Online Advertising Legal Risks, Contracts & Compliance in New Zealand

Online ads can bring in customers fast, but they can also create expensive legal problems just as quickly. New Zealand businesses often get caught by three avoidable mistakes: accepting an ad platform or agency contract without checking the fine print, publishing claims they cannot properly back up, and collecting customer data through ads or landing pages without meeting privacy rules. Another common issue is assuming that if a campaign is outsourced, the legal risk sits with the agency. It often does not.

If you are paying for search ads, social media campaigns, influencer content, retargeting, affiliate marketing or display advertising, this guide answers the practical questions that matter before you sign. It covers the main legal risks, the contract terms that deserve a close look, and how New Zealand consumer and privacy rules affect your advertising.

The goal is simple: help you spend your marketing budget with clearer protections and fewer surprises.

Overview

Online advertising compliance is mainly about two things: what you say to customers, and what you agree to with the people or platforms helping you say it. In New Zealand, misleading advertising, unclear fees, weak data protections and vague performance promises are the issues that most often create trouble for startups and SMEs.

• Check whether your ads make claims that can be proven, especially around pricing, results, comparisons and testimonials.
• Review platform, media buying and agency contracts for minimum spend, auto-renewal, liability caps, ownership of ad accounts and termination rights.
• Confirm who is responsible for privacy compliance if customer data is collected, matched, uploaded or shared for targeting.
• Make sure influencer, affiliate and sponsored content arrangements clearly deal with disclosure and approval rights.
• Do not rely on verbal promises about leads, return on ad spend, exclusivity or campaign results.
• Keep records of approvals, claim substantiation, budgets, variations and reporting before disputes arise.

What Online Advertising Risks Contracts & Compliance Means For New Zealand Businesses

For most New Zealand businesses, the real issue is not whether online advertising is allowed. The real issue is whether your ads and your contracts set the right expectations, allocate risk properly and comply with the rules that apply to marketing, data use and customer representations.

Online advertising covers more than paid social posts or Google-style search ads. It can include sponsored content, remarketing, influencer campaigns, affiliate arrangements, marketplace promotions, programmatic display ads, email acquisition campaigns and lead generation funnels. Each of these can create legal obligations even if the ad spend is small.

Your marketing claims still need to be accurate

The Fair Trading Act 1986 is central here. If your advertising is misleading or deceptive, or likely to mislead, your business can face complaints, regulator attention and disputes with customers or competitors. The risk is not limited to outright false statements. An ad can be misleading because of what it leaves out, how pricing is framed, how urgency is presented or how disclaimers are buried.

Founders often run into problems with claims such as:

• "Lowest price" or "best in New Zealand" without a proper basis.
• Performance claims, such as time savings, growth projections or product outcomes, without evidence.
• "Free" offers where charges, subscriptions or delivery fees still apply.
• Before and after claims that depend on unusual results.
• Limited-time sale messaging that is repeated so often it is not really limited.
• Testimonials or reviews that are edited, cherry-picked or not genuine.

If you are using comparative advertising, health-style claims, finance-related messaging or claims aimed at vulnerable consumers, extra care is needed. The legal test is about the overall impression created for the audience, not just whether each line can be technically defended.

Privacy issues often sit behind ad campaigns

The Privacy Act 2020 can affect your advertising where personal information is collected, matched, uploaded or reused. This commonly happens when businesses use tracking tools, customer match audiences, lead forms, remarketing lists or campaign analytics tied to identifiable individuals.

Before you accept the provider's standard terms, be clear on questions such as:

• What personal information is being collected through the ad, landing page or form?
• Who is collecting it, your business, the platform, the agency or all of them?
• What privacy notice is shown to the customer at the point of collection?
• Will data be transferred or stored offshore?
• Can the provider use your campaign data for its own purposes?
• What happens to customer data when the campaign ends?

Privacy compliance is not just a website issue. If a lead ad collects names, phone numbers and email addresses, or a customer list is uploaded to create a lookalike audience, your advertising activity is touching personal information. That needs a clear internal process, not assumptions.

Contract risk is usually hidden in standard terms

Many online advertising relationships begin with standard platform terms, short proposal documents or email confirmations. The legal risk often sits in what those documents do not explain well. Before you sign a contract, look closely at who controls the ad account, what fees can change, whether spend is refundable, and who carries the risk if an ad is disapproved or a campaign underperforms.

This matters whether you are working with:

• A digital marketing agency.
• A freelancer or consultant.
• An influencer manager.
• An affiliate network.
• A media buying platform.
• A lead generation provider.

