Chapter 3. Customer Data and Commercial Message Transmission

Learning objectives

• Explain what advertising information for profit-making purposes is, and understand that messages personalized with AI follow the same rules.
• Determine whether transmission is permitted by applying the Prior consent principle, transactional relationship exceptions, rejection of reception, nighttime transmission, mandatory disclosures, prohibited acts, and periodic verifications under Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection (Information and Communications Network Act).
• Explain the remaining liabilities of the consignor when transmission is entrusted to an agency or AI automation.
• Define the scope of data to be used for AI personalization in accordance with the purpose limitation, minimum processing, Consent to processing for promotional purposes, child consent, and entrustment provisions of the Personal Information Protection Act (PIPA).
• Distinguish between what can and cannot be done with pseudonymous information and anonymous information.

Introduction

A CRM manager at a meal-kit online store generated customized discount text messages for 30,000 members using generative AI. The copy was excellent, and the tone, which seemed to remember each member's recent orders, looked poised to boost response rates. However, right before pressing the send button, the legal affairs manager asked four questions: Did these members consent to receiving advertisements? What time will they be sent? Were members who opted out excluded? Where was member data entered when generating the copy?

AI personalization changes the content of a message, but it does not change the fact that the message is an advertisement. Even if written in different sentences for each customer, if it encourages discount sales, it constitutes advertising information for profit-making purposes, and the consent, time, and disclosure rules under Article 50 of the Information and Communications Network Act apply as they are. And the moment customer data is entered into an AI tool to generate those sentences, questions under the Personal Information Protection Act (PIPA) begin separately: May that data be used for this purpose? In what environment is it processed? Were only the strictly necessary items included?

This chapter covers both acts in turn. The first part outlines "to whom, when, and through what medium can messages be sent" under the Information and Communications Network Act; the second part outlines "what data under what conditions can be entered into AI" under the Personal Information Protection Act (PIPA); and finally, both questions are consolidated into a single decision table and procedure.

Key concepts

Advertising Information for Profit-Making Purposes and Electronic Transmission Media

Article 50 of the Information and Communications Network Act applies to anyone who transmits advertising information for profit-making purposes using an electronic transmission medium. Representative examples include text messages, app pushes, messenger notifications, and email. Allowing app notifications on a smartphone is merely a device setting, not Consent to receive advertising information under the Information and Communications Network Act. If the content encourages the sale of goods—such as discounts, new products, or repurchase recommendations—it is advertising information.

Remember three things:

1. Personalization does not change the nature. Even if AI wrote differently for each customer, if it encourages sales, it is advertising information.
2. If mixed, it is an advertisement. If discount coupon text is appended to transactional information such as shipping updates or reservation confirmations, that message becomes a message containing advertising information.
3. The title does not determine the nature. Even if it is titled 'Member-Exclusive Benefits Guide', if the content is a sales solicitation, it is advertising information.

Principle: Explicit Prior Consent

Article 50, Paragraph 1 requires obtaining the recipient's Explicit Prior consent to send advertising information. Because it is 'Explicit,' the recipient must clearly indicate their intention to consent, and an approach that deems consent has been given simply because they did not refuse (opt-out) does not constitute consent. In practice, it is collected via an approach where the recipient expresses their intention to consent first (opt-in). Because it is 'Prior,' an approach of inquiring about rejection after sending the first advertisement is also not permitted.

The scope of consent is also important. If a user only consented to 'Receive service notifications' during sign-up, that is not consent to receive advertising. Consenting to 'Receive winning notice' in a promotional giveaway event is the same. Consent can only be used within the scope of what the person consented to.

Three Conditions for the Transactional Relationship Exception

Article 50, Paragraph 1, Subparagraph 1 provides an exception allowing transmission without Prior consent. All three conditions must be satisfied.

The exception only exempts 'Prior consent.' The provisions on rejection of reception, nighttime transmission, mandatory disclosures, and prohibited acts below apply as they are.

Rejection of Reception and Withdrawn Consent

Article 50, Paragraph 2 prohibits sending advertising information if the recipient indicates their intention to refuse reception or has Withdrawn Prior consent. This applies equally to customers who were sent messages under the transactional relationship exception and customers who consented in the past.

The cessation of transmission takes effect from the moment the intention is received. The 14-day period below is the deadline for notifying the processing result, not a grace period during which transmissions may continue. The procedures prescribed by the Act and the Enforcement Decree regarding rejection of reception are as follows:

• Necessary measures must be taken so that the recipient does not bear any costs, such as telephone charges, incurred when refusing reception or when consent is Withdrawn (Paragraph 6; Article 62 of the Enforcement Decree requires specifying and providing toll-free telephone services, etc., pursuant to Attached Table 6).
• When a recipient expresses their intention of consent, refusal, or Withdrawn consent, the sender's name, the fact and date of the recipient's expression of intention, and the processing result must be notified within 14 days from that date (Paragraph 7; Article 62-2 of the Enforcement Decree).

