POPIA and your marketing: what changes when you use AI

Using an AI tool to draft a headline from public product information is different from uploading a customer list and asking a tool to rank people by predicted willingness to buy. The second example involves personal information and makes the privacy questions harder to ignore.

POPIA is not a general ban on AI marketing. It applies to the processing of personal information, so the relevant questions are what information is used, for what purpose, by whom and under what safeguards. The Protection of Personal Information Act 4 of 2013 and the Information Regulator’s direct-marketing guidance are the places to start. This article is practical orientation, not legal advice.

Start by asking whether personal information is involved

A prompt that contains a person’s name, phone number, email address, purchase history or private message may involve personal information. Even if the AI tool produces only a segment or a draft, the information used to create that output still needs a clear purpose and appropriate handling.

Use the least information needed. For a general campaign draft, anonymised or invented examples may be enough. Avoid copying customer conversations or records into a tool unless the business has checked that the use is appropriate and the tool’s terms, access controls and data practices fit the task.

Know who is responsible for the data

POPIA defines a responsible party as the person or organisation that determines why and how personal information is processed. An operator processes personal information for a responsible party under a contract or mandate. Those roles depend on the actual arrangement, not merely on what a software provider calls itself.

If a supplier or AI service handles personal information for your business, check the agreement, confidentiality and security arrangements, what information is retained and what happens when the service ends. POPIA requires a written contract with an operator that ensures appropriate security safeguards. The business still needs to understand and govern the processing it has chosen.POPIA, sections 20–21

Direct marketing still needs a lawful route

Using AI does not create a new permission to send marketing. Section 69 of POPIA addresses direct marketing through unsolicited electronic communications. In broad terms, consent is required unless the limited existing-customer exception applies. That exception is tied to contact details obtained in the context of a sale, marketing the responsible party’s own similar products or services, and giving the person a reasonable, free way to object when their details are collected and in each marketing message. The message must identify the sender and provide contact details to ask that it stop.POPIA, section 69

The Information Regulator’s guidance note on direct marketing explains the difference between electronic and non-electronic marketing. A customer message, service update and unsolicited promotion can have different purposes. Do not assume every WhatsApp conversation is marketing, or that a customer inquiry automatically gives permission for later promotions.

Be careful with profiling and sensitive information

POPIA section 71 addresses a decision based solely on automated processing when it is intended to profile someone and has legal consequences or affects them to a substantial degree. The section has exceptions and protective requirements. It should not be described as applying automatically to every AI-assisted draft or ordinary ad campaign. The wider POPIA conditions can still matter when personal information is used.POPIA, section 71

Special personal information, such as information about health, beliefs or criminal behaviour, has additional restrictions. It is not implicated by every marketing list or personalisation task. If a campaign actually uses this kind of information, get advice before processing it.

Put a human check into the workflow

Before a campaign goes out, confirm what data fed it, who can access the results, whether the audience criteria match the stated purpose, and how a person can object or opt out. Review AI-generated copy for claims the source data does not support. Keep records of decisions and permissions where needed.

A sensible next step

Map one campaign from the data source to the final message. Write down what personal information enters the process, which systems handle it, who approves the audience and how recipients can object. If that map is unclear, pause automation and get privacy advice before expanding the campaign.

FAQs

Does POPIA ban AI tools in marketing?
No general ban is described in POPIA. The Act’s ordinary requirements still matter when a tool processes personal information, and specific rules may apply to direct marketing, sensitive information or certain automated decisions.

Can I upload customer details to an AI tool?
That depends on the data, purpose, tool, contract and safeguards. Do not assume it is appropriate just because the tool accepts the upload. Minimise the data and check the arrangement first.

Does AI-assisted marketing need consent?
The tool does not remove the direct-marketing rules. If personal information is processed for unsolicited electronic direct marketing, section 69 and the limited customer exception are relevant. Assess the specific communication and relationship.

Sources: Protection of Personal Information Act 4 of 2013, Information Regulator guidance notes, Information Regulator direct-marketing guidance note.