POPIA: Cookies, marketing and consent for websites in South Africa

Does POPIA apply to your website?

POPIA applies to processing by a responsible party domiciled in South Africa, or by one outside the country that uses automated or non-automated means in South Africa, unless those means only forward information through the country (section 3).

The Act does not say whether setting cookies on devices in South Africa counts as using means there, so overseas businesses should assess this rather than assume. No turnover threshold exempts small businesses.

Under section 1 of the Act, personal information includes online identifiers and covers identifiable living people and, where applicable, existing juristic persons such as companies.

Cookies, profiling and direct marketing: one example

An online shop selling outdoor gear sets an advertising cookie. It records that a visitor viewed hiking boots, links that history to the email address used at checkout and adds the person to a “boots” audience. It then emails a boot promotion and shows boot ads on other websites.

What the Act says: once linked to the visitor, the cookie ID and browsing history are personal information, because the definition includes online identifiers. Building the audience needs a section 11 ground. The email is electronic direct marketing, which section 69 prohibits without consent or the existing-customer conditions.

What the Information Regulator says: its Guidance Note on Direct Marketing lists the use of cookies among methods of direct marketing by unsolicited electronic communication, next to email, SMS and push notifications. On that reading, the cookie-based ads also fall under section 69. The note is advisory; the Act and Regulations prevail.

Profiling under the Act: POPIA does not define profiling. Section 71 restricts decisions based solely on automated profiling that have legal or substantial effects. Below that threshold, the audience still needs a lawful ground and should match what visitors were told.

Passiro’s implementation tip: treat the cookie and the marketing as one purpose. Keep advertising and remarketing cookies in a consent category that stays off until opt-in, and store the email marketing choice as a separate field.

Lawful grounds, consent and objection

Section 11 allows six grounds: consent, a contract with the person, a legal obligation, the person’s legitimate interest, a public law duty, or the legitimate interests of you or a third party. You bear the burden of proving consent, and it can be withdrawn at any time.

Consent means a voluntary, specific and informed expression of will. Agreeing to purchase or account terms is therefore not specific consent to advertising cookies.

Objection is a separate right. People can object at any time to processing based on legitimate interests, on reasonable grounds and in the prescribed manner, and to non-electronic direct marketing such as post. After an objection, the processing must stop (section 11(3)–(4)).

The Regulator’s guidance note accepts legitimate interests for some non-electronic direct marketing after a documented purpose, necessity and balancing test. Electronic direct marketing falls under section 69 instead.

When the existing-customer route applies

Section 69(3) allows electronic direct marketing without consent only to your customer, and only when all three conditions are met:

1. Contact details from a sale: you obtained them in the context of selling a product or service to that person.
2. Your own similar products: the marketing is for your own similar products or services. The Regulator’s example: shoes and belts for a clothing retailer, but not funeral insurance.
3. A chance to object: the person had a reasonable, free and simple opportunity to object when the details were collected, and gets one with every message.

Every direct marketing message must also identify the sender and give contact details for asking that messages stop (section 69(4)).

The route has limits. A website visit or browsing profile is not a sale, a past purchase does not cover unrelated products, and an objection ends the route for that person. The Regulator adds that silence is not consent: someone never asked at collection has not agreed.

For everyone else, you need consent, and you may ask only once, not after a refusal (section 69(2)). The amended POPIA Regulations require written consent on a form substantially similar to Form 4 or another free, accessible method, and state that an opt-out is not consent.

Information, rights and operators

Before collecting personal information, take reasonably practicable steps so people know what is collected, who you are, the purpose, recipients, any transfer abroad and their rights, including objection and complaints to the Regulator (section 18).

People can also request access, correction and deletion, subject to conditions. Route objections and withdrawals to every system that uses the data: ad audiences, scheduled campaigns and exports.

Operators may process only with your authorization, under a written contract requiring security measures (sections 20–21). Transfers to a third party abroad need adequate protection, consent or another section 72 ground; an accepted advertising cookie is not a transfer consent by itself.

Website checklist

• Scope: record why POPIA applies to your site.
• Purpose per tool: mark which cookies feed marketing audiences.
• Before consent: confirm advertising cookies and pixels stay off.
• Customer route: check all three section 69(3) conditions before relying on it.
• Objections: confirm they reach audiences, exports and campaigns.
• Operators: check contracts and transfer grounds for each vendor.

FAQ