AI direct marketing calls in Nigeria, Kenya and South Africa: consent and opt-out rules

Do you need consent to make AI marketing calls in Nigeria, Kenya and South Africa?

In practice, yes, in all three countries. Each has a data protection law built on the same idea as Europe's GDPR: personal data, including a phone number, may be used only on a lawful basis, and marketing is one of the uses those laws single out. Nigeria has the Nigeria Data Protection Act 2023 (NDPA), Kenya the Data Protection Act 2019, and South Africa the Protection of Personal Information Act 2013 (POPIA). Older telecom and consumer rules sit on top of each.

Nigeria is the most direct. It requires consent "for any direct marketing activity" (General Application and Implementation Directive, or GAID, Article 18(1)(a)). Kenya bars using personal data for commercial purposes without express consent, unless a written law allows it (Data Protection Act, section 37(1)). Its telecom rules go further for automated calls: using "automated calling systems without human intervention" for direct marketing without the subscriber's prior consent is an offence (Consumer Protection Regulations, 2010, regulation 17(1)).

South Africa is the most contested of the three. POPIA requires consent for direct marketing by electronic communication, including automatic calling machines (section 69(1)). The Information Regulator says ordinary phone calls count too. Law firms say that view is open to challenge, and the Regulator's guidance is not binding.

Whatever the outcome of that debate for human callers, an AI agent that dials people automatically sits on the strict side of the line in every country. The workable plan is the same everywhere: consent first, a clear opt-out on every call and a stop list that works across all your campaigns. None of the three laws we reviewed requires the agent to say it is an AI, unlike the EU AI Act's disclosure rule for voice agents, but saying so costs one sentence.

Nigeria: consent under the NDPA and GAID, and the DND list

Nigeria's rule leaves the least room for argument. The Nigeria Data Protection Commission (NDPC) issued the GAID under the NDPA, and the GAID lists direct marketing as the first case where consent is required (Article 18(1)(a)). The GAID is dated 20 March 2025.

Consent may be written, oral or electronic, but silence is not consent (NDPA section 26(3) and (7)). For a voice agent, that means a person who simply stays on the line has not agreed to anything. Whatever form the consent takes, keep a record of it (GAID Article 17(6)). Before collecting data, you must also tell the person who you are, why you are collecting it and what their rights are (NDPA section 27).

People can object to direct marketing at any time, and you must then stop using their data for it (NDPA section 36(3) and (4)). Withdrawing consent must be as easy as giving it (section 35(2)). If a person can agree in one sentence on a call, one sentence must be enough to withdraw, so a spoken "stop calling me" should end the call and mark the number at once.

Telecom rules sit on top of the data law. The Nigerian Communications Commission (NCC) runs a Do-Not-Disturb (DND) service on short code 2442. People text STOP to block all unsolicited calls and texts, or HELP to choose the categories they still want. Check numbers against your carrier's DND data before calling. Breaching the NDPA can cost the greater of ₦10 million or 2% of annual gross revenue for data controllers and processors of major importance, and the greater of ₦2 million or 2% for others (section 48).

Kenya: express consent, spoken opt-outs and the rule on automated calls

Kenya reaches a similar result through two sets of rules, its data protection law and older telecom consumer rules, and together they mean: get express consent, and offer an opt-out on every call. You may not use personal data for commercial purposes without the person's express consent, unless a written law allows it (Data Protection Act, section 37(1)). The regulations define commercial purposes broadly, to include inducing someone to buy, rent, subscribe to or exchange products or services (Data Protection (General) Regulations 2021, regulation 14). A typical AI sales call fits that description.

Every direct marketing message must give a free way to ask you to stop (regulation 15(2)). On a marketing call, one way to do that is to tell the person they may opt out of future calls verbally (regulation 17(2)(d)). Once someone opts out, you must not use their data for direct marketing (regulation 16(2)). If a person asks you to stop sharing their data with third parties for marketing, you have seven days to do it, free of charge (regulation 18). You must also notify people before collecting their data (Data Protection Act, section 29).

Using data for commercial purposes without consent is an offence: up to KES 20,000, six months in prison, or both (regulation 15(4)). The Data Commissioner can also fine up to KES 5 million or 1% of turnover, whichever is lower (section 63). Complaints about marketing calls do reach the regulator. In one consolidated case reported by the law firm AB & David, the Office of the Data Protection Commissioner (ODPC) awarded three people KES 2.6 million in total against a digital lender. The lender had made unsolicited promotional calls and sent messages with no consent and no opt-out.

