September 22, 2026. South Korea is an opt-in market with no business-address exception. Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Network Act, requires express prior consent before you transmit advertising information for profit through an electronic transmission medium. The statute then lists the exceptions, and there are only two. Neither of them is the one most outbound teams rely on everywhere else, which is that the address was published on the company's own website.
The version read for this piece is the English translation of Act No. 20069, promulgated 23 January 2024, published by the Korea Legislation Research Institute, with the Enforcement Decree alongside it. The Korea Communications Commission and the Korea Internet and Security Agency enforce it, and the two bodies issued a revised compliance guide to the Act on 4 March 2026.
The two exceptions, in full
- A recent customer, same product, six months. Article 50 paragraph 1 subparagraph 1 permits sending where you directly collected the contact details from the addressee in your dealings of goods, and you are advertising the same kinds of goods you deal in. Article 61 paragraph 1 of the Enforcement Decree fixes the period at six months from the date the trade was concluded.
- A voice telemarketing call. Subparagraph 2 covers a telemarketer under the Act on Door-to-Door Sales who states the source of the personal information by voice on a telephone call. It is not an email route.
- There is no third. A published address, an industry directory, a LinkedIn profile or a job advert gives you nothing under Article 50. The B2B carve-out that makes Japanese cold email workable has no Korean equivalent.
Four duties that outlast the consent
Getting consent is the start of the obligation, not the end of it. Article 50 paragraph 4 requires the message to state the sender's name and contact details and the method by which the recipient can refuse or withdraw. Article 61 paragraph 3 of the Decree puts the detail in Appendix 6, which is where the advertisement label required in the subject line comes from. Article 50 paragraph 6 requires that refusing or withdrawing costs the recipient nothing.
Article 50 paragraph 7, amended on 23 January 2024, goes further than most regimes: when someone consents, refuses or withdraws, you must tell them the outcome of what you did about it. And Article 50 paragraph 8, read with Article 62-3 of the Decree, requires you to verify every two years from the date consent was given whether the recipient still consents. A Korean permission list silently expires on a rolling twenty four month clock unless you work it.
Where it turns criminal
Most Article 50 failures are administrative. Article 76 paragraph 1 sets an administrative fine of up to thirty million won for sending without valid consent under paragraphs 1 to 3, for omitting or falsifying the required statements under paragraph 4, for loading the cost of opting out onto the recipient under paragraph 6, and for failing to run the two year reverification under paragraph 8.
Paragraph 5 is the one that carries a criminal penalty. It prohibits five acts: evading or preventing opt-outs, automatically generating contact details from combinations of numbers, symbols or letters, automatically registering numbers or addresses for sending, concealing the identity of the sender or the source of the transmission, and deceiving an addressee into responding. Article 74 paragraph 1 subparagraph 4 punishes that with up to one year of imprisonment with labour or a fine up to ten million won. The list was last amended on 23 January 2024.
Email is exempt from the night rule
One detail worth knowing before you build a Korean cadence. Article 50 paragraph 3 requires separate express prior consent to send between 9pm and 8am, and the proviso exempts media set by Presidential Decree. Article 61 paragraph 2 of the Decree names that medium: electronic mail. So a scheduled email at 11pm Korean time does not need the extra night-time consent, while the SMS or KakaoTalk message in the same sequence does.
What it means for operators
Korea is the market where the usual agency answer fails. If your process is scrape a published address, send, and honour opt-outs, that process is lawful in Japan under its published-address exception and unlawful in Korea, from the first send, with a thirty million won administrative exposure attached. Article 50-3 closes the outsourcing gap as well: whoever entrusts the sending to a third party must control and oversee that third party, so the brand does not escape by hiring an agency, and the agency does not escape by pointing at the brand.
The workable Korean play is not cold email. It is consented email plus everything else: content that earns an inbound opt-in, events, partners, and paid. If you are keeping Korean contacts in the same database as the rest of Asia Pacific, segment them now, tag the consent date, and put the reverification on a calendar, because that field is the one that decides whether the list is still legal in twenty four months. The same sending and consent infrastructure that keeps your domains healthy is where that field belongs. For how Korea sits against the rest of the world, see our opt-in versus opt-out map and the companion piece on cold email laws in Japan, which is the same region and the opposite answer.
Frequently Asked Questions
Almost never. Article 50 of the Network Act requires express prior consent before sending advertising information for profit, and the only exceptions are a recent customer being sent offers on the same kinds of goods within six months, and a voice telemarketing call under the Door-to-Door Sales Act. A published business address gives you no permission to send.
Article 76 paragraph 1 allows an administrative fine of up to thirty million won for sending in breach of Article 50 paragraphs 1 to 3, for omitting the required sender and opt-out statements, for making the recipient bear the cost of opting out, or for failing to reverify consent. Breaching the five prohibited acts in Article 50 paragraph 5 is criminal, with up to one year of imprisonment or a fine up to ten million won.
Every two years. Article 50 paragraph 8 of the Network Act requires senders to verify whether the recipient still consents, and Article 62-3 of the Enforcement Decree sets the interval at every two years from the date consent was obtained.
Yes, for email. Article 50 paragraph 3 requires separate prior consent to send between 9pm and 8am, but the proviso exempts media set by Presidential Decree and Article 61 paragraph 2 of the Decree names electronic mail as that medium. SMS and other messaging in the same sequence still need the extra night-time consent.