Authored By: Pearl Taeli
University of South Africa
Introduction
South Africa’s property industry has relied on telephonic canvassing for years, and for most of that time, practitioners understood cold calling to sit outside the strict opt-in consent regime that the Protection of Personal Information Act 4 of 2013 “POPIA” imposes on electronic direct marketing. That assumption no longer holds uncontested. In December 2024, the Information Regulator issued a Guidance Note declaring that telephonic marketing conducted over Voice over Internet Protocol “VoIP” now the technology behind most modern calls falls within POPIA’s definition of “electronic communication,” and therefore it requires the same opt-in consent as an SMS or email. This article argues that the Regulator’s interpretation is not supported by the plain wording of section 69, that it sits awkwardly alongside the newer, opt-out-based compliance regime introduced by 2026 amendments to the Consumer Protection Act 68 of 2008 “CPA”, and that only a court, not further regulatory guidance, can resolve the resulting uncertainty for property practitioners.
The Legal Framework
Section 69 of POPIA generally prohibits the use of personal information for direct marketing through “unsolicited electronic communication”, unless the person has given prior consent or is an existing customer being offered similar goods or services. The Act defines “electronic communication” in a relatively narrow way it refers to things like a text, voice, sound or image message sent through an electronic communications network that is stored on the network or on the recipient’s device until the recipient retrieves it.
For more than a decade, legal practitioners and commentators interpreted this definition as not covering live telephone calls. The reasoning was straightforward during a real-time phone conversation, the communication is not necessarily stored somewhere waiting for the recipient to retrieve it. On this interpretation, cold calling was not regarded to fall within the section 69’s consent requirement. Instead, it was generally understood to be subject to an opt-out approach a person could receive an initial marketing call and then request not to be contacted again, but the caller did not necessarily need to obtain consent before making that first call.
This reading was reinforced by the CPA, which has long given consumers a separate right to object to direct marketing and to pre-emptively block unwanted contact through a registry mechanism. Because the CPA route did not require providers to prove opt-in consent before the first contact, cold calling and CPA-registry compliance developed as a coherent, if imperfect system.
The Regulatory Shift
The Information Regulator’s 2024 Guidance Note challenged this long-standing interpretation. The Regulator’s reasoning is based on the fact that most modern telephone calls are made through Voice over Internet Protocol (VoIP) rather than traditional telephone networks. Because VoIP calls are transmitted digitally in packets, the Regulator considers them to fall within the scope of section 69. This means that, according to the Guidance Note, a property practitioner who wants to cold-call a potential seller would first need to obtain prior consent, using the prescribed Form 4. That consent could apparently be obtained in writing or even read aloud during the call. In practical terms, however, this creates an obvious difficulty if consent must be obtained before the call is made, the practitioner cannot simply make the initial cold call to ask for that consent.
This interpretation has not gone unchallenged. Legal practitioners, including ENSafrica, have pointed out that the Guidance Note that represents a significant departure from the interpretation of POPIA that had generally been accepted before 2024. They also question the distinction between traditional telephone calls and VoIP calls. If the statutory definition requires the communication to be stored until it is retrieved by the recipient, it is not immediately clear why a VoIP call should satisfy that requirement when a traditional live telephone conversation does not. The Guidance Note itself recognises that it is not legally binding and cannot overrule the wording of POPIA where there is a conflict. Nevertheless, it is important in practice because it indicates how the Information Regulator is likely to interpret and enforce the Act, leaving property practitioners to balance the legal uncertainty against the risk of non-compliance.
The position becomes even more complicated when the Consumer Protection Act (CPA) is considered. The CPA’s compliance requirements were also tightened in 2026, requiring property practitioners involved in cold calling and canvassing to register annually as direct marketers, keep their registration information up to date, conduct monthly checks against the opt-out registry and clearly identify themselves during each communication. This creates a relatively straightforward opt-out system, under which cold calling remains permissible provided that the practitioner complies with the registration and registry requirements. The difficulty is that the Information Regulator’s 2024 Guidance Note appears to challenge this assumption by suggesting that the same cold call may also require prior opt-in consent under POPIA.
The result is a clear tension between the two regulatory approaches: the CPA appears to permit cold calling subject to compliance with its opt-out requirements, while the Information Regulator’s interpretation of POPIA potentially requires consent before the call is made in the first place.
