Advertising via Electronic Messages​

Key Takeaways

Hong Kong is hyper-connected. WhatsApp, email and SMS can feel like the cheapest way to reach customers. Yet local culture treats unsolicited commercial messages with deep suspicion. Many Hongkongers view unexpected texts, emails or calls as potential scams. Trust is fragile, attention is short, and one careless campaign can damage your brand faster than it builds it.

At Get Started HK we support more than 46,000 clients from Europe, the United States, India, Indonesia, Southeast Asia, Mainland China, Brazil, Argentina and elsewhere. Privacy expectations differ sharply across these cultures. What feels normal in one market can feel invasive or illegal here. This guide focuses on what founders actually need to do, and what to avoid, under Hong Kong’s Unsolicited Electronic Messages Ordinance (UEMO), while also covering related consumer-protection rules enforced by Customs and key differences with the EU’s GDPR.

Important note: This article shares practical observations from our experience helping founders set up and operate in Hong Kong. It is not legal advice. For specific situations, please consult a Hong Kong solicitor.

Hong Kong Culture and the Consent Rule

People here register numbers on Do-not-call lists, report spam, and often assume unknown commercial messages are fraud. In the AI era, when bulk tools and automated voices make mass messaging easy, authorities watch closely. Fully AI-generated pre-recorded messages without real human interaction still fall under UEMO (Cap 593).

The non-negotiable rule: Only message people who have clearly agreed to hear from you. Never assume that buying a list or scraping contacts gives permission. Different cultures have different starting points, European clients often expect GDPR-level consent, US clients may be more used to commercial lists, while many Asian markets vary widely, but Hong Kong applies its own clear standard.

What Counts as a Commercial Electronic Message?

Any electronic message (email, SMS, MMS, pre-recorded voice or video, certain messaging-app broadcasts) that promotes goods, services, facilities or business opportunities and has a Hong Kong link is covered. A Hong Kong link exists if the message is sent from Hong Kong, sent to a Hong Kong number, or accessed in Hong Kong.

What is Electronic Direct Mail Marketing (EDM)?

Electronic Direct Mail Marketing (EDM) is a multi-channel approach that goes beyond simple email blasts. It combines email with SMS, messaging apps and other channels to build longer-term relationships. The focus is on making customers feel recognised and valued rather than just pushing promotions. In practice this means collecting high-quality opt-in lists, segmenting audiences, and sending tailored, useful content that people actually want to receive.

The UEMO Checklist: What You Must Do

1. Include clear and accurate sender information in every message so recipients immediately know who is contacting them.
2. Provide a free, easy and obvious unsubscribe facility (for example “Reply STOP” or a clear link). Honour any request within 10 working days.
3. Check and respect the Do-not-call Registers. Do not send commercial electronic messages to listed numbers (from the 10th working day after registration) unless you have specific consent.
4. Never hide your calling-line identification when sending from phone or fax numbers.
5. Avoid misleading subject lines or headers, especially in email.
6. Do not use address-harvesting tools, harvested lists, or automated generation of addresses without consent.

These rules are technology-neutral. Whether you send the message yourself, use a platform, or let AI generate the content, the same obligations apply. OFCA’s enforcement statistics show hundreds of reports every year, with warning letters and enforcement notices regularly issued.

What Founders Should Do vs What to Avoid

Do this:

• Build your own opt-in lists through genuine value (lead magnets, useful content, events, existing customers).
• Segment and personalise only within the consent you have.
• Keep messages useful — practical updates, genuine offers or newsletters that deliver real value convert better and attract fewer complaints.
• Scrub lists against Do-not-call Registers and your own suppression list before every send.
• Record a legitimate +852 Hong Kong phone number on your company incorporation documents (Form NNC1). It strengthens identification when messaging and creates an official government record that makes impersonation harder. Learn more here: Hong Kong Phone Number.

