Explainer
Does NZ's anti-spam law apply to LinkedIn messages?
7 days free. No card. Then US$79/mo · See pricing
By the Bingle team · Published 28 October 2026 · Researched from the sources listed below, drafted with AI help and checked against those sources
Short answer
Does New Zealand's anti-spam law apply to LinkedIn messages?
The Unsolicited Electronic Messages Act 2007 covers commercial instant messages, and DIA's business guidance says a message sent through LinkedIn Messaging would qualify, so a sales DM to a New Zealander needs consent, clear sender details and a working unsubscribe. The Act itself never names LinkedIn, we found no court decision applying it to LinkedIn, and DIA has not said whether a connection note counts or whether a LinkedIn profile is a published address for deemed consent. Bingle makes the checking easier because each drafted message waits for your OK (unless you switch review off) and goes out from your own LinkedIn account under your name.
How we researched this
On 28 October 2026 (New Zealand time) we read 16 DIA web pages, its November 2017 booklet Compliant Electronic Marketing, its two-page fact sheet and its Enforcement Response Guidelines 2017, plus a published summary of the High Court decision in Chief Executive of the Department of Internal Affairs v Mansfield. legislation.govt.nz returned a bot check and no text, and the web archive refused connections, so we could not read the Act directly. We did not ask DIA about LinkedIn and tested nothing.
What the Act counts as a commercial electronic message
DIA's New Zealand spam law page says the Act came into force on 5 September 2007 and "covers email, fax, instant messaging, mobile/smart phone text (TXT) and image-based messages of a commercial nature". Voice telemarketing and pop-ups are outside it. It bites on messages with a New Zealand link, meaning sent to, from or within New Zealand, so a seller in Sydney writing to a buyer in Wellington is inside it.
Whether a message is commercial depends on what it says. DIA's booklet sets out section 6: a commercial electronic message is one that markets or promotes goods, services, land, an interest in land, or a business or investment opportunity; helps someone dishonestly obtain a financial advantage; or links or directs the reader to another message that does either of those. Free offers still count. So does a one-off: DIA's page for businesses says the message "does not need to be sent or received in bulk".
Section 6(b) takes out replies to a request for a quote, messages confirming a deal the recipient agreed to, factual updates on an existing account or membership, and a few others. A cold note to a stranger is none of those, and DIA's FAQ treats even recruiters approaching candidates for a client as commercial.
Are LinkedIn messages covered? What DIA says, and what it leaves open
The Act works by type of account. DIA's booklet (dated November 2017) lists the electronic addresses it covers as "an email account; a telephone account; an instant messaging account; or a similar account". It then turns to social media in two sentences that matter here: "Whether a social media platform/account constitutes an instant messaging account or similar for the purposes of the Act depends on how the platform in question functions and is used. For example, messages sent to another user's account using a social media messaging system (e.g. … LinkedIn Messaging), would qualify as sending messages to an instant messaging address."
The same booklet gives three questions to test any campaign: are you sending an email, text, instant message or fax; are you sending it to an email, telephone, instant messaging or similar account; and is it commercial. "If you were able to answer 'yes' or 'probably yes' to all of these questions, then you must comply with the consent, unsubscribe, and identification requirements of the Act." Here is how we would answer them for the things a LinkedIn sequence does. The right-hand column is our reading, not DIA's.
| What DIA has said | Our reading |
|---|---|
| A message to a connection | |
| Named: LinkedIn Messaging qualifies as an instant messaging address | If it sells anything or links to your site, the consent, sender and unsubscribe rules apply |
| A paid message to someone you aren't connected to | |
| Not named separately | We would treat it like any other LinkedIn message |
| A connection request with a note | |
| Not addressed | If the note promotes what you sell or carries a link, treat it as covered |
| A connection request with no note | |
| Not addressed | It carries no words to market anything, but nobody has said it is outside the Act |
| A public post or comment | |
| A typical advertisement on a website is "not captured" | Closer to a post on a website than to a message sent to an account |
The guidance is nearly nine years old (it still points readers to the Privacy Act 1993, since replaced), and DIA says it is "not a substitute for professional legal advice". We searched for a New Zealand court decision or DIA warning involving LinkedIn and found none.