Critical Analysis and Argument
The issue is therefore more than just a legal debate. It creates a real compliance problem for property practitioners. Much of the existing commentary treats POPIA and the CPA as two separate sets of requirements that practitioners simply need to comply with. However, this does not fully address the conflict created by the Regulator’s position on VoIP calls. If that interpretation is correct, complying with the CPA’s opt-out registry would not be enough to protect a practitioner from liability under POPIA. In other words, a practitioner could be properly registered, have checked their database against the relevant registry and complied with all the CPA requirements, but could still breach POPIA by making the same call without obtaining prior consent.
This tension was already apparent in the property industry before the Guidance Note formally addressed it. In 2024, cold calling remained a relatively ordinary practice among property practitioners and was generally approached on an opt-out basis. By 2025, however, industry data providers such as Lightstone had started placing greater emphasis on POPIA compliance in their services, including features relating to personal-information searches and the tracking of consent. This suggests that the industry was beginning to respond to the growing regulatory risk even though the underlying legal question had not yet been definitively resolved.
From a legal perspective, there is still a strong argument that a live telephone conversation, whether made through a traditional network or VoIP, does not meet section 69’s requirement that an electronic communication be stored until it is retrieved by the recipient. On this interpretation, the Regulator has arguably given the statutory definition a broader technical meaning than Parliament intended when POPIA was enacted.
However, the practical difficulty is that the Guidance Note, although not legally binding, provides a clear indication of how the Information Regulator is likely to approach enforcement. Property practitioners therefore cannot simply ignore it and rely on what may be the stronger interpretation of the legislation. The most reliable way to resolve the uncertainty would be through a declaratory court order, whether brought by an affected practitioner, an industry body, or arising from enforcement proceedings. Such an order could finally determine whether VoIP based cold calling falls within section 69.
Until that happens, property practitioners are effectively required to navigate two overlapping regulatory systems governing the same conduct. The CPA operates on an opt-out model, while the Regulator’s interpretation of POPIA potentially introduces an opt-in requirement. This unresolved conflict leaves the property industry having to manage regulatory risk in an area where the law itself remains unsettled.
Conclusion
POPIA’s approach to cold calling highlights a broader concern within South African data protection law: important compliance requirements are increasingly being shaped by non-binding regulatory guidance rather than through amendments to legislation or clear judicial interpretation. The Information Regulator’s interpretation of section 69, particularly its focus on VoIP calls, can be understood as a legitimate policy concern, but it is also a legally strained interpretation of the statutory definition. This creates further uncertainty because it sits uneasily alongside the CPA’s compliance framework, which operates on the assumption that cold calling is permitted subject to opt-out and registration requirements.
For property practitioners and the wider Prop Tech industry, the safest practical approach is therefore to follow the stricter interpretation of the law until greater certainty is provided. The more fundamental solution, however, is for a court to determine whether a live telephone call particularly a VoIP call can properly be regarded as being “stored” within the meaning intended by POPIA’s drafters. Until that question is settled, practitioners are left navigating the uncertain boundaries of legislation that was enacted before today’s communication technologies became commonplace.
Reference(S):
LEGISLATION
Consumer Protection Act 68 of 2008.
Protection of Personal Information Act 4 of 2013.
PRIMARY SOURCE
Information Regulator, ‘Guidance Note on Direct Marketing in terms of the Protection of Personal Information Act 4 of 2013 (POPIA)’ (Information Regulator, December 2024).
SECONDARY SOURCE
Era Gunning, Wilmari Strachan and Priyanka Raath, ‘Information Regulator’s Guidance Note on Direct Marketing: What do you need to know?’ (ENSafrica, 10 December 2024).
‘CPA Amendments 2026: What Property Practitioners Need to Know About Cold Calling’ (Bizmag, 20 May 2026).
Tayyibah Suliman and Sadia Rizvi, ‘Navigating the Information Regulator’s guidance note on direct marketing’ (Cliffe Dekker Hofmeyr, 29 January 2025).
POPI Act and cold calling: a tricky matter’ (Property Professional, 3 September 2020).
How many times are you allowed to cold call the same homeowner?’ (Property Professional, 2 December 2024).
