New rules offer consumers a way to block annoying spam calls

---

1. A New Dawn for Fed-Up Consumers

April 15, 2026: The Day the Calls Stopped

South Africans long accustomed to tele-pitches at supper, “You’ve won a yacht” SMS blasts, and inbox floods promising “once-off deals” opened their eyes on 15 April 2026 to a radically altered landscape.
Trade, Industry & Competition Minister Parks Tau quietly appended fourteen pages to the Consumer Protection Act through Government Gazette 48792, and with that single stroke the entire playbook for outbound sales teams, email blasters and competition hustlers became obsolete.

The star of the show is the National Opt-Out Registry (NOR). Instead of begging each firm individually to stop, citizens now park their phone numbers, e-mail addresses - even street addresses - on a single, real-time database. Marketers must prove, every thirty days, that every contact they still hold has not requested silence.

Penalties That Bite Hard

The new rules are not gentle hints. Any unwanted pitch that lands on a listed address is classified as a prohibited transaction from the minute the amendments took effect.
An individual offender faces an immediate R1 million fine; a business, R10 million. Daily continuation adds another R50 000 for each sunrise.
The National Consumer Commission (NCC) - once seen as a mall-referee - now wields search-and-seizure powers, server-mirroring authority and the right to freeze bank accounts while investigations run.

---

2. How the System Really Works

The Machinery Behind the Silence

Long before the Gazette hit the streets, the NCC contracted a CSIR-led team to bolt the system together. The platform can juggle 25 000 registration sessions at once and crunches 100 million look-ups a day.
Consumers add their details via USSD (134 662# ), WhatsApp (060 063 3222), a zero-rated site, or any post-office counter. A one-time PIN proves ownership, after which the data is salted and run through SHA-512 hashing before resting in an air-gapped tier-four facility in Centurion.
Marketers upload CSV files and, within minutes, download a scrubbed list plus a cryptographic receipt that doubles as audit evidence.

Price Tag for Access

Annual fees depend on volume:
- Fewer than 1 000 contacts → R250
- 1 000–50 000 → R2 000
- 50 000–1 million → R15 000
- Beyond a million → R100 000 plus one cent for each extra record.
Failure to pay bars the firm from marketing for a full year and doubles the fee as a punitive levy.

---

3. What Marketers Must Do – and Fast

Mandatory “Marketing Passport”

Every voice call, text, e-mail, push alert or in-app offer must display: legal name, CPA licence number, physical office, main switchboard and a NOR-issued campaign ID.
Cold calls open with a seven-second disclosure and cap at ninety seconds unless the consumer chooses to stay. Robocalls survive, but only between 09:00 and 17:00 on weekdays, and a single key-press must end the call within two seconds.

Lead-Recycling Is Dead

Marketers can no longer pass a “consented” list from vacuum-cleaner promotions to insurance cold calls. Consent is locked to the original product category and evaporates after six months unless renewed through a double opt-in. Any hand-off to a third party triggers a fresh, clearly labelled consent request.

---

4. Mobile Networks, Mega-Tech and the Global Ripple

Vodacom, MTN, Cell C and Telkom Knuckled Under

South Africa’s four networks tried claiming “service messages” immunity; the new wording erases that argument. Promos for data bundles, double airtime or handset upgrades now count as direct marketing and must be NOR-scrubbed.
Vodacom admits its 47 million records will shrink by roughly 11 %, slashing an estimated R1.8 billion from annual promo revenue. MTN calls the hit “material but manageable” and will push fibre bundles instead.
Smaller lead generators feel the most pain: a Johannesburg solar-panel firm told Engineering News that thirty percent layoffs loom unless conversion rates triple.

Silicon Valley Scrambles

Within forty-eight hours Amazon Web Services amended its Acceptable Use Policy to prohibit SES, Pinpoint or Connect from hitting South African numbers without NOR credentials. Twilio now blocks SA destinations by default until a valid CPA number is supplied. Microsoft is coding an NOR API plug-in for Dynamics 365 Marketing, slated for Q3 2026.

---

5. Consumer Reality Check & Opportunities Ahead

Early Numbers Tell a Story

Even before the July registration window opened, more than 600 000 citizens pre-registered through a beta link leaked on social media. The average user is 42, urban and on prepaid - the demographic most harassed by personal-loan sharks.
Almost three in ten opted into a “public-interest whitelist”, letting government and NGOs send vaccination reminders or disaster alerts. Banks and insurers are pouncing on the loophole: First National Bank now funnels forty percent of its acquisition budget to in-app banners visible only to logged-in clients, a channel exempt from NOR. Discovery notifies safe-driving rewards through the Vitality app, sidestepping outbound contact entirely.

