How Does POPIA Affect Meta Ads?

POPIA is South Africa’s Protection of Personal Information Act 4 of 2013. Its text sets rules on consent, objection, electronic direct marketing and sending information abroad. Meta’s pages tell you to have a lawful basis and any necessary consents before you share customer data with Meta. Whether POPIA reaches your ads is for a qualified adviser. This entry reports what the pages say, as checked on 2 Oct 2026, and is not legal advice.

What is POPIA, and when did it take effect?

The South African government page says the Act aims to promote the protection of personal information processed by public and private bodies and to set minimum requirements for processing it. It lists commencement dates: 11 April 2014 for some provisions, and 1 July 2020 for sections 2 to 38 and 55 to 109, among others.

Section 3 says the Act applies to processing recorded by or for a “responsible party” that is domiciled in South Africa, or is not but uses automated or non-automated means there, unless those means only forward information through it. Section 1 defines processing to include collection, storage, use and dissemination by transmission, and personal information to include an identifiable person’s email address and phone number. What you can do: list the customer data you give Meta, for your adviser.

Section 11 allows processing only on listed grounds, including the person’s consent and the legitimate interests of the responsible party or a third party to whom the information is supplied. Section 1 defines consent as a voluntary, specific and informed expression of will giving permission. The responsible party bears the burden of proof for consent, and the person may withdraw it at any time.

Section 11(3) lets a person object at any time to processing for direct marketing, other than the electronic kind covered by section 69, and after an objection the information may no longer be processed. What you can do: record when and how each person agreed.

What does POPIA say about electronic direct marketing?

Section 1 defines direct marketing as approaching a person, in person or by mail or electronic communication, to promote or offer goods or services, or to ask for a donation. Section 69 says processing for direct marketing by any form of electronic communication, including SMS or email, is prohibited unless the person has consented or is, under subsection 3, a customer of the responsible party.

You may approach a person only once to ask for consent, if they have not withheld it.
The customer route needs contact details obtained in a sale, your own similar products or services, and a free chance to object.
Any such communication must name the sender and give an address for stop requests.

This entry does not say a Meta ad is such a communication. Whether an ad, a customer list or a follow-up message is one is for an adviser. What you can do: keep email and SMS consent records.

What does POPIA say about sending information abroad?

Section 72 says a responsible party in South Africa may not transfer personal information about a person to a third party in a foreign country unless a listed ground applies, such as adequate protection under a law, binding rules or agreement, or the person’s consent.

What do Meta’s pages say you must do?

Meta’s business tools page makes these points, and its customer list page repeats the first:

Have a lawful basis and the necessary rights and permissions, including any necessary consents, before you share information with a third party, including Meta.
Where consent is required, share no data until the person has consented. The Pixel should wait for cookie acceptance, and the Conversions API should not send events about people who have not consented.
Do not share prohibited information, including health and financial information and other categories sensitive under applicable laws. Section 26 of the Act restricts “special personal information”, such as health, biometric information and criminal behaviour.
You are ultimately responsible for the data you share.

The page names the European Union as its example for cookie consent and links resources on the GDPR and LGPD. It gives no South African guidance. What you can do: ask your adviser to read it beside the Act.

What does not change wherever you advertise?

Meta’s page says its requirements apply to all Meta business tools, browser-side and server-side, and that you are responsible for consent and permissions.

FAQ

The Act lists consent as one of several grounds for processing (section 11) and requires it, or a customer relationship, for electronic direct marketing (section 69). Whether a Meta ad or customer list falls under those sections is for a qualified adviser.

Does Meta mention POPIA?

Meta’s business tools page links resources on the GDPR and LGPD and names the European Union as its cookie consent example. It does not name POPIA. It does say you need a lawful basis and any necessary consents before you share information with Meta.

Does POPIA cover sending customer data abroad?

Section 72 restricts a responsible party in South Africa from transferring personal information to a third party in a foreign country unless a listed ground applies, such as adequate protection or the person’s consent. Whether sharing data with Meta is such a transfer is for an adviser.

How Does POPIA Affect Meta Ads?