Is B2B Cold Email Legal in New Zealand Under the UEMA?

Yes, B2B cold email can be legal in New Zealand, as long as you can name and prove a consent basis for each person on the list. The Unsolicited Electronic Messages Act 2007 sets out to stop unsolicited commercial electronic messages with a New Zealand link (section 3), and section 9 makes sending one unlawful.

For a first email to someone at another company, the route that usually applies is deemed consent. The person published a work address in a business capacity and added no "no unsolicited messages" note, and your offer is relevant to their job. On top of consent, every commercial email has to identify the sender accurately and carry an unsubscribe facility that works.

The Act recognizes three kinds of consent: express, inferred and deemed.

1. Express consent. The person agreed to hear from you, in writing or out loud.
2. Inferred consent. An existing business relationship makes your message something they would reasonably expect.
3. Deemed consent. The published-address route described above.

So an email about software delivery to a CTO whose address sits on her company's leadership page can fit the Act. A pitch to a bought file of addresses you cannot trace to any publication usually cannot. This is not legal advice, and legality is the lowest bar your outreach has to clear; for a specific campaign, ask a New Zealand lawyer.

Who does the UEMA apply to?

It covers New Zealand companies selling to other businesses and overseas companies writing to New Zealand inboxes. The Act applies to messages with a New Zealand link: the message is sent from New Zealand, the sender or the recipient is in New Zealand, or it goes to a .nz address. A head office in London or Sydney does not put you outside the Act.

There is no general exemption for business recipients. What makes B2B different is deemed consent, which only works for addresses published in a business or official capacity. A private consumer address never qualifies for that route.

Some countries demand prior consent, as Germany, Austria and the Czech Republic do, and cold email there needs a compliant basis, so I open on LinkedIn instead. Other markets sit elsewhere on the scale, for example Ireland and Switzerland. New Zealand is different. Consent is still the default, but the deemed route lets a sender who keeps records write first.

Each country uses its own consent model, so a multi-country list needs the cold email rules in each country checked market by market. Across the Tasman, Australia's Spam Act sets rules to check next to these.

What counts as a commercial electronic message?

Under the Act, a message is commercial when it markets or promotes goods, services, land or an interest in land, or a business or investment opportunity. A first sales email to a prospect promotes a service, so it is covered.

DIA lists the channels as email, fax, SMS TXT and other instant messages that are commercial by nature (DIA, What is spam). Volume plays no part. Section 9 is written around a single message, so one email can breach the Act without any bulk send.

The content decides the category. A quote the prospect asked for is exempt, but a second offer bolted onto it is promotion. When one email does both jobs, write it as if the Act applies.

Which consent types does the UEMA recognize?

DIA's starting rule is short: a commercial electronic message can only go to a recipient who has consented to receive it (DIA, Frequently asked questions).

The same FAQ adds two points B2B teams tend to skip. Consent given out loud counts, but the burden of proving it sits with the sender, so a yes on a call needs a dated note. And an email telling people to unsubscribe if they want no more messages creates no consent at all, because silence is not consent.

Inferred consent is narrower than the name suggests. The Marketing Association's FAQ on inferred and deemed consent says that swapping business cards at a meeting covers messages about that meeting or relationship and nothing unrelated. It adds that a single purchase is not enough to infer consent to marketing.

So inferred consent belongs to people already in your pipeline or client base. If someone complains, DIA's spam FAQ puts the onus on the sender to show that inferred consent existed.

For a true first touch, the realistic routes are express or deemed consent. The same FAQ says contacts published in a trade directory count as conspicuously published. That gives you deemed consent, but only if the message is relevant to the recipient's business, role, functions or duties.

When does deemed consent cover a published address?

Only when all three of DIA's conditions hold at once (DIA, Frequently asked questions):

1. The person published the address conspicuously, in a business or official capacity.
2. The publication carries no statement that they do not want unsolicited messages.
3. Your message is relevant to their business, role, functions or duties.

"Conspicuously" means somewhere a reader would actually see it. The Marketing Association's FAQ gives a website, a brochure and a magazine as examples. If you cannot show where the person published the address, the first condition fails before you reach the other two.

I read the role test as a targeting rule first and a legal one second. A message aimed at everyone in a company reaches nobody in particular, and in New Zealand that sloppiness becomes a compliance problem too. Before a title goes on the list, look at your past deals and check who actually signed off.

Then search for that exact title, head of engineering or fleet manager, instead of a generic "manager" filter. A named decision-maker with a published address gives you the stronger legal basis and the better prospect in the same contact. A shared inbox gives you less to stand on, and whoever reads it is rarely the buyer.

How do you build a New Zealand list you can defend?

