POPIA and marketing tracking: what to check

Not legal advice. This is general information for marketers, written from a data and tracking perspective. POPIA applies to your specific circumstances in ways only a qualified South African lawyer or your information officer can confirm. Check the Act and the Information Regulator's guidance directly before making decisions.

The short answer: the Protection of Personal Information Act (POPIA) applies to most marketing data in South Africa, including contact details, CRM records and online identifiers. That means you need a lawful ground for collecting and using it, you need to tell people what you do, and unsolicited electronic marketing has its own rules. Tracking tools that send data abroad add cross-border considerations.

What POPIA covers in marketing

POPIA is South Africa's data protection law, enforced by the Information Regulator. It covers personal information, which the Act defines broadly. The definition includes things marketers collect every day, such as email addresses, phone numbers, location information and online identifiers.

• Website analytics and ad pixels, where cookies or device identifiers can link activity to a person.
• Forms and CRM records, including names, emails, company details and the UTM tags and click IDs saved with them.
• Email and messaging lists, which fall under both the general rules and the direct marketing rules.
• Data you send to platforms, for example hashed emails or CRM stages sent to ad platforms through server-side or offline conversion tracking.

Your business is usually the responsible party. The tools and agencies that process data for you are operators, and the Act expects a written arrangement with them.

Lawful grounds and notices

POPIA requires a justification for processing personal information. Consent is one ground. Others include what is necessary to perform a contract, and a legitimate interest of the responsible party or a third party, provided it does not override the person's rights. Which ground fits each activity is a question for your lawyer.

• Tell people. Your privacy notice should say what you collect, why, who receives it, and how people can ask about or correct their information. Keep it current when you add tools.
• Collect what you need. Do not capture fields, or keep records, longer than the purpose requires.
• Be able to respond. People can ask what you hold, and ask for corrections or deletion where appropriate. Know where the data sits, including in ad platforms and spreadsheets.
• Secure it. Limit who can access CRM exports and reporting data, and review it when staff or agencies change.

Direct marketing rules

The Act sets rules for unsolicited electronic communications, such as email, SMS and automated calls. The general approach is opt-in: people are not contacted for direct marketing unless they have consented, with limited exceptions such as certain existing customers who were given a chance to opt out. Check the current text of the relevant section, and make sure your forms record consent clearly, with a record of when and how it was given.

• Do not pre-tick marketing consent boxes.
• Keep consent for newsletters separate from consent for enquiries.
• Include a working unsubscribe in every message, and honour it promptly.
• Store consent status in the CRM so lists, automations and imports respect it.
• Be careful with bought or scraped lists. Your lawyer can confirm what is permitted.

Tracking tools and cross-border transfers

Most analytics and advertising tools run on servers outside South Africa. POPIA places conditions on transferring personal information to a third party in another country, such as the recipient being subject to similar protection or a suitable agreement being in place. Your lawyer or information officer should confirm how that applies to Google, Meta, LinkedIn, Microsoft and your CRM vendor.

• List your tools. GA4, Tag Manager, ad pixels, CRM, email platform, chat widgets, heatmaps, form tools. Note what data each receives and where it is hosted.
• Review data processing terms with each vendor, and keep them on file.
• Use consent controls. A consent banner that defers non-essential tags until the visitor chooses lets you honour their choice. Google's Consent Mode passes that choice to Google tags.
• Minimise what you send. If you use the Meta Conversions API or offline conversion uploads, send only the fields you need, and hash identifiers where the platform expects it. See the Meta Conversions API guide and offline conversion tracking.
• Consider where the server sits. Server-side tracking gives you control over what leaves your site, but it does not change your obligations.

If you also market abroad

If you reach visitors in the UK, the EU or other regions, their laws may apply too. The UK and EU generally expect opt-in consent before non-essential cookies and ad tracking load, and Google's consent signals have to be set before tags fire. A common approach is a region-aware consent default: stricter where the law is stricter, and clearly worded everywhere. We run our own site this way, with analytics denied by default in the UK, EEA and Switzerland until the visitor chooses, and advertising storage denied everywhere until they accept.

A practical checklist

• A current privacy notice that names the tools you use and what they collect.
• A consent banner that actually blocks non-essential tags until consent, where that is required.
• Consent boxes on forms that are unticked, specific and recorded.
• A record of vendors, hosting regions and data processing terms.
• CRM fields for consent status and source, and a way to honour opt-outs across tools.
• A routine for access, correction and deletion requests, including in ad platforms.
• Limited access to exports and dashboards, and a review when agencies or staff change.
• A named information officer and a lawyer you can ask about edge cases.

Tracking that respects consent still works. It means some visitors will be unmeasured, which is why reports should say how much data is missing. The accuracy side of this is covered in B2B marketing attribution and GA4 vs Google Ads conversions. Our GA4 and Tag Manager work includes consent configuration, and our privacy policy shows how we handle our own site.

Questions people ask