Skip to content
OmniChannels.ai

Bulk SMS in New Zealand: Spam Act, Consent and Sender ID

Bulk SMS New Zealand guide: Unsolicited Electronic Messages Act consent and unsubscribe rules, DIA, One NZ, Spark and 2degrees, sender IDs and macron text.

Updated 10 min read

By OmniChannels.ai Editorial Team · Reviewed by BroadNet Messaging Solutions Team

SMS & OTP

Short answer

To send bulk SMS in New Zealand, use a provider with routes to One NZ, Spark and 2degrees and send commercial texts only where you have express, inferred or deemed consent under the Unsolicited Electronic Messages Act 2007. Every marketing text must identify the sender and carry a free, working unsubscribe option. The Department of Internal Affairs enforces the Act, and the burden of proving consent is on the sender.

On this page
  1. What rules apply to bulk SMS in New Zealand?
  2. What does the Unsolicited Electronic Messages Act require?
  3. What counts as consent to send marketing texts?
  4. How must the unsubscribe option work?
  5. Which networks carry SMS in New Zealand?
  6. How do sender IDs work in New Zealand?
  7. How should you separate OTP and promotional traffic?
  8. How do macrons and Māori words affect SMS length?
  9. When should you send?
  10. A worked example: a Wellington cafe chain
  11. What are the common mistakes?
  12. How OmniChannels.ai helps

Key takeaways

  • The Unsolicited Electronic Messages Act 2007 covers commercial text messages; the Department of Internal Affairs (DIA) enforces it, and the sender carries the burden of proving consent.
  • Consent can be express, inferred or deemed. Keep a record of how each number came to you, because you will need to show it if someone complains.
  • DIA's guidance says an unsubscribe facility must be clear, free to use, work on the same channel and still work 30 days after the message; sending on past 5 working days after an unsubscribe attempt is a ground for complaint.
  • Our coverage data lists three networks with direct routes: One NZ (530-01), Spark NZ (530-05) and 2degrees (530-24). Our regulation data records no published sender ID registry and no regulator-set sending hours.
  • A macron such as the ā in Māori is not in the GSM 7-bit alphabet, so one such letter switches a whole message to Unicode at 70 characters (67 per part) instead of 160 (153).

This guide is for marketing, e-commerce, hospitality and operations teams that want to send business SMS to New Zealand mobile numbers: OTPs, order alerts, reminders and promotions. It explains the anti-spam law, how consent and unsubscribe work, which networks carry your traffic, how sender IDs behave and why a Māori word can change your message length. It is a practical overview, not legal advice; confirm requirements with New Zealand counsel and the networks before launch.

What rules apply to bulk SMS in New Zealand?

Three things shape bulk SMS in New Zealand: the Unsolicited Electronic Messages Act 2007, the Privacy Act 2020 for how you handle personal information, and the policies of the mobile networks. There is no separate "bulk SMS law", so you assemble the picture from each.

Layer What it covers Where to check
Unsolicited Electronic Messages Act 2007 Consent, sender identification and unsubscribe for commercial texts, emails and similar messages legislation.govt.nz, DIA
Privacy Act 2020 How personal information, including phone numbers, is collected, stored and used Office of the Privacy Commissioner
Networks (One NZ, Spark, 2degrees) Routes, filtering and any sender ID requirements Your provider, at onboarding

Our regulation data lists the Department of Internal Affairs (DIA) as the regulator for this area. DIA describes the Act as covering commercial email, fax, instant messages, text messages and image-based messages, and says it does not cover internet pop-ups or voice telemarketing. The Act came into force on 5 September 2007.

What does the Unsolicited Electronic Messages Act require?

It requires three things of a commercial text: consent, accurate sender information and a functional way to unsubscribe. DIA summarises the Act's purpose as banning unsolicited commercial messages that have a New Zealand link, requiring accurate sender information and a working unsubscribe option.

A commercial electronic message is a message that markets or promotes goods, services or a business. A reminder or receipt for something the customer already bought sits in a different place from a sale offer, and the offer is what makes a message commercial. If a text mixes the two, treat it as commercial.

  • Consent. You may send only where the recipient has consented. The next section explains the three kinds.
  • Sender identification. The message must include accurate information about the person who authorised it. In SMS this means your trading name at the start of the text, or a sender ID that people recognise.
  • Unsubscribe. Every commercial message needs a functional unsubscribe facility.

Enforcement sits with DIA, and the Act places the onus of proof on the sender. In practice that means the one question to ask before every campaign is "could I show, today, how this number agreed?".

Consent can be express, inferred or deemed, and you must be able to show which one applies. DIA's guidance on avoiding spam says commercial messages should be sent only where one of the three exists.

