When a marketing email crosses the line into a legal violation
An Israeli SaaS company sends a marketing campaign to hundreds of leads collected at an industry conference. A week later, it receives a complaint claiming the messages were sent without consent. This is a common scenario, and it typically stems from an incomplete understanding of the legal framework governing marketing communications in Israel.
The controlling statute is Section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982 — commonly known as the "Anti-Spam Law" (introduced by Amendment 40 to the law). The section applies to any "advertising message" sent by fax, SMS, email, or automated dialing systems.
The law defines "advertising message" broadly: any communication intended to encourage the purchase of a product or service, including promotion of the company's own offerings, event promotion, and even content designed primarily to grow a customer base. Many companies underestimate the scope of this definition, assuming the law applies only to explicit advertisements. In practice, it also applies to newsletters that incorporate marketing content.
Prior consent and the existing-customer exception
The baseline rule under the Anti-Spam Law is opt-in consent: an advertising message may not be sent without the recipient's express prior consent, and silence or failure to object does not constitute consent.
There is one defined and narrow exception: the "existing customer" exception. This exception applies only when three conditions are met simultaneously:
- The recipient is an existing customer who provided their details in the course of a purchase or business relationship
- The business notified the customer, at the time their details were collected, that they might be used for marketing purposes, and gave the customer a reasonable opportunity to object
- The advertisement concerns a product or service similar to one the customer previously purchased
It is important to understand that this exception is not a gateway to send marketing to anyone who ever signed up to a mailing list. It is limited to actual customers and to similar products only. Businesses maintaining raw lead lists — details of individuals who never made a purchase — need express, documented consent, and cannot rely on this exception.
What every marketing message must include
Beyond the question of consent, the Anti-Spam Law imposes mandatory technical requirements on the content of the message itself. Failing to meet these requirements is a violation in its own right, even where consent to send was validly obtained.
- A clear indication that the message is an advertisement
- Identifying details of the advertiser, including business name and contact information
- A simple, accessible, and free mechanism to withdraw consent (unsubscribe from the mailing list)
Once a recipient requests removal, the business must stop sending further advertising messages to that recipient within the timeframe prescribed by law. Continuing to send messages after an unsubscribe request constitutes a separate violation, even if the original message was sent lawfully.
Businesses should verify that their marketing automation systems fully implement unsubscribe requests, including in sub-lists, parallel campaigns, and every tool that feeds into the mailing infrastructure, and not only in the primary list.
Direct mailing and mailing lists under the Privacy Protection Law
In addition to the Anti-Spam Law, the Privacy Protection Law, 5741-1981 (as amended by Amendment 13), regulates "direct mailing" — contacting an individual based on details originating from the collection and processing of personal information into a mailing list, addressing the data itself rather than merely the method of delivery.
A business that operates a mailing list for direct mailing purposes, or that uses a third-party service for that purpose, is subject to obligations distinct from those under the Anti-Spam Law: it must disclose to the recipient, upon request, the source of the information underlying the mailing, and must allow removal from the list free of charge. These obligations exist alongside the consent requirements of the Anti-Spam Law, not in place of them.
It is important to emphasize that Amendment 13 narrowed the database registration requirement so that it now applies to public bodies and to "data brokers" above a statutory threshold, rather than functioning as a general requirement for every business operating a mailing list. That said, the substantive obligations relating to direct mailing — disclosure of source and the right of removal — remain in force independent of any registration requirement.
Privacy Protection Authority guidance requires separate consent for profiling
The Privacy Protection Authority's final guidance on consent, which entered into force in early 2026, sets a stricter standard for informed consent generally, and for marketing communications in particular.
- Consent to receive marketing communications (under the Anti-Spam Law)
- Separate consent to direct mailing — that is, being contacted using details originating from a personal-data mailing list
- Separate consent to profiling — that is, the analysis of behavioral data and personal information to tailor marketing content or segment audiences
The guidance provides that a single blanket consent covering multiple distinct purposes is no longer sufficient. Each of the following situations requires its own separate, specific consent:
In practice, this means a single checkbox reading something like "I agree to the terms and to receive marketing communications" no longer meets the standard. Businesses must clearly separate each consent, use plain and understandable language, and allow each consent to be withdrawn independently. Companies using data-driven marketing automation tools, such as segmentation based on browsing history, should revisit their consent mechanisms on their websites and applications.
Enforcement, civil claims, and administrative fines
The Anti-Spam Law grants recipients a civil cause of action without any requirement to prove actual damages, a mechanism that significantly lowers the barrier to filing claims, including class actions in cases of mass marketing. This represents a meaningful financial and operational risk for businesses running large-scale marketing campaigns.
On the civil side, the Ministry of Communications is also authorized to act against violators through administrative measures. In parallel, following Amendment 13 to the Privacy Protection Law, the Privacy Protection Authority now holds expanded enforcement powers and the authority to impose significant administrative fines for violations of the law, including violations relating to the processing of personal data for direct mailing purposes.
The combination of these two enforcement tracks, civil liability under the Anti-Spam Law and regulatory enforcement by the Privacy Protection Authority, creates dual exposure for any business that fails to properly manage its consent mechanisms.
What businesses should actually do
Full compliance with the Anti-Spam Law and the Privacy Protection Law requires ongoing review of marketing processes, not merely a legal document drafted once and filed away. The following practical steps are recommended:
- Conduct an audit of all existing mailing lists and verify the source of consent for each entry
- Clearly distinguish between existing customers, to whom the narrow exception may apply, and leads, who require express consent
- Separate the consent mechanism for marketing from consent for profiling, in line with the Privacy Protection Authority's guidance
- Ensure every message identifies the sender and includes an accessible, free unsubscribe mechanism
- Implement an internal process that carries out removal across all systems within the statutory timeframe
- Document consent, including date, wording, and channel, to support proof in the event of a dispute
Effective digital marketing and legal compliance are not mutually exclusive. A business that invests in a well-structured consent infrastructure benefits from both higher-quality mailing lists and meaningful legal protection against claims and enforcement action.
The information contained in this article is general in nature and does not constitute legal advice. For advice tailored to the specific circumstances of your company, we invite you to contact our firm.