Consent: express, inferred and deemed
Section 4(1), as DIA's booklet restates it, accepts three kinds of consent: express, inferred "from the conduct and the business and other relationships of the persons concerned", and deemed. Section 9(3) puts the proof on you, and the booklet says a good record holds the date, the method, what the person agreed to, who obtained it and who gave it. Silence never counts: in DIA's FAQ, "the recipient's silence should not be taken as consent".
| Kind of consent | What it needs | DIA's example | The LinkedIn question left open |
|---|---|---|---|
| Express | A positive opt-in act. Silence, going along with it, or failing to opt out never counts | Ticking a box, filling in a form, a phone call or a face-to-face conversation | Whether "sure, send it through" typed in a LinkedIn thread is enough. It is a positive act, so we would keep a copy |
| Inferred | A relationship and conduct that make messages expected. One purchase is not enough | Two people swap business cards at a meeting; messages about that meeting or relationship are fine, unrelated promotions are not | DIA has never discussed whether accepting a connection request creates any relationship |
| Deemed | An address conspicuously published in a business or official capacity, with no statement refusing unsolicited messages, and a message relevant to the person's role | A trade directory or a work address on a company website | DIA has never said whether a LinkedIn profile is conspicuous publication |
Most LinkedIn prospecting would lean on deemed consent. DIA's booklet says conspicuous publication "can include publishing on a website, print, or television advertising, and brochures or trade directories that are intended to be used for commercial contacts", and that "there must be a strong link" between the message and the person's business role. A stationery seller, it says, should write to the procurement officer rather than the chief executive. Its counter-example: a company mailing schools from an online directory whose site says the addresses must not be used for unsolicited commercial messages "will be in breach of the Act".
Two points follow for LinkedIn, and both are our reading, untested by DIA or a court. A headline or About section that says something like "no sales pitches, please" looks like the statement that cancels deemed consent, if a profile counts as publication at all. And because deemed consent covers only messages relevant to the person's role, a pitch to the wrong job title fails the third condition even when the first two hold.
Saying who you are, and giving people a way out
Section 10 is the identify rule. DIA's three steps page says commercial messages "must always clearly identify the business responsible for sending the message and how they can be contacted", with contact details reasonably likely to stay accurate for 30 days after sending. The person who authorised a message may not be the one who sent it. If an agency or assistant sends for you, the message still has to name your business and how to reach it.
Section 11 is the unsubscribe rule, and DIA's FAQ fills in details the Act leaves to practice. The five working days start the day after someone uses the facility. The facility needn't be automated, "but should be reliable". A thank-you note confirming the unsubscribe is fine if it goes within the five days, and so is one exit question in that window; after it, you have no consent left to write again. The parties can agree by contract to leave the facility out, but a request to stop must still be acted on.
DIA's unsubscribing page lists what people can complain about, and one item maps straight onto LinkedIn: having "no ability for you to respond to the sender requesting to be unsubscribed, using the same method of communication that was used to send you the message initially". A line asking people to reply in the thread meets that. We wouldn't rely on a link to a web form alone: DIA accepts one in an email, but it hasn't said anything about LinkedIn.
Penalties, and what enforcement looks like in practice
DIA's page on how New Zealand regulates spam says "Failure to comply could mean a fine of up to $500,000", and that its options run from a formal warning to High Court action for pecuniary penalties, compensation and damages. The Act's caps, as the High Court set them out in Chief Executive of the Department of Internal Affairs v Mansfield [2013] NZHC 2064 (read in a published summary): "If the perpetrator is an individual, the pecuniary penalty must not exceed $200,000", and for an organisation "the maximum penalty is $500,000". The defendant in that case lived in Perth, and living in Australia did not keep the case out of a New Zealand court.
| Outcome | Who decides | Amount | Source |
|---|---|---|---|
| Education and guidance material | DIA | None | Enforcement Response Guidelines 2017 |
| Formal warning, named on DIA's register | DIA | None: "carries no financial penalty" | DIA case studies page |
| Civil infringement notice | DIA | Not stated on the pages we read | Enforcement Response Guidelines 2017 |
| Pecuniary penalty | High Court, on DIA's application | Up to NZ$200,000 for an individual, NZ$500,000 for an organisation | Mansfield [2013] NZHC 2064, para 9 |
| Compensation and damages | A court, on DIA's or the recipient's claim | Depends on the loss | DIA, How New Zealand regulates spam, and its spam questions page |
DIA's guidelines weigh the number of messages, harm, gain, past breaches, whether it was "a genuine mistake, systemic or deliberate", and how the addresses were acquired. On 28 October 2026 the newest year on DIA's enforcement page is 2023, and every action listed for 2022 and 2023 is a formal warning, mostly for breaches of sections 9 (consent), 10 and 11.
Who carries the breach inside a company? DIA's FAQ says that where a company has clear policies on consent and on who may send commercial messages, and a salesperson breaks them, DIA is likely to treat it as the employee's breach, depending on factors including "the accounts used to send the message". Recipients can also act alone: "an individual victim of spam can take independent action seeking compensation and damages".
A connection note and a follow-up DM, worked through
Here is how we would apply this to a two-step sequence aimed at a finance manager in Auckland. It is our reading of DIA's guidance, not DIA's advice.