Type What it means in practice Evidence to keep
Express The person clearly opted in, for example by ticking a box or texting a keyword Wording shown, date and time, channel, number
Inferred Consent can reasonably be inferred from an existing business relationship, such as a recent purchase Record of the relationship and what the customer would expect to receive
Deemed The person published a work address or number in a business or official capacity, and the message is relevant to their role The publication, and proof it had no "no unsolicited messages" statement

Deemed consent does not apply if the publication says the person does not want unsolicited commercial messages at that address. Because inferred and deemed consent depend on facts that are easy to dispute, express opt-in is the safest basis for mass marketing. Our regulation data also calls for a logged source of consent that can be reviewed.

A safe routine:

  1. Capture consent with a record: the exact wording, date, time, channel and number.
  2. Say who is sending and what to expect at sign-up, for example "Offers from Kiwi Brew by text".
  3. Honour opt-outs and keep one suppression list across SMS, WhatsApp and email.
  4. Do not buy lists. A purchased number has no consent trail.
  5. Review old lists before reusing them for a new offer.

Our opt-in consent generator drafts sign-up wording, and the guide to opt-in consent across channels shows how to record it.

How must the unsubscribe option work?

It must be clear, free, usable on the same channel and valid for at least 30 days. DIA's page on unsubscribing lists what makes a facility unacceptable: not readily usable, not clear and conspicuous, costing the recipient money, not available through the same method of communication, or no longer valid within 30 days of the message.

DIA also treats continued messages 5 working days after someone attempts to unsubscribe as a valid ground for complaint. Our regulation data says the same in short form: a STOP keyword and a clearly stated unsubscribe on every marketing send, honoured within 5 business days at most. Do not use that as a target. Process opt-outs immediately.

Do Do not
End each marketing text with "Reply STOP to opt out" Ask people to log in or call a paid number to opt out
Stop sending the moment STOP arrives Wait until the end of the campaign to update the list
Treat "Unsubscribe", "Stop" and "Opt out" as the same Require an exact capitalised word
Apply the opt-out to all marketing channels Keep emailing someone who texted STOP without telling them

A two-way SMS set-up that receives replies on the same sender makes the opt-out simple. The definitions of opt-in and opt-out are in our glossary.

Which networks carry SMS in New Zealand?

Three mobile networks appear in our coverage data, each with a direct route:

Operator MCC-MNC
One NZ (Vodafone NZ) 530-01
Spark NZ 530-05
2degrees 530-24

Read delivery reports per network rather than a single blended figure. A healthy total can hide one weak network, and our guide to improving SMS delivery rates shows how to diagnose it. For a neighbouring market with a similar open-sender approach, see our bulk SMS Australia guide.

How do sender IDs work in New Zealand?

You can usually send from an alphanumeric sender ID of up to 11 characters, or from a numeric number, but New Zealand has no published sender ID registry. Our regulation data lists formats as alphanumeric where supported, or a numeric long code or short code, and records that operator requirements are confirmed during onboarding. The lead time is free-form, so we state no typical duration.

What that means for your plan:

  • Choose the sender type by purpose. A brand name helps trust for alerts and promotions. A two-way number is better when you want customers to reply.
  • Test on all three networks. A sender that displays your brand on one network may not on another.
  • Keep names honest. Avoid names that imitate banks, government bodies or the networks. Accurate sender information is also a legal requirement.
  • Use separate senders for OTPs and promotions so a marketing complaint cannot affect your login codes.

If you want us to prepare the paperwork where a network asks for it, see registrations; approval decisions stay with the networks. The sender ID checker and the New Zealand sender ID page show the current position, and our guide to sender ID types explains the options.

How should you separate OTP and promotional traffic?

Keep OTPs, order alerts and other service messages on their own sender and route, and promotions on another. A promotion inside an OTP puts your login codes at risk if the route is filtered.

Traffic Example Practice
Transactional OTP, pickup ready, payment confirmation No promotion inside; own sender; any hour
Promotional Sale, new store, loyalty offer Consent on record; sender identified; unsubscribe in the text; daytime
Mixed "Your order shipped. Get 10% off next time" Avoid; the offer makes it commercial

For OTP design and security, read our OTP authentication messages guide and the article on SMS pumping fraud prevention.

How do macrons and Māori words affect SMS length?

Plain English fits the default GSM 7-bit alphabet, so one message holds 160 characters (153 per part when split). Te reo Māori uses macrons (ā, ē, ī, ō, ū), which are outside that alphabet, so one macron switches the whole message to Unicode with 70 characters (67 per part). Emoji and curly quotation marks do the same. See GSM-7, Unicode SMS and concatenated SMS for definitions.