The expression of intention does not depend on the channel. If a customer entered "Stop sending ads" into an AI consultation chatbot, that is also an expression of intention to refuse reception. Any delay in reflecting this in internal systems is the company's problem, not the customer's.

Nighttime Transmission and Email Exception

Article 50, Paragraph 3 requires obtaining Prior consent separately from the consent under Paragraph 1 in order to transmit advertising information from 9:00 PM to 8:00 AM the following day. The proviso provides an exception for media prescribed by Presidential Decree, and Article 61, Paragraph 2 of the Enforcement Decree specifies that medium as email.

Because the nighttime provision begins with "Notwithstanding Paragraph 1," separate consent is required to send nighttime text messages even to customers to whom messages can be sent without consent under the transactional relationship exception.

Mandatory Disclosures and Prohibited Acts

Article 50, Paragraph 4 requires specifically disclosing the following matters in advertising information:

1. Name and contact information of the sender
2. Matters concerning measures and methods to easily indicate the intention to refuse reception or have consent to reception Withdrawn

Specific disclosure particulars and methods are prescribed in Attached Table 6 pursuant to Article 61, Paragraph 3 of the Enforcement Decree.

On exams, you should watch out for answer choices that omit the two statutory requirements directly mandated by law, such as "Displaying only the '(Ad)' label relieves all other disclosure obligations."

Prohibited acts. Article 50, Paragraph 5 prohibits persons sending advertising information from engaging in the following acts. This is also a checklist of items that must be prevented at the design stage when automating transmission with AI agents:

1. Acts of evading or obstructing rejection of reception or consent to reception being Withdrawn (designs that create multi-step rejection procedures or require login)
2. Acts of automatically generating contact information, such as telephone numbers or email addresses, by combining numbers, symbols, or characters
3. Acts of automatically registering telephone numbers or email addresses for the purpose of transmitting advertising information
4. Various acts to conceal the identity of the sender or the origin of the advertising transmission
5. Various acts to induce replies by deceiving recipients for the purpose of transmitting advertising information

Periodic Confirmation of Consent to Reception Every Two Years

Article 50, Paragraph 8 requires a person who has obtained consent to reception to regularly confirm whether consent to reception is maintained, and Article 62-3 of the Enforcement Decree sets the period at every two years from the date consent was obtained (prior to the same calendar day as the consent date in the year marking every two years). When confirming, the sender's name, the fact and date of the recipient's consent, and methods to maintain or have consent Withdrawn must be disclosed.

What the law stipulates is a confirmation procedure. Do not read it as "consent automatically lapses after two years"; instead, incorporate a feature into the CRM that manages the confirmation schedule based on the consent date.

Entrusting Transmission

Article 50-3 sets forth the rules when entrusting the transmission of advertising information to another person.

• In order to entrust the transmission of advertising information using services under Article 2, Subparagraph 14 (b) of the Telecommunications Business Act, it must be entrusted to a person who has obtained transmission qualification certification pursuant to Article 22-11, Paragraph 1 of the same Act (Paragraph 1, newly inserted on March 31, 2026).
• The consignor must manage and supervise the consignee so that the consignee does not violate Article 50 (Paragraph 2).
• In terms of liability for damages arising from the consignee's violation of the Act in connection with such affairs, the consignee is deemed an employee of the consignor (Paragraph 3).

Even if stated in the contract that "the agency bears liability for violations of law," this statutory structure does not change. Entrustment contracts must include verification of nighttime consent, update cycles for opt-outs, mandatory disclosure items, and the provision of transmission records, which must be inspected in practice.

Basic Principles of the Personal Information Protection Act

We now turn to the data used to generate messages. Article 3 of the Personal Information Protection Act (PIPA) requires clarifying the purpose of processing, processing only the minimum necessary personal information within the scope required for that purpose, and not using it for purposes beyond that scope. Article 3, Paragraph 7 specifies that if the purpose can be achieved by processing anonymously or pseudonymously, it should be processed anonymously, and if it cannot be achieved anonymously, it should be processed pseudonymously.

The legal bases for collection and use are set forth in Article 15 (consent, contract performance, legitimate interests, etc.), and Article 18 prohibits use beyond the scope of purposes determined at the time of collection, while providing exceptions such as separate consent. Translated into practical questions: "What was this data originally collected to do, and what did the customer consent to?" If a customer center intends to use consultation records collected for the purpose of 'Inquiry handling' to select advertising targets, there must be a separate legal basis for use beyond the original purpose.

