Businesses Using App-Only SMS Opt-Outs Could Be Breaking South Africa’s Privacy Law

South African companies that force consumers to opt out of marketing SMS messages through mobile apps could soon find themselves in hot water. Legal experts are warning that this growing trend is in direct violation of the Protection of Personal Information Act (POPIA).

The issue came to light when MyBroadband reported on Vodacom’s approach to promoting its VodaPay app. Rather than allowing users to opt out by replying to the SMS, Vodacom requires individuals to dig through the app’s settings — even if they no longer use or have the app installed.

For one frustrated former user, this meant re-downloading VodaPay, resetting a forgotten PIN, and navigating the app just to stop receiving promotional messages — a process that consumed both time and data.

According to consumer rights journalist Wendy Knowler, this approach violates Section 69 of POPIA, which mandates that every marketing SMS must include an opt-out option. Marketers cannot dictate how or through which channel a person withdraws consent. “It’s not compliant to force consumers to opt out via an app when the marketing is coming through SMS,” Knowler said.

Legal Experts Weigh In

Wendy Tembedza, a technology law expert and partner at Webber Wentzel, echoed these concerns. She emphasized that POPIA gives individuals the right to decide how they want to receive — or refuse — marketing messages.

“One of the core principles of POPIA is ensuring consumers have control over their personal data, including direct marketing,” Tembedza explained. “Each SMS should give recipients a clear and immediate option to opt out.”

She added that this requirement is reinforced in the Information Regulator’s Guidance Note on Direct Marketing, which makes it clear that the opt-out method must be simple, cost-free, and aligned with the communication channel used.

Jodi Poswelletski, a director at Fairbridges Wertheim Becker, also weighed in. She said that forcing users to opt out through mobile apps is overly complicated and incurs data costs, making it neither reasonable nor free — and therefore not POPIA-compliant.

More Companies May Be At Risk

MyBroadband has learned that Vodacom isn’t the only major player using this strategy. At least two large South African banks are also requiring mobile app access to manage marketing preferences — a move that could trigger investigations by the Information Regulator.

Vodacom defended its system, saying that “customers can always download and install the app again” to update their settings. However, this stance does not sit well with legal professionals who insist that compliance must prioritize consumer convenience and consent.

What Businesses Should Do

If you’re running a business that sends marketing SMS messages in South Africa, take note:

• You must include a free and easy opt-out option in every SMS.

• The opt-out process must be available through the same channel as the communication.

• It should not require app downloads, data usage, or forgotten passwords.

Companies that fail to meet these requirements risk regulatory action, damage to their reputation, and possible fines under South Africa’s data protection laws.

{Source: My Broad Band}

Follow Joburg ETC on Facebook, Twitter , TikTok and Instagram

For more News in Johannesburg, visit joburgetc.com