Encoding Single message Per part when concatenated
GSM 7-bit 160 characters 153
Unicode (UCS-2) 70 characters 67

These examples were counted against the limits (Kiwi Brew is a synthetic cafe chain):

Message Encoding Characters Parts
Your Kiwi Brew code is 482913. Valid for 5 minutes. Never share it. GSM-7 67 1
Kiwi Brew: Your order #1042 is ready for pickup at the Queen Street store. GSM-7 74 1
Kiwi Brew: Kia ora! Our new Taupo cafe opens Saturday. Details: kiwibrew.example/s Reply STOP to opt out GSM-7 104 1
Kiwi Brew: Kia ora! Our new Māori Bay cafe opens Saturday. Details: kiwibrew.example/s Reply STOP to opt out Unicode 108 2

The last two rows differ by one letter. If macrons matter to your brand, accept Unicode for those messages and keep them short, or write place names without macrons only where that is acceptable to your audience. Check final copy in the SMS character counter. For other scripts see SMS character limits and Unicode.

When should you send?

We have not found a regulator-published time-of-day window for promotional SMS in New Zealand, and our regulation data records none. Agree sending hours with your provider, schedule promotions for local daytime and avoid late evenings. New Zealand observes daylight saving, so schedule against local time, not a fixed UTC offset. OTPs and alerts can go at any hour. The send time planner helps schedule campaigns, and SMS marketing rules by country compares hours across markets.

A worked example: a Wellington cafe chain

"Kiwi Brew" (synthetic) has 12 cafes and wants a loyalty-app OTP, pickup alerts and a weekly offer.

  • It sets up two senders, one for transactional texts and one for promotions, and tests both on One NZ, Spark and 2degrees.
  • It collects express opt-in in the app and at the counter, storing the wording, timestamp and number, and shows "Offers by text" with a clear opt-out.
  • It writes OTPs and pickup alerts in plain English at 160 characters or fewer.
  • Each offer starts with the trading name, ends with "Reply STOP to opt out" and is checked against the suppression list before scheduling.
  • It sends the offer without macrons or emoji where a single part matters, and accepts two parts for the occasional te reo announcement.
  • STOP replies feed one suppression list that also covers WhatsApp and email.

What are the common mistakes?

  • Relying on inferred consent for old lists. A purchase three years ago may not support a promotion today.
  • No consent evidence. The sender must be able to prove consent, so a missing timestamp is a real risk.
  • Hard-to-use opt-outs. An unsubscribe that costs money or sits behind a login does not meet DIA's guidance.
  • Missing sender identification. Texts that never say who is sending are non-compliant and look like scams.
  • One macron in every message. It turns 160 characters into 70 and can double your parts.
  • Mixing OTP and promotion on one sender.

How OmniChannels.ai helps

OmniChannels.ai is powered by BroadNet, which has direct routes to One NZ, Spark and 2degrees in our coverage data. We help you choose and test sender types, give you per-network delivery reports and support Unicode text, with SMPP 3.4 for high volume. For indicative list prices, see the New Zealand SMS pricing page, then book a demo. Small team? Our SMS marketing guide for small businesses covers the basics.

Frequently asked questions

Is bulk SMS legal in New Zealand?

Yes. Businesses send OTPs, alerts and marketing by SMS every day. The rule that matters most is the Unsolicited Electronic Messages Act 2007, which bans unsolicited commercial electronic messages, including texts, with a New Zealand link. Send marketing only with consent, identify yourself and include an unsubscribe option. Ask a New Zealand lawyer about specific cases.

What counts as consent to send marketing texts in New Zealand?

DIA's guidance names three kinds: express consent, inferred consent and deemed consent. Express consent is a clear opt-in. Inferred consent comes from an existing relationship. Deemed consent can apply when a person publishes a work address in a business capacity without a no-spam statement. The sender must be able to prove whichever one it relies on.

Does every marketing text need an unsubscribe option?

Yes. The Act requires commercial electronic messages to include a functional unsubscribe facility. DIA says it should be clear, free to use, work through the same channel and still work for at least 30 days. For SMS this usually means a STOP reply or a free link, honoured quickly.

Do I need to register a sender ID in New Zealand?

Our regulation data records no published sender ID registry for New Zealand, and says operator requirements are confirmed during onboarding. Alphanumeric IDs are available where supported, with numeric long codes and short codes as alternatives. Do not assume your brand name will display on every handset. Test on One NZ, Spark and 2degrees before launch.

Does the letter ā in Māori words change the message length?

Yes. Macron vowels such as ā, ē, ī, ō and ū are outside the GSM 7-bit alphabet, so a single one switches the whole message to Unicode. That cuts a single message from 160 to 70 characters, and from 153 to 67 per part when split. Check final copy in an SMS character counter.

Are there legal hours for sending marketing SMS in New Zealand?

We have not found a regulator-published time-of-day window for promotional SMS in New Zealand, and our regulation data records none. Send promotions in local daytime, agree hours with your provider and keep OTPs and alerts on a transactional route that can run at any hour.

Sources

  1. Unsolicited Electronic Messages Act 2007, New Zealand Legislation
  2. New Zealand spam law, Department of Internal Affairs
  3. Three steps to ensure you are not spamming, Department of Internal Affairs
  4. About unsubscribing, Department of Internal Affairs
  5. 3GPP TS 23.038: Alphabets and language-specific information