If your customer acquisition depends heavily on one campaign or provider, these terms can directly affect cash flow and business continuity.

Outsourcing does not remove your legal exposure

If an agency writes the copy or an influencer posts the content, your business can still face the commercial fallout if the message is misleading or the arrangement is poorly documented. This is where founders often get caught. They assume the specialist takes all the legal risk because the specialist created the ad.

In practice, responsibility is often shared or disputed. Your contract should say who drafts content, who approves it, who checks legal compliance, and who is responsible if a complaint or takedown request arrives.

Legal Issues To Check Before You Sign

The best time to manage advertising risk is before you spend money on setup, before content goes live and before you rely on a verbal promise about results. A short contract review of the agreement and campaign structure can prevent months of argument later.

Scope of services and deliverables

Your agreement should clearly state what the provider is actually doing. Vague promises like "manage digital growth" or "optimise campaign performance" are not enough if you later need to prove what was included.

The contract should spell out:

• Which channels are covered, such as search, social, display, influencer or email acquisition.
• What content will be created, approved and published.
• Whether ad copy, graphics, landing pages and reporting are included.
• How often campaigns will be reviewed or adjusted.
• What the reporting format and frequency will be.
• Any exclusions, assumptions or client responsibilities.

If success depends on you providing product information, approvals or customer lists, that should also be written down.

Performance promises and disclaimers

Be very careful with guarantees about leads, sales, rankings or return on ad spend. Some providers use optimistic projections in pitches that never make it into the contract. If a statement matters to your decision, do not leave it as a sales conversation.

Before you sign, ask:

• Is any result guaranteed, or is the provider only committing to use reasonable skill and care?
• How are key performance indicators measured?
• What attribution model is used for conversions?
• Can the provider change strategy without approval if results are poor?
• What happens if benchmarks are missed?

There is nothing wrong with an agreement that does not promise outcomes, but it should be honest about that. Problems arise where marketing language sounds like a commitment while the legal terms deny responsibility for performance.

Fees, spend and payment mechanics

Online advertising contracts often mix service fees with third-party ad spend. Those amounts need to be separated clearly. Otherwise, it becomes hard to know what is refundable, what is earned, and what can be paused.

Key fee points include:

• Whether media spend is prepaid or billed in arrears.
• Whether the provider earns a percentage of ad spend, a fixed monthly fee or both.
• Who is liable if the platform charges more than expected.
• Whether minimum monthly commitments apply.
• How fee increases or budget variations are approved.
• Whether platform credits, rebates or commissions are retained by the provider.

Before you accept the provider's standard terms, make sure there is a practical process for budget approvals and emergency pauses. This matters if campaign spend escalates quickly.

Ownership of accounts, content and data

You should know exactly who owns the advertising assets you are paying for. If an agency sets up campaigns under its own manager account and the relationship ends badly, access can become the dispute.

Your contract should deal with ownership and control of:

• Ad accounts and business manager access.
• Creative assets, copy, video and landing pages.
• Pixel data, audience data and campaign analytics.
• Customer lists and leads generated through campaigns.
• Login credentials and administrator rights.

Many businesses assume they own everything because they paid for it. The contract may say otherwise. This is especially important where software tools, templates or licensed content are involved.

Privacy, data use and offshore providers

If campaign activity involves personal information, your agreement should reflect that. A provider may need to handle customer data only under your instructions, keep it secure and notify you if something goes wrong.

Depending on the arrangement, useful clauses may cover:

• Permitted uses of personal information.
• Security standards and access controls.
• Subcontracting and offshore processing.
• Deletion or return of data at the end of the engagement.
• Responsibility for privacy notices and customer disclosures.
• Incident reporting if a privacy issue occurs.

If data is going overseas, check whether your business has considered the data protection implications properly. The contract should match the reality of the campaign.

Compliance approval and liability

Someone needs final sign-off on advertising content. If that process is unclear, each side may later say the other was responsible.

A well-drafted agreement should address:

• Who provides product claims and substantiation.
• Who reviews ads for legal and brand approval.
• Who responds to platform policy breaches or takedown notices.
• Who handles complaints from customers, competitors or regulators.
• Whether liability is capped, and if so, how.
• Any indemnities for misleading claims, IP infringement or privacy breaches.

Liability caps are common, but they should be read carefully. A low cap may leave you carrying most of the downside if a campaign causes serious commercial loss.

Term, renewal and exit rights

The right to exit is often as important as the right to start. Some advertising contracts lock businesses into notice periods, fixed spend levels or auto-renewals that are easy to miss.

