Privacy, Consent and Compliance in NZ Digital Campaigns

What does NZ privacy law mean for digital campaigns?

The Privacy Act 2020 is the primary privacy law in New Zealand, and it applies to NZ-based businesses and those targeting New Zealanders. For campaigns, it means you must be open about what data you collect, collect only what you need, and protect it properly. The Privacy Commissioner can issue compliance notices, and the guide notes fines of up to $10,000 for non-compliance.

The Act replaced the Privacy Act 1993 with stronger protections and mandatory breach notification. Its key principles cover transparency, purpose limitation, data minimisation, access and correction rights, security safeguards, limits on disclosure to third parties, accountability and restrictions on overseas transfers.

Treat privacy as part of campaign planning from the start. Trust also carries commercial weight: brands that handle data well build deeper and more loyal customer relationships.

What counts as personal data?

Personal data is any information that can identify a person, either directly or indirectly. Even data that looks anonymous can become personal when combined with other information. Marketers handle more of it than they often realise.

• Basic identifiers: name, email address, phone number and physical address.
• Technical identifiers: cookie IDs and, in many cases, IP addresses.
• Device identifiers: device IDs and advertising IDs, which persist across sessions and apps.
• First-party data: CRM records and behavioural data collected through your owned channels, such as purchase history and preferences.

Consider all of these when you design a privacy programme.

What are the consent requirements in NZ?

Consent should be informed, specific and freely given. People need to understand what you collect and how you will use it, and they must be able to decline without penalty. Vague wording is not enough.

• Implied consent is acceptable in some contexts, mainly for non-sensitive information needed to provide a requested service.
• Explicit consent is needed for sensitive data, including health, finance and children's data. Use an opt-in mechanism.
• Cookie banners are not explicitly required by law, but they are recommended best practice and prepare you for regulatory change.

How do NZ expectations compare with Europe and the US?

New Zealand does not mandate cookie consent banners, but market expectations are moving that way. Many NZ businesses adopt stricter standards from overseas so they can serve global clients without separate compliance setups.

A common approach is to work to the highest common standard. For clients with international audiences, a tiered consent model can satisfy both NZ and stricter overseas rules.

What happens as third-party cookies disappear?

First-party cookies are set by the site a person is visiting. They support login, preferences and shopping carts. Third-party cookies come from external platforms such as ad tech and analytics, and they enable cross-site tracking and retargeting. Browsers are restricting the second kind. Safari has blocked them by default since 2017, Firefox has applied Enhanced Tracking Protection since 2019, and Chrome has delayed its own phase-out.

Plan for a multi-solution approach rather than one replacement:

• First-party data, through CDPs and data clean rooms.
• Contextual targeting, which uses page content instead of IDs.
• Identity solutions such as LiveRamp RampID, Google PAIR and Unified ID 2.0.
• Seller Defined Audiences, where publishers package audiences from their own data.
• Server-side tracking.

Start testing these now, so you are ready before the change arrives.

How do you handle CRM and retargeting data compliantly?

Use first-party data responsibly: collect only what you need, explain its use at the point of collection, secure it with access controls, and segment or anonymise where you can.

For CRM and retargeting specifically, follow these rules:

• Confirm every contact has verifiably opted in to marketing.
• Upload hashed data only to ad platforms.
• Refresh CRM lists every 90 to 120 days to remove unengaged contacts.
• Limit retention of data on inactive users to a maximum of 24 months.
• Include an opt-out link in every personalised ad variation.
• Keep an audit trail of consent and restrict CRM access by role.
• Run a privacy impact assessment when launching new retargeting, and keep a breach response plan for marketing data.

What should you check when vetting vendors?

Every vendor that touches your data affects your compliance. Ask these questions before you sign.

• Privacy policy: is it NZ-compliant, clear and regularly updated?
• Cookie management: are first-party and third-party cookies disclosed?
• Consent tracking: is consent stored and logged for audit, and can people withdraw it easily?
• Framework support: do they support GDPR, TCF or similar, and how do they handle cross-border transfers?
• Retention and security: what are their retention rules, and is there a documented breach process?

Your tool stack matters too. Consent management platforms such as OneTrust and Cookiebot record preferences, and Google Tag Manager can control which tags fire based on those choices.

What privacy mistakes should you avoid?

Four mistakes appear again and again.

1. Running CRM lists without a clear opt-in. This risks regulatory action and reputational damage.
2. Collecting more data than you need. Excess data adds liability and security risk.
3. Relying on third-party cookies with no backup plan. Performance will suffer as browsers restrict them.
4. Not explaining your tracking. Plain-language notices and accessible cookie settings build trust.

A good privacy experience has four features: a plain-language policy, simple opt-in and opt-out controls with no pre-selected options, transparent tracking disclosures, and a cookie settings panel that is easy to find and lets people choose by category.

Creative needs the same care. Avoid misleading claims, particularly in finance and health. Keep disclaimers legible and persistent, document the evidence behind every claim, secure rights for all creative assets, and allow time for legal review of regulated campaigns.

Frequently asked questions

Written by the KBR team, an independent media and digital agency in Auckland and Christchurch.