South Africa: POPIA and the dispute over cold calling

Cold calling is not illegal outright in South Africa, but POPIA makes it risky. Direct marketing by electronic communication, including automatic calling machines, needs the person's consent unless they are an existing customer (section 69(1) and (3)). You may approach a non-customer only once, to ask for consent, and only if they have not refused before (section 69(2)).

The argument is about what counts as electronic communication. The Information Regulator's Guidance Note on Direct Marketing, published on 3 December 2024, says ordinary phone calls do, because they now run as digital voice (paragraph 7.1.1). On that view, cold calling without consent is unlawful. The note itself says it is advisory and that POPIA prevails where they differ.

Law firms point out that live calls may fall outside POPIA's definition of electronic communication, and that telemarketers have long relied on the Consumer Protection Act's opt-out model instead (Werksmans, December 2024; DLA Piper, January 2025). We know of no court ruling on the point as of 24 October 2026. An AI voice agent is closer to an "automatic calling machine" than a human caller is, so whichever side wins the argument about live calls, the safer route for AI is consent before marketing.

If you ask for consent by phone, the Regulator sets out how. Form 4 is its standard form for requesting consent to direct marketing, and the Guidance Note says to read out its contents and record the call (paragraph 7.2.6). With an automatic calling machine, the recorded message must contain all of Form 4 and let the person answer "I give my consent" or "I do not give my consent". You must record the reply (paragraph 7.2.7).

South African calling hours and the National Opt-Out Registry

The opt-out model those law firms mention comes from the Consumer Protection Act 2008 (CPA), and it adds two things POPIA does not: fixed calling hours and, now, a national registry. South Africa is the only one of the three countries where we found calling hours. You may not direct-market to a consumer at home on Sundays or public holidays, on Saturdays before 09:00 or after 13:00, or on other days between 20:00 and 08:00 (CPA section 12 and the prohibited times set under it). Put the other way round, you may call from Monday to Friday between 08:00 and 20:00, and on Saturday between 09:00 and 13:00.

The notice makes an exception where the consumer has expressly or implicitly asked or agreed otherwise, but the exception is worded as part of the weekday rule. On our reading, it is unclear whether it also covers Sundays, public holidays and Saturdays, so take advice before relying on it there. If a consumer asks to be called at another time, store that request with their record, so you can show why the call was allowed.

These hours are easiest to keep as dialler settings rather than instructions to staff. On Sonex, for example, each outbound calling campaign carries its own calling window, time zone and retry limit, so a South African campaign can run on South African hours. The calling rules by country tool sets these hours next to other markets.

Offering an opt-out in the caller's language

All three countries let people stop direct marketing, so the opt-out line is the one part of the script every call needs. Say it early, in the language of the call, and act on it at once. Kenya's rules expect every marketing message to point out the opt-out and, for calls, suggest telling the person they can opt out verbally (regulation 17). The same habit also meets Nigeria's and South Africa's rules on objecting to marketing.

The lines below are short drafts for the opening or closing of a call, and none has yet been reviewed by a native speaker. Have one check each line before use. Train the agent to recognise a plain "stop" or "don't call me" in each language, not only the exact phrase, because people rarely repeat a script word for word. Our guide to testing a multilingual voice agent covers how to check that before launch, and the disclosure script library has more opening lines.

• English (all three countries): You can ask us to stop marketing calls at any time. Just say "stop calling me" and we won't call you again.
• Yoruba (Nigeria): O lè ní kí a dẹ́kun pípè ọ́ fún ìpolówó nígbàkígbà. Kàn sọ pé "ẹ má pè mí mọ́", a ò sì ní pè ọ́ mọ́.
• Hausa (Nigeria): Za ka iya cewa mu daina kiran ka don talla a kowane lokaci. Ka ce "kada ku sake kira na", ba za mu sake kiran ka ba.
• Swahili (Kenya): Unaweza kutuomba tuache kukupigia simu za matangazo wakati wowote. Sema tu "msinipigie tena", na hatutakupigia tena.
• isiZulu (South Africa): Ungasicela noma nini ukuthi siyeke ukukushayela ngokukhangisa. Vele uthi "ningaphinde ningishayele", ngeke siphinde sikushayele.
• Afrikaans (South Africa): Jy kan ons enige tyd vra om op te hou om jou vir bemarking te bel. Sê net "moenie my weer bel nie", en ons sal jou nie weer bel nie.

The three countries side by side

Read across the countries and the pattern is plain. Consent before the call and an opt-out that works at once are common ground in all three. Fixed calling hours are, on what we found, a South African feature, and each country handles do-not-call lists differently: Nigeria has a telecom short code, South Africa a new national registry, and Kenya no national register at all. The table pulls the rules together; where we could not confirm a rule from the official text, the cell says so.

Key dates