Direct mailing and advertising: two laws, two duties

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Direct marketing in Israel sits at the crossroads of two laws that people tend to confuse. The distinction is simple: the Communications Law asks how you sent it. The Protection of Privacy Law asks where you got the list.

The first track: section 30A of the Communications Law

Section 30A(b) sets the rule: “An advertiser shall not send an advertising message by fax, an automatic dialing system, an electronic message or a short text message without receiving the recipient’s prior express consent, in writing, including in an electronic message or a recorded call.”

This is an opt-in regime. There is no “implied consent” and no “unsubscribe if you don’t want it”. Consent is required in advance, expressly and in writing. The section adds that dialing through an automatic dialing system without consent is also a breach, “even if the dialing was stopped before the call was answered”.

Section 30A(c) sets the main exception, and its conditions are cumulative: the recipient gave their details to the advertiser during a purchase or negotiations for a purchase, and the advertiser told them that the details would be used to send advertising messages; the advertiser gave them an opportunity to give notice that they refuse, and the recipient did not do so; and the advertising message relates to a product or service of a type similar to the one purchased. This is the basis of every properly built sign-up form.

What happens in case of a breach

• Section 30A(i): “A breach of the provisions of this section is a civil wrong, and the provisions of the Torts Ordinance [New Version] shall apply to it.”
• Section 30A(j)(1): where an advertising message was sent knowingly contrary to the provisions of the section, the court may award compensation that does not depend on damage, in an amount not exceeding NIS 1,000 for each advertising message.
• Section 30A(h): a manager of a corporation and whoever is responsible for marketing or advertising in it must supervise and do everything possible to prevent an offense. If an offense was committed, it is presumed that the officer breached their duty, unless they did everything possible.

The combination of “for each advertising message” with the personal presumption against the officer is what turned the field into a central arena for class actions.

The second track: the list itself

The Protection of Privacy Law regulates the other side of the same activity: holding the information and processing it. Section 17D:

“A controller of a database or a holder of a database shall not process personal information in a database used for direct mailing services unless it is registered in the Register and one of its registered purposes is mailing services.”Protection of Privacy Law, 5741-1981, section 17D — Nevo text (unofficial translation)

This is a preliminary requirement for a database used for “direct mailing services”, meaning providing mailing services to others by transferring lists, labels or data (definition in section 3): such a database must be registered, and “mailing services” must appear as one of its registered purposes; the recipients’ consent is not enough. A business that sends mailings to its own customers from its own database does not provide “direct mailing services”, and since Amendment No. 13 the duty to register applies only to the databases listed in section 8A. Section 17E adds a duty to keep a record of the source from which each collection of data was received, the date it was received and to whom it was provided.

What must appear in every message

Section 17F(a) lists three details that every direct mailing message must include “clearly and prominently”:

1. a statement that the message is a direct mailing, together with the registration number of the database used for direct mailing services in the Register of Databases;
2. a notice of the recipient’s right to be deleted from the database, together with the address to write to for this purpose;
3. the identity and address of the controller of the database on the basis of which the message was sent, and the sources from which it received the information.

The registration number of the database is required when the message is based on a database used for direct mailing services, and in that case it is an express requirement in the wording of the Law.

And what happens when these duties are breached? A person may demand in writing that the information about them be deleted from a database used for direct mailing; the controller must act on the demand and notify them of this in writing, and if it did not notify them within 30 days, they can apply to the Magistrates’ Court (section 17F(b), (d) and (e)). Since Amendment No. 13, the head of the Privacy Protection Authority may impose a monetary sanction, including: NIS 50 for each person who received a message without the details in section 17F(a) (NIS 100 for information of special sensitivity), and NIS 30,000 if the calculated amount is lower than that (section 23Z(c)); NIS 15,000 for failing to comply with a deletion demand (section 23Z(b)(5)); and NIS 150,000 for processing in a database for direct mailing services that is not registered (section 23Z(a)(3)). These are the base amounts in the Law; under section 23FF(b) they are updated on 1 January each year, and in 2026 they are NIS 51.18 (NIS 102.36 for sensitive information), NIS 30,710, NIS 15,350 and NIS 153,540 (notice on the update of the monetary sanction amounts, Yalkut HaPirsumim 15000, 7 October 2026, in Hebrew).

A checklist for businesses

• Consent: kept, documented, and you can show when and how it was given. Section 30A(b) requires it to be “express, in advance, in writing”.
• The mechanism: every message starts with the word “advertising” (and in email, in the subject line) and includes the advertiser’s details and a simple way to give notice of refusal (section 30A(e)(1)). In an SMS the Law requires only the advertiser’s name and the ways to contact them to give notice of refusal (section 30A(e)(2)), but it is advisable to state “advertising” there too. Requests are actually handled, not just recorded.
• The database: if it is used for direct mailing services (transferring lists to others), it is registered, and one of its registered purposes is mailing services (section 17D).
• The message: it carries the details in section 17F(a), including, when it is based on a database for direct mailing services, the registration number of the database.
• Supervision: an internal procedure that shows the officer “did everything possible”: this is the only defense against the presumption in section 30A(h).

And what does not exist: Israel has no “mail prohibition law”, and there is no general duty under such a law to keep records of consent and present them to the authorities. The duties are those in the two laws above, and they are enough.

Frequently asked questions

Do you need prior consent to send advertising?

Yes. Section 30A(b) of the Communications (Telecommunications and Broadcasting) Law, 5742-1982, prohibits sending an advertising message by fax, an automatic dialing system, an electronic message or a short text message without the recipient’s prior express consent, in writing.

What is the exception to consent?

Section 30A(c) sets three cumulative conditions: the recipient gave their details during a purchase or negotiations for a purchase, and the advertiser told them that the details would be used to send advertising messages; the advertiser gave them an opportunity to give notice that they refuse, and the recipient did not do so; and the advertising message relates to a product or service of a similar type.

What is the compensation for a breach?

Section 30A(i) provides that a breach of the section is a civil wrong. Section 30A(j)(1) allows the court to award compensation that does not depend on damage, in an amount not exceeding NIS 1,000 for each advertising message sent knowingly contrary to the provisions of the section.

What must appear in a direct mailing message?

Section 17F(a) of the Protection of Privacy Law requires every message to include, clearly and prominently: a statement that the message is a direct mailing, together with the registration number of the database used for direct mailing services in the Register of Databases; a notice of the right to be deleted from the database and the address to write to; and the identity and address of the controller of the database and the sources from which it received the information. In addition, section 17D prohibits processing information in a database used for direct mailing services unless it is registered and one of its registered purposes is mailing services. These registration and disclosure duties are part of the legal aspects of e-commerce, and not a separate topic handled only by the marketing people.