The Rise of the Consent Economy

Some brands gamble on genuine opt-in rewards: Pick n Pay’s Smart Shopper pilot gives 500 extra points to members who keep their number off the NOR and accept two live calls a month. Uptake sits at three percent, yet the firm swears lead quality has leapt ten-fold.

---

6. Roadmap, Grey Zones and the Next Frontier

Enforcement Timeline

• June 2026: Consumer registration opens; marketers start pre-scrubbing lists.
• July 2026: First compliance certificates roll out; ad agencies must staple them to every pitch deck.
• October 2026: Surprise audits begin - 500 companies chosen by a blockchain lottery streamed live on YouTube.
• January 2027: NOR widens to WhatsApp Business API and Facebook’s Click-to-Message ads.

Loopholes, Scams and Unintended Victories

Political parties and charities currently sit outside the CPA, so election robocalls and charity tele-fundraising may roar on until lawmakers move.
A fresh grift already circulates: fraudsters offer “NOR registration for R39” then loot the victim’s card. The NCC reiterates the real process is free and will never request payment by phone.
On the upside, liquidators must hand dormant marketing data to the NCC for permanent blacklisting, ending the game of phoenix companies rising under fresh names.

---

7. The Bottom Line - What Happens Now

The registry is live, the fines are real, and “mystery-phone” AI bots are registering SIMs to bait spammers. Call volumes to prepaid users have already dropped 38 %, and a quiet weekend is no longer a fantasy in Soweto.

Marketers that adapt stand to gain fiercely loyal, genuinely interested customers; those that do not risk becoming the first defendants in a potential R60 billion fine pool - money that rivals the national housing budget.
For consumers, the message is simple: silence is now the default, and the law, at last, has given it teeth.

What is South Africa's 2026 Opt-Out Law?

South Africa's 2026 Opt-Out Law, enacted on April 15, 2026, established the National Opt-Out Registry (NOR). This law allows citizens to add their contact details to a single database to prevent unwanted marketing communications. Businesses are required to regularly check their contact lists against the NOR, facing substantial penalties of up to R10 million for non-compliance, thereby fundamentally altering direct marketing practices.

How do consumers register for the National Opt-Out Registry (NOR)?

Consumers can register their phone numbers, email addresses, and even street addresses on the NOR through several methods: via USSD (134662#), WhatsApp (060 063 3222), a zero-rated website, or at any post-office counter. A one-time PIN is used to verify ownership of the contact details, ensuring security and accuracy. This central registry replaces the need to individually opt-out with multiple businesses.

What are the penalties for businesses that don't comply with the Opt-Out Law?

Non-compliant businesses face severe penalties. An individual offender can be fined R1 million, while a business faces a R10 million fine for each instance of sending unwanted marketing to a listed contact. Additionally, a daily fine of R50,000 is imposed for continued non-compliance. The National Consumer Commission (NCC) has enhanced powers, including search-and-seizure authority, server-mirroring capabilities, and the right to freeze bank accounts during investigations.

How does the Opt-Out Law affect marketing practices for businesses?

Businesses must now obtain a "Marketing Passport" for every communication, displaying their legal name, CPA licence number, physical office, main switchboard, and a NOR-issued campaign ID. Consent for marketing is tied to the original product category, expires after six months unless renewed via double opt-in, and cannot be recycled or transferred to third parties without fresh consent. Lead generation is significantly impacted, with a focus shifting towards genuine opt-in and in-app or internal marketing channels.

What is the cost for marketers to access and use the NOR?

Annual fees for marketers to access the NOR vary based on the volume of contacts they need to scrub. For fewer than 1,000 contacts, the fee is R250. For 1,000–50,000 contacts, it's R2,000. For 50,000–1 million contacts, the fee is R15,000. For over a million contacts, the cost is R100,000 plus one cent for each additional record. Failure to pay these fees results in a one-year ban from marketing and a doubled punitive levy.

Are there any loopholes or exceptions to the Opt-Out Law?

Currently, political parties and charities are exempt from the Consumer Protection Act (CPA), meaning election robocalls and charity tele-fundraising may continue unchecked until potential legislative changes. Banks and insurers are adapting by using in-app banners and notifications for logged-in clients, as these channels are exempt from NOR requirements. However, new scams have emerged, with fraudsters offering fake NOR registration for a fee, while the actual process is free and never requests payment.