Avoid this:

• Buying raw personal data lists. Bought lists frequently lack proper consent, may contain harvested addresses, and create liability for both buyer and seller.
• Aggressive or high-pressure sales tactics in any channel. Customs actively enforces against harassment, coercion or undue influence that impairs a consumer’s freedom of choice (recent cases include beauty and skincare retailers).
• Bait advertising or bait-and-switch (advertising something you cannot reasonably supply, then pushing a different product).
• Accepting payment when you know (or have no reasonable grounds to believe) you can deliver the goods or services within a reasonable time. Recent Customs actions have targeted fitness centres, child-development programmes and similar prepaid services.
• False or misleading trade descriptions of goods or services. Maximum penalty under the Trade Descriptions Ordinance is a fine of HK$500,000 and five years’ imprisonment. Customs investigates both physical and online traders and has a 24-hour hotline (182 8080).

These “what not to do” points draw from the Trade Descriptions Ordinance (enforced primarily by Customs) and practical guidance reflected in consumer-rights resources. Goods must also meet basic standards of merchantable quality and fitness for purpose under the Sale of Goods Ordinance (Cap. 26), marketing claims that create false expectations increase dispute risk.

GDPR vs Hong Kong’s PDPO: What Global Founders Need to Know

Many of our clients already operate under European rules. Here is a clear side-by-side view of the practical differences:

What you want to do	Under European Law (GDPR)	Under Hong Kong Law (PDPO)
Collect & use customer data	You must tick a strict legal box (like getting explicit consent or proving you have a vital business reason) before you can touch anyone’s data.	Much more relaxed for general use. You can collect and use data as long as you’re transparent about why you’re taking it.
Store or send data overseas	Very strict opt-in. You cannot trick people into checking a pre-ticked box.	Also strict for direct marketing. You must clearly tell them what you’re doing, and if you sell or pass their data to someone else for money without proper consent, you can face criminal jail time (up to 5 years).
Store or send data overseas	A massive headache. You generally cannot send EU citizen data outside Europe unless you use heavy legal contracts or approved country setups.	More business-friendly. Hong Kong does not block founders from routing data to global cloud architectures, regional servers, or tech stacks overseas, provided standard security safeguards are maintained.
If customer data gets hacked / leaked	Triggers mandatory, high-stress emergency reporting to European authorities within 72 hours under threat of staggering financial turnover penalties.	Basic notification to the PCPD is technically handled voluntarily rather than via strict automatic triggers, navigating a breach safely largely depends on the reputation and infrastructure of your service provider.
If a customer says “delete me”	Subject to absolute enforcement of the “right to be forgotten,” requiring comprehensive data erasure across complex technical databases.	They mostly only have the right to ask what data you have on them and to fix mistakes. They don’t have a blanket right to demand total data deletion.

If you serve both European and Hong Kong customers, treat the stricter rule as your baseline for each audience. Note that PDPO Section 33 (cross-border transfer restrictions) is still not in force as of 2026, which is why Hong Kong remains more flexible on data routing than the EU.

Benefits When You Get It Right

Clean, consented messaging delivers higher open and response rates, stronger long-term relationships, lower complaint risk, and better cost-effectiveness than traditional advertising. Useful newsletters and personalised offers (within consent) keep customers sticky. Respect for local culture and clear compliance also protect your reputation in Hong Kong’s tight business networks.

Electronic messaging remains powerful for Hong Kong businesses. The difference between success and problems is simple: treat consent as the foundation, follow the UEMO checklist every time, avoid the unfair practices Customs actively polices, and never treat Hong Kong recipients the same way you might treat audiences in markets with looser norms.

Build lists properly, send only what people have agreed to receive, and use tools (including AI) responsibly. That approach protects your company and earns the trust that turns contacts into customers.

Frequently Asked Questions about collection of personal data

Sources for the above guidance include the Unsolicited Electronic Messages Ordinance (Cap. 593), OFCA public materials, PCPD guidance on direct marketing, and recent Customs enforcement actions under the Trade Descriptions Ordinance.