Spam Control Act Singapore: the rules for cold email, SMS and WhatsApp

In this guide

• What the Act covers
• When outreach counts as bulk
• What every message must contain
• What the Do Not Call Registry adds
• Email, SMS and WhatsApp compared
• A sender's checklist and how Olano fits

What does the Spam Control Act cover?

The Spam Control Act 2007 covers commercial messages the recipient did not ask for, sent in bulk to an email address, a mobile number or an instant messaging account, where the message has a Singapore link:

• Commercial: its primary purpose is to offer or promote goods, services, land, a supplier, or a business or investment opportunity (section 3).
• Unsolicited: the recipient did not request or consent to it. A published address is not consent (section 5(2)), so an email address on a company website or LinkedIn profile does not make a cold email solicited.
• Electronic message: sent to an email address, a mobile number or, since 1 February 2021, an instant messaging account such as WhatsApp or Telegram (sections 2 and 4). Voice calls are excluded (section 4(3)).
• Singapore link: the message originates here, the sender is here or is a Singapore entity or has an office here, or the recipient is in Singapore when reading it (section 7).

Two duties follow. Nobody may send to addresses generated by a dictionary attack or collected by address-harvesting software (section 9; for phone numbers, section 48B of the PDPA). And anyone who sends, causes or authorises unsolicited commercial messages in bulk must meet the Act's Second Schedule (section 11). A business that knowingly lets someone promote its product is deemed to authorise those messages unless it takes reasonable steps to stop them (section 3(4) and (5)), so a lead-generation agency's client can be a sender too.

The Act sets no fines. Anyone who suffers loss or damage from a breach can sue the sender, or anyone knowingly concerned in it, for an injunction, damages or statutory damages of up to S$25 per message, capped at S$1 million unless a larger actual loss is proven (sections 12 to 14).

When does outreach count as sending in bulk?

Messages are sent in bulk when one sender sends, causes or authorises more than 100 with the same or similar subject matter in 24 hours, more than 1,000 in 30 days or more than 10,000 in a year (section 6). Crossing any one is enough.

Scroll the table sideways to see every column.

The Minister can vary these numbers by order in the Gazette (section 6(2)); these were in force on 1 November 2026. Below every threshold the Second Schedule does not apply, but the Do Not Call and PDPA consent rules still can.

AI personalisation does not reset the count

On our reading of section 6, which is not a ruling, the test is subject matter, not wording. An AI tool that writes a different opening for each prospect but pitches the same service sends messages with the same or similar subject matter, so every one counts. And because the sender includes whoever causes or authorises the sending, messages from several inboxes, tools or an agency working for you add up to one total: an AI agent sending on your behalf is sending as you.

What must every unsolicited commercial message contain?

Once you send in bulk, every unsolicited commercial message needs an unsubscribe facility that stays live for at least 30 days, and every email or text also needs an <ADV> label, a truthful subject and headers, and a working contact for the sender (Second Schedule, paragraphs 2 and 3).

Scroll the table sideways to see every column.

The instant messaging column rests on paragraph 3(3), which exempts instant messaging from the labelling rules, and section 4A, which treats a WhatsApp account named by a phone number as an instant messaging account, not that number; on our reading, the SMS rule on a textable number therefore does not apply on WhatsApp. On every channel, unsubscribe requests must not be disclosed without consent (paragraph 2(8)), and business days exclude weekends and public holidays (section 2).

What does the Do Not Call Registry add?

The Do Not Call provisions in Part 9 of the PDPA are a separate regime with no volume threshold: before sending a marketing message to a Singapore telephone number by voice call, text or fax, you need a check result no more than 21 days old showing the number is not registered, unless the person gave clear and unambiguous consent that you have on record (section 43).