Consent for Promotional Purposes, Right to Refuse, and Children

Article 22, Paragraph 1 requires that when obtaining consent, each consent item must be distinguished, and specifically in Subparagraph 7, consent to the processing of personal information for the purpose of promoting goods or services or soliciting sales must be obtained separately. Furthermore, Paragraph 5 prohibits refusing to provide goods or services on the grounds that the data subject did not give this consent. Any design that conditions feature utilization on marketing consent conflicts with this provision.

Article 22-2 requires obtaining the consent of a legal representative and verifying whether the legal representative has consented in order to process the personal information of a child under 14 years of age based on consent under this Act. Marketing consent checked by a child on their own does not satisfy this requirement.

Conditions for Entering Customer Data into AI Tools

Entering customer data into an AI service to generate company copy generally constitutes entrustment, where the company delegates its personal information processing affairs to an external vendor. However, if the vendor also uses the received data for its own purposes (e.g., training its proprietary models), it may constitute third-party provision (Article 17) rather than entrustment; and if the vendor's servers are located abroad, resulting in the cross-border processing entrustment or storage of data, the cross-border transfer requirements (Article 28-8: separate consent, or disclosure in the privacy policy / individual notification as processing entrustment and storage necessary for contract performance, etc.) must also be confirmed. When it falls under entrustment, the requirements of Article 26 are as follows:

1. Entrustment must be conducted via a document specifying the prohibition of processing beyond the purpose of the entrusted affairs, technical and managerial safeguards, and other matters prescribed by Presidential Decree (purpose and scope, restrictions on re-entrustment, access restrictions, inspections of management status, damages, etc.) (Paragraph 1; Article 28, Paragraph 1 of the Enforcement Decree).
2. The details of the entrusted affairs and the consignee must be disclosed so that data subjects can easily check them at any time. The Enforcement Decree establishes continuous posting on the consignor's internet website as the general rule (Paragraph 2; Article 28, Paragraph 2 of the Enforcement Decree).
3. If promotional or sales solicitation affairs are entrusted, the details of the entrusted affairs and the consignee must be notified to the data subject (Paragraph 3). Methods include written notice, etc. (Article 28, Paragraph 4 of the Enforcement Decree).
4. The consignee must be supervised through training, inspections of processing status, etc. (Paragraph 4).
5. If the consignee wishes to re-entrust, it must obtain the consent of the consignor (Paragraph 6).

Two practical principles are added here. First, do not enter customer data into personal accounts or free services that have no enterprise contract with the company, because there is no contractual document, no supervision, and no control over whether data is used for model training. Second, even in a contracted environment, include only necessary items. Writing Recommendation copy does not require payment methods or addresses, and contact information can be combined later in the transmission system.

Pseudonymous Information and Anonymous Information

Applied to marketing practice, it is as follows: Statistics such as purchasing trends by age group and region can be produced using pseudonymous information or anonymous aggregations. However, re-matching pseudonymous information with original member information to send coupons to specific members cannot be done under the pseudonymous information framework. Individualized messages must be conducted using personal information supported by legal grounds such as consent.

Transmission Feasibility Decision Table

Evaluate each transmission plan in the following order:

Defining the Scope of Data for AI Personalization

Define the data to be used for personalization through the following procedure:

1. Determine what the output of personalization is: individual copy or group strategy.
2. If group-level results are sufficient, process using anonymous aggregations or pseudonymous information.
3. If individualized results are required, verify the purpose of data collection and the scope of consent: Is there Consent to processing for promotional purposes? For children under 14 years of age, is there legal representative consent?
4. Select only the items strictly necessary for generating copy. Combine identifying information only at the transmission stage.
5. Process within an AI environment equipped with entrustment contracts, disclosure and notification, and supervisory procedures.
6. Establish retention and destruction schedules for outputs and input data.

Going deeper

Things personalization does not change

AI personalization makes messages look as though they are tailored to a single person. Because of this feeling, there is a misconception practitioners often have: "This is not a mass advertisement, but personal guidance, so it is fine." The law looks at the purpose of the message, not its format. If it encourages discount sales, whether sent to one person or a million people, it is commercial advertising information.

Personalization actually creates new risks. Copy that remembers a product a customer bought just once a long time ago can trigger anxiety: "Just how far is this company using my information?" Furthermore, reflecting dissatisfaction read from consultation records in advertising copy constitutes use beyond the intended purpose. The depth of personalization must stay within the scope consented to and expected by the customer.

When AI agents automate transmissions

When AI agents automatically handle everything from writing copy to selecting targets, transmitting, and processing opt-outs, human mistakes decrease, but design mistakes are repeated on a massive scale. In practice, there are four points where incidents frequently occur:

1. Synchronization delay: The problem where opt-out intentions coming from chatbots, customer service centers, or app settings are reflected late in transmission lists. Establish a step to cross-check the latest status again immediately before transmission.
2. Time zone calