Reading time: 6 minutes

Advertising online for your business is a crucial part of your marketing plan, especially if you source most of your customers through online portals. With social media evolving the way it has, you may decide it is a good idea to take advantage of third-party advertising systems designed to attract target customers. However, if you are not clear about using your customer’s personal information for advertising, you run the risk of legal penalties. For some guidance, this article will go through some privacy law obligations when using personal information and how this relates to advertising for your business.

How Can I Use My Customers’ Personal Information?

When you collect personal information for your business, you must abide by New Zealand’s privacy law requirements when handling it. Personal information includes email addresses or other contact information. When using this personal information, you need to:

  • inform customers that you are collecting it;
  • tell customers why and how you are doing so;
  • use it for exclusively the reason you told customers at the time of collection;
  • only use accurate information;
  • only keep it for as long as necessary;
  • dispose of it when you no longer need it; and
  • only disclose it where you have a legitimate reason.

For example, if you collect tracking cookies from visitors to your website, you need to inform visitors that you are doing so. If you are doing this for your web analytics, you need to let your users know this as well.

The general rule is that you cannot tell a customer you are using their information for one reason and then use it for a different one. However, there a few exceptions to this rule. Some exceptions include when the: 

  • second purpose is directly related to the first one;
  • customer has given you their permission;
  • information is de-identified, and recognition is not likely;
  • source of information is on public record;
  • law requires it, such as for an audit or investigation; or
  • new purpose is to prevent a serious threat to health and safety.

Disclosing Personal Information

The starting position under the law is that you should not disclose or share customers’ personal information with third parties. However, you may do so under limited circumstances, which you need to provide evidence of. These circumstances are when:

  • you have the customers’ permission;
  • disclosure was a purpose for collecting the information;
  • sharing the information will not identify the person involved;
  • disclosure is necessary for complying with the law; or
  • you need to share the information to prevent a threat to someone’s health or safety.

You may share information with an overseas organisation. In this case, you need to ensure the organisation follows privacy rules similar to New Zealand’s own. If you do not have a customer’s permission for disclosure, it may be a privacy breach, and you could face legal consequences if it causes serious harm.

For example, disclosure may be one of your purposes for information collection. In your privacy policy, you should detail the third parties you will share the information with, such as vendors or consultants.

Personal Information and Targeted Advertising

Targeted advertising refers to when third parties like Google or Facebook place ads on your website (or you place your ads on another party’s site) that target a particular demographic or customer base. You share your customers’ personal information with this third party to choose which kinds of internet users you want to target.

For example, if you have a Facebook page for your business, you can upload an encrypted list of your customers’ email addresses to Facebook for advertising. They then send your ads to Facebook accounts associated with those email addresses, directing them to visit your page or site.

If you host other advertisers on your website, there may be a similar process. For instance, if you share certain information to determine what ads your customers see, such as website visitor behaviour. 

Many people are not aware of the algorithms that power this process and how much of their personal information it may require.

Getting Permission

Consequently, to meet your privacy obligations, you must be very clear with your customers that you collect their information for targeted advertising and be clear about who you are sharing it with. You cannot use the information you collected for a different purpose for this disclosure.

For example, say that you tell your customers that you use their email addresses for sending out business newsletters. You cannot then share their email addresses with a third party for targeted advertising because you did not tell them, and you do not have their permission.

When using any of your customers’ personal information in your advertising content, such as their photos or personal reviews with their names, you must let them know and get their permission.

Key Takeaways

If you want to use your customers’ personal information for advertising, you need to let them know and get their permission in most cases. This applies whether you are sharing their information with third-party advertisers or in your advertising content. If you would like more information or help with personal information in your advertising, contact LegalVision’s New Zealand privacy lawyers on 0800 447 119 or fill out the form on this page.

Frequently Asked Questions

What is personal information?

Personal information is information about an identifiable individual. This applies to any information that you can use to identify a living person. Examples include phone numbers, IP addresses, or location information.

What is targeted advertising?

Targeted advertising is a marketing method that targets ads to individuals based on their characteristics or behaviours. This process may use customers’ personal information to determine their targets.

Can I share my customers’ personal information with third parties?

The general rule is that you cannot disclose customers’ personal information. However, you can if the disclosure was your reason for collecting that information, or you have the customer’s permission.

Do I need to tell my customers if I use targeted ads?

If you collect a customer’s personal information for targeted advertising, you need to let them know. You should not be vague about it and specifically say that you are using it for this purpose.

About LegalVision: LegalVision is a commercial law firm that provides businesses with affordable and ongoing legal assistance through our industry-first membership.

By becoming a member, you'll have an experienced legal team ready to answer your questions, draft and review your contracts, and resolve your disputes. All the legal assistance your business needs, for a low monthly fee.

Learn more about our membership

Need Legal Help? Submit an Enquiry

If you would like to get in touch with our team and learn more about how our membership can help your business, fill out the form below.

Our Awards

  • 2019 Top 25 Startups - LinkedIn
  • 2020 Innovation Award 2020 Excellence in Technology & Innovation Finalist – Australasian Law Awards
  • 2020 Employer of Choice Award 2020 Employer of Choice Winner – Australasian Lawyer
  • 2020 Financial Times Award 2021 Fastest Growing Law Firm - Financial Times APAC 500
  • 2021 Law Firm of the Year Award 2021 Law Firm of the Year - Australasian Law Awards
  • 2022 Law Firm of the Year Winner 2022 Law Firm of the Year - Australasian Law Awards