The Spam Law and Consent

A marketing email, a promotional SMS or a WhatsApp message to customers looks like ordinary marketing. In Israel, however, sending advertising messages is subject to strict rules set in the Communications Law, known as the "spam law". Many businesses face claims simply because they did not know the rules apply to them.

This article explains the principle, what counts as consent, the opt-out duties and how all of this connects to privacy law.

What does the law regulate?

The law deals with sending an "advertising message" by email, SMS or automated message, fax, and automated-dialling calls. For each of these the rule is a prohibition and permission is the exception: an advertisement may not be sent unless the recipient gave explicit consent in advance. The exact rules and exceptions are in section 30A of the Communications Law and are refined by case law, so check them before every campaign.

What is an "advertising message"?

A message whose main purpose is to encourage buying a product or service or spending money in another way. A sale notice, a newsletter with a purchase link or an offer of a new service may qualify. A purely service message, such as confirming an order already placed, is different, but the line is not always sharp. A message that mixes service content with a marketing pitch may be treated as advertising.

What is valid consent?

Consent to marketing messages should be explicit and given in advance. A few principles help:

• Explicit: the recipient took a clear action, such as ticking a box or signing, rather than merely "not objecting".
• Separate: preferably not buried in long terms of use. Clear, visible wording is better.
• Provable: the business should be able to show when, how and from which address consent was given. Without records, defending a claim is hard.
• Focused: consent to offers on one subject is not necessarily consent for every subject or for every party who receives the details.

A pre-ticked box, or consent taken as a "condition" for an unrelated service, raises questions. Receiving a business card or buying a mailing list does not replace consent.

A limited exception

The law recognises certain situations where an existing customer may be contacted without fresh consent, subject to conditions: the details were provided during a purchase or negotiation, the offer concerns similar products, and the customer was given a clear way to refuse. The exception is narrow, so anyone relying on it should verify that every condition is met.

The opt-out duty

Even with consent, every message must include a simple way to stop receiving messages. Opting out must be accessible and free, and a removal request requires stopping within a reasonable time. Continuing to send after such a request is among the most problematic cases.

Keep a central suppression list so that someone removed in one channel does not keep receiving messages in another. The message should also be marked as advertising and identify the sender, with contact details, as the law requires.

Legal exposure

A violation may lead to several kinds of consequences:

• A civil claim. The law lets a recipient claim compensation in an amount set by the law for each message, even without proving damage. With many messages the total may be significant. The court examines the circumstances, so there is no single figure.
• A class action. Because violations usually affect many people, class actions have been filed in this area.
• Criminal liability. The law also contains criminal provisions; check the current text.

We do not state amounts here, because they are set in the statute and are updated. Check them in the official text when needed.

The link to privacy protection

A mailing list is a personal data database. Beyond the spam law, privacy law also applies: the duty to inform people of the purpose of collection, information security, the right to inspect and correct, and limits on using the data beyond its original purpose. The latest amendment to the Privacy Protection Law widened the duties; see our article on Amendment 13. For websites that collect details, a website privacy policy matters too.

For a larger organisation, or sensitive data, a privacy officer may also be required: who must appoint one.

A checklist for businesses

1. Does every recipient on the list have documented consent?
2. Is the consent wording clear, collected with an empty checkbox?
3. Does every message have a working opt-out link?
4. Are removal requests handled in all channels?
5. Are messages marked as advertising and do they identify the sender?
6. Was only the necessary data collected and is it properly secured?
7. Was any purchased or transferred list checked before use?

What if a claim or demand arrives?

If you receive a demand letter or a statement of claim over mailings, do not ignore it and do not delete records. Preserve the mailing list, the consent records and the opt-out messages, and stop sending to the claimant immediately. Early legal advice lets you check whether there was a basis for consent and assess the exposure soundly and sensibly.

FAQ

Is consent needed to message an existing customer? Usually yes, unless the exception's conditions are met. It depends on the circumstances.

Does "if you are not interested, reply" help? Not always. An opt-out option is required, but it does not replace prior consent.

Does the law apply to a small business? Yes. It applies to anyone sending advertising messages, regardless of size.

In summary

Direct marketing is a valuable tool and can be used smartly and safely, provided there is orderly consent, records and a simple opt-out. Review your procedures before starting a campaign. To review consent wording and privacy policies, read about privacy protection and the privacy officer role or contact us. This article is general and is not legal advice.