Start with what you cannot use. The Act has a separate part restricting address-harvesting software and harvested-address lists. DIA states that businesses must not use harvesting software, or lists generated with it, to send unsolicited commercial electronic messages (DIA, Electronic address harvesting software).

I prefer lists built from data platforms such as Sales Navigator and Apollo over anything scraped. For New Zealand, a platform record is only where the work starts. It tells you who the person is and what they do. It does not show that they published the address themselves.

Before a contact enters a sequence, store a small proof record:

1. The consent type: express, inferred or deemed
2. The URL of the page where the address is published, or the form, email or call note behind express consent
3. The date you captured it
4. One line on why the offer fits the person's role

Look where the Marketing Association's examples point: the company's own leadership, team and contact pages, its brochures, and industry magazines that list people with their roles. If you sell into New Zealand construction and public works, the buyers sit in New Zealand infrastructure contracts. For title filters and list sourcing in general, see our lists and targeting FAQ.

What must every email in the sequence carry?

Once you have a basis, two obligations apply to each commercial email, follow-ups included: accurate sender information and an unsubscribe facility. Under the Act and DIA's FAQ, the facility must keep working for at least 30 days after the message went out, and consent counts as withdrawn 5 working days after someone uses it.

Outbound teams usually send from several domains and mailboxes, so an opt-out can arrive in any of them. With a withdrawal window that short, keep one do-not-contact list, in whatever CRM you already use, and check it before every send, on every mailbox.

Where does LinkedIn fit under the Act?

DIA's list of channels includes "other instant messages", so I treat a promotional LinkedIn message to someone in New Zealand as covered. A connection request with no offer, followed by a genuine exchange, is a different matter. The moment you pitch, the same consent, identity and opt-out logic applies.

That is why I like LinkedIn as the opening move in any market with consent rules. You connect without a pitch and start a conversation. When the person writes back "send me the details", you hold express consent you can record. Conversations come first, and in New Zealand the conversation is also your paper trail.

We send warm emails after a LinkedIn touch, never as the opener, so the email arrives from a name the prospect already knows. For a Canadian financial advisory firm, LinkedIn outreach and posting, with warm emails behind it, booked 421 sales meetings in 12 months.

LinkedIn can also carry real weight on its own. For a UK software development and IT consulting firm, between 17 April and 17 May 2023 LinkedIn brought 62 positive replies, 18 booked meetings and 3 contracts. Cold email in the same month brought 41, 13 and 2.

How does DIA enforce the law?

DIA's Digital Messaging and Systems Team was set up to enforce the Act, and its stated strategy pairs direct enforcement with education and awareness (DIA, team overview).

According to DIA's overview of how it regulates spam, an investigation starts with a report from a member of the public or an organization. One of three outcomes follows:

1. No breach found: no further action.
2. Breach suspected but not substantiated: DIA may send education and guidance on complying.
3. Breach found: anything from a formal warning to court action for pecuniary penalties, compensation and damages.

The same page says failure to comply could mean a fine of up to NZ$500,000. DIA's enforcement page says its early focus after the Act came in was educating companies, with penalties to follow repeat breaches. DIA also publishes an annual Digital Messaging Transparency Report; reports from 2022 to 2025 are listed there.

In practice it starts with one report to DIA. The first thing anyone will ask is why you wrote to that person. The saved URL with its capture date is your answer.

A worked example: one prospect who fits and one who does not

A software development firm wants to reach the head of engineering at a Christchurch logistics company. Her email is on the leadership page with no opt-out note, and engineering capacity is her job, so deemed consent fits. Here is a first message, with brackets where your own details go:

Subject: Engineering capacity for Q1

Hi [first name],

Your careers page lists several open developer roles, which usually means the roadmap is moving faster than hiring.

We place senior engineering teams with companies in that position. [One real result from a past client, in one sentence.]

Would a 20-minute call next week help you see whether a short-term team fits?

[Your name], [company], [email], [phone]

Wrong person or wrong time? Reply "stop" and we will remove you.

The first message sells a short meeting and leaves the full service for the call. I would rather see one real result in the email than a paragraph about the company. A short, human note beats a polished template, and it is easier to keep compliant.

Now send the same email to that company's CFO. Her address came from a vendor export and is published nowhere, and your sending tool strips the footer. That fails on provable publication, on role relevance, and on sender details and opt-out. Find the published engineering lead instead. Moving the same pitch to the CFO's LinkedIn inbox fixes none of it.

The rule that covers both cases: if you cannot name the consent type for a contact and show the evidence, do not send. Fill in the proof record on a small first batch before you scale. If a list cannot pass the check at small numbers, it will not pass at big ones.

Planning outreach into New Zealand and unsure how to record consent per contact? Book a call and we can go through your proof record.