Before you sign, check:

• How long the initial term runs.
• Whether the contract renews automatically.
• What notice is required to terminate.
• Whether there are early termination fees.
• What transition assistance is provided on exit.
• How quickly accounts, data and assets must be handed over.

If your campaigns are business-critical, exit support can make a major difference. You do not want to lose account access in the middle of a trading period.

Common Mistakes With Online Advertising Risks Contracts & Compliance

The most common mistakes are not exotic legal failures. They are ordinary business shortcuts that create avoidable exposure once money has been spent and expectations are already set.

Relying on verbal promises

A founder hears that the agency will deliver a certain number of leads, reduce acquisition cost or give exclusive access to a market segment. None of that appears in the final agreement. When results disappoint, there is no clear contractual promise to enforce.

If a promise affects price, term or your decision to engage, it belongs in writing.

Assuming the platform terms are non-negotiable and low risk

Even where platform terms are not heavily negotiable, they still need to be understood. Automatic suspension rights, broad rights to change policies, limited support obligations and strong liability exclusions can all affect your campaign.

The point is not always to negotiate every clause. The point is to know the risk before you build your customer acquisition around that platform.

Using aggressive claims without evidence

Businesses often get excited about headlines and hooks. That is understandable, but legal trouble starts where the copy outruns the proof. If you claim a product is superior, safer, faster, cheaper or proven, you should have a reasonable basis for saying so when the ad goes live.

Disclaimers do not always fix a misleading headline. The overall impression still matters.

Forgetting disclosure in influencer and affiliate arrangements

Sponsored content should not look like an independent recommendation if there is a commercial relationship behind it. If gifts, commissions, fees or free products are involved, the arrangement needs transparent disclosure and a written contract that sets expectations.

This is particularly important where affiliates create their own copy. Your business may still be associated with statements you did not draft.

Not controlling the ad account

If only the agency has administrator access, changing providers can become messy. The same issue comes up with analytics tools, tag managers, pixels and audience data. Account control is a practical legal issue because it affects ownership, continuity and evidence if a dispute starts.

Before you rely on a provider for a major campaign, make sure your business has the right access level.

Collecting leads without matching privacy documentation

A business runs a lead form ad and receives personal information directly through the platform. The campaign works, but the privacy wording is outdated or silent on how the information will be used. That gap becomes more serious if the data is uploaded elsewhere, shared with a salesperson or used for remarketing.

Your privacy position should reflect what the campaign is actually doing, not what your website used to say last year.

Treating approvals casually

Fast-moving campaigns often get approved in chat messages or phone calls. Later, nobody remembers who signed off a price claim, image, target audience or promotional deadline. A simple written approval workflow helps create accountability and reduces blame-shifting.

This matters even more when multiple people are involved, such as founders, marketing staff, agencies and designers.

FAQs

Is my business responsible if an agency creates a misleading ad?

Often, yes. An agency may share responsibility, but your business can still face complaints and commercial fallout if the ad promotes your goods or services. Your contract should clearly allocate approval, compliance and liability responsibilities.

Do I need a written contract for online advertising services?

Yes, in most cases. A written contract helps define scope, fees, ownership, privacy responsibilities and exit rights. Email threads and verbal promises rarely cover enough detail when a dispute arises.

Can I use customer lists for retargeting or matched audiences?

Possibly, but you need to consider privacy obligations carefully. The key questions are whether the information was collected lawfully, whether people were told how it would be used, and whether the provider handling the data is covered by suitable terms.

Who owns the ad account and campaign data?

That depends on the contract and how the account was set up. Do not assume ownership just because you paid the invoices. The agreement should state who controls accounts, data, creative assets and access credentials.

What should I do before signing an advertising agency agreement?

Check the scope, fees, performance wording, data handling, approval process, ownership clauses, liability caps, renewal terms and exit process. If the campaign is important to revenue, get the contract reviewed before you sign.

Key Takeaways

• Online advertising legal risk in New Zealand usually comes down to misleading claims, weak contract terms and poor handling of customer data.
• The Fair Trading Act can affect pricing claims, testimonials, urgency messaging, comparative claims and overall ad impressions.
• The Privacy Act can apply where ad campaigns collect, upload, match or share personal information.
• Before you sign a contract, confirm scope, fees, account ownership, performance wording, approvals, liability and exit rights.
• Do not rely on verbal promises about leads, exclusivity or campaign outcomes.
• Influencer, affiliate and agency arrangements should clearly address disclosure, approvals and responsibility for compliance.
• Keep written records of substantiation, campaign approvals, budget changes and data handling processes.

If you want help with advertising contracts, claim review, privacy obligations, and agency terms, you can reach us on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.