• What counts: any message with a purpose of offering or promoting goods, services, land, or a business or investment opportunity (section 37). The PDPC's guide for organisations adds that a service message with any marketing element, such as a delivery update with a discount code, still counts.
• Which numbers: eight-digit numbers beginning with 3, 6, 8 or 9 (section 36), home, office and mobile alike.
• WhatsApp and Telegram: the PDPC's guide for individuals says the rules apply on both, and that such a message to a number on the No Text Message Register is a potential violation.
• AI voices: a voice call includes a recorded or synthetic voice (section 36), so AI sales calls are covered.
• Identify yourself: say who sent the message and how to reach them, in details valid for 30 days (section 44); calls must not hide the caller's number (section 45).
• Withdrawals: anyone can withdraw consent, and you must stop within 21 days of the notice (section 47 and regulation 17 of the Do Not Call Registry Regulations).

The Eighth Schedule excludes transactional messages, messages in an ongoing relationship whose sole purpose relates to it, market research, and messages sent to an organisation for its own purposes. The PDPC treats the last as a business-to-business exclusion for numbers such as an office line, lost if the message also markets something for the recipient's personal use; a one-off purchase is not an ongoing relationship.

Checks are made through an account on the DNC Registry portal, opened with a UEN and Corppass. On 1 November 2026 set-up cost S$32.70 including GST for a Singapore-registered organisation, each main account had 1,000 free check credits a year, and bulk checks returned within 24 hours (PDPC). For an intentional or negligent breach, the PDPC can impose a financial penalty of up to S$1 million on an organisation or S$200,000 on an individual (section 48J).

Which rules apply to cold email, SMS and WhatsApp?

Cold email is mainly a Spam Control Act question; SMS, WhatsApp and calls to Singapore numbers bring in the Do Not Call rules as well.

Scroll the table sideways to see every column.

The Do Not Call column assumes no recorded consent and no exclusion. The PDPA's data protection rules sit on top: business contact information, such as a name, title, business phone or email given other than solely for personal purposes, is outside them (section 4(5)), and the PDPC's Advisory Guidelines on Key Concepts (revised 29 April 2026) give a business card as the usual example. That exemption does not reach the Spam Control Act or the Do Not Call rules. Personal email addresses and mobile numbers are usually personal data, and PDPC guidance is that direct marketing generally needs express, opt-in consent; our guide to the PDPA and AI agents covers the rest.

A sender's checklist

Treat every outbound programme as bulk: the controls cost little, and with AI drafting the thresholds are easy to cross.

1. Keep one suppression list across every inbox, tool, agency and channel, and check it before each send.
2. Put an opt-out line in the signature or template, in English and easy to see: "To stop these emails, reply UNSUBSCRIBE." For SMS, give a number that accepts texts.
3. Honour opt-outs within a day, across every sequence, well inside the 10 business days the Act allows.
4. Keep the unsubscribe route alive for 30 days after each message: no no-reply addresses, and a monitored mailbox after a domain is retired.
5. Count across the campaign, from everyone sending for you, AI-personalised messages included.
6. Decide on <ADV> up front. If cold email or SMS could cross 100 similar messages a day or 1,000 in 30 days, label it.
7. Run DNC checks within 21 days before each SMS, WhatsApp or call campaign, unless you hold recorded, clear and unambiguous consent.
8. Ask list vendors how addresses were collected, and never use harvested or generated ones.
9. Write honest subject lines and headers, and name your business.
10. Keep records of consent, DNC results and opt-outs, and share opt-out details with no one.

How Olano fits

Olano is a Singapore AI studio that builds AI agents, and they start with outbound messages waiting for a person's approval: a WhatsApp agent begins with every outbound message held for approval, and the AI inbox assistant keeps every outbound email queued until someone clears it. Approval gates can be set per category, with trust levels 0 to 4, and every reply, tool call and approval is recorded on an audit trail.

The compliance decisions stay yours: DNC checks, consent records, opt-out wording and the suppression list. For a newsletter to an opted-in list, a dedicated email marketing platform with built-in unsubscribe handling is the better tool. A single-workflow pilot might cost S$300 to S$1,500 a month plus your review time, quoted as a fixed proposal after a 30-minute consultation; see our services and the WhatsApp AI agent page.