Department of Internal Affairs, NZ spam law. read 24 Oct 2026
- Department of Internal Affairs, Three steps to compliance. read 24 Oct 2026
- Department of Internal Affairs, Spam frequently asked questions. read 24 Oct 2026
- Department of Internal Affairs, How New Zealand regulates spam. read 24 Oct 2026
- Department of Internal Affairs, Commercial electronic messaging in New Zealand. read 24 Oct 2026
- Department of Internal Affairs, Information for businesses. read 24 Oct 2026
- vLex, Aksentijevic v Department of Internal Affairs. read 24 Oct 2026
- Office of the Privacy Commissioner, Principle 2. read 24 Oct 2026
- Office of the Privacy Commissioner, Principle 3A. read 24 Oct 2026
- Office of the Privacy Commissioner, AskUs: contacting someone found in a public source. updated Nov 2025; read 24 Oct 2026
- Office of the Privacy Commissioner, What changed between the Privacy Act 1993 and the Privacy Act 2020?. read 24 Oct 2026
- Office of the Privacy Commissioner of Canada, Joint statement on data scraping. published 24 Aug 2023; read 24 Oct 2026
- Federal Register of Legislation, Spam Act 2003 (Australia), s7. read 24 Oct 2026
- LinkedIn Help, Prohibited software and extensions. read 24 Oct 2026
- LinkedIn Help, Types of restrictions for sending invitations. read 24 Oct 2026
- DataReportal, Digital 2026: New Zealand. published 8 Nov 2025; read 24 Oct 2026
- Inland Revenue, Balance dates. read 24 Oct 2026
- Employment New Zealand, Public holidays and anniversary dates. last modified 25 Sep 2026; read 24 Oct 2026
- govt.nz, Daylight saving. updated 11 Aug 2026; read 24 Oct 2026
- NSW Government, Daylight saving. read 24 Oct 2026
More from the blog
- Is LinkedIn outreach legal in Australia? What the Spam Act and Privacy Act mean for your messages
- Is LinkedIn outreach legal in Singapore? The Spam Control Act, the PDPA and Do Not Call explained
- How to choose a LinkedIn outreach tool in Australia (prices in A$)
- How many LinkedIn connection requests can you send a week in 2026?
- What to message a prospect who viewed your LinkedIn profile
- How to score LinkedIn leads by fit and intent (with a worked formula)
See who's looking right now
Your first leads show up in minutes, each with its reason. Free for 7 days, no card.