- Connection note: "Hi Aroha, your comment on Tuesday's post about month-end close was the clearest take in the thread. Would be good to connect." It promotes nothing and has no link, so on the section 6 test we see nothing commercial in it. Add your website, a booking link or a line about what you sell, and DIA's view of links in email signatures suggests it becomes commercial.
- Before the DM, name your consent route and write it down. For deemed consent: the page where she publishes a work address, the date, the absence of a refusal statement, and why your offer fits her role. If you can't name a route, DIA's booklet suggests phoning to ask, and voice calls sit outside the Act.
- The DM itself: what you noticed, what you sell in one or two sentences, then your name, business and a contact that will still work in 30 days. End with a way out in the same thread: "If you'd rather not hear from me, reply stop and I won't message again."
- If she replies stop, halt every step queued for her and record it with the date. You have five working days, counted from the day after she asks, and any later commercial message to her needs fresh consent.
DIA's FAQ has one answer written for online communities that reads well for LinkedIn too: "If you send something to another community member who objects to the message, apologise and don't do it again. In most cases that will be the end of the matter." For the privacy side of the same messages, including the IPP 3A notice rule from May 2026, see our New Zealand outreach guide; for the matching Singapore rules, see Singapore's PDPA and Do Not Call rules.
Where Bingle fits: each LinkedIn message it drafts waits in an approval queue for you to approve, edit or regenerate, unless you switch review off for that sequence. That is the moment to check the sender line, the opt-out line and your consent note. It sends from your own LinkedIn account, the sign-off uses the name in your Sender settings, and any reply stops the sequence, so a stop message halts the steps still queued. You can also switch off automatic sending and send each step yourself from Today's sends.
Its limits here: visits, likes and blank invites run without the review step, and Bingle's user guide doesn't describe an automatic unsubscribe line, so write yours into the message step or the draft. Bingle is 7 days free with no card, then from US$49 a month; see pricing, or more posts on the Bingle blog.
Questions
Can one LinkedIn message break New Zealand's spam law?
Yes, if it is commercial and you lack consent, sender details or an unsubscribe. DIA says a message does not need to be sent in bulk to be spam.
Does accepting my connection request count as consent to sales messages?
Neither the Act, as DIA restates it, nor DIA's guidance says so. Inferred consent needs a relationship that makes messages expected, and DIA has never discussed connection requests.
If nobody replies asking me to stop, do I have consent?
No. DIA says a recipient's silence should not be taken as consent, and express consent always needs a positive opt-in act.
Who is liable when a salesperson sends a non-compliant message?
DIA says that if the company has clear policies on consent and who may send, and the employee breaks them, it is likely to treat the breach as the employee's. It weighs intent, training, policies and the accounts used.
Sources
- Department of Internal Affairs, New Zealand spam law. read 28 Oct 2026
- Department of Internal Affairs, What anti-spam law means for businesses. read 28 Oct 2026
- Department of Internal Affairs, What is spam?. read 28 Oct 2026
- Department of Internal Affairs, Compliant Electronic Marketing: Guidance for New Zealand Businesses (booklet; restates UEMA s4(1), s6, s9, s10, s11, s13). dated November 2017; read 28 Oct 2026
- Department of Internal Affairs, Simple Steps to Compliant Electronic Marketing (fact sheet). read 28 Oct 2026
- Department of Internal Affairs, Three steps to ensure you are not spamming. read 28 Oct 2026
- Department of Internal Affairs, Frequently asked questions. read 28 Oct 2026
- Department of Internal Affairs, About unsubscribing. read 28 Oct 2026
- Department of Internal Affairs, How New Zealand regulates spam. read 28 Oct 2026
- Department of Internal Affairs, Enforcement Response Guidelines 2017. read 28 Oct 2026
- Department of Internal Affairs, Case studies. read 28 Oct 2026
- Department of Internal Affairs, Enforcement action (with the 2022 and 2023 lists). read 28 Oct 2026
- vLex, Chief Executive of the Department of Internal Affairs v Mansfield [2013] NZHC 2064 (secondary summary of the judgment). judgment 14 Aug 2013; read 28 Oct 2026
More from the blog
- Is LinkedIn outreach legal in New Zealand? What the spam law and IPP 3A mean for your messages
- Singapore's PDPA and Do Not Call rules: what they mean for LinkedIn outreach
- Is LinkedIn outreach legal in Australia? What the Spam Act and Privacy Act mean for your messages
- LinkedIn connection request messages for each buying signal (with examples)
- Best LinkedIn buying signal tools in 2026
- What are the best Gojiberry alternatives for signal-based LinkedIn outreach?
See who's looking right now
Your first leads show up in minutes, each with its reason. Free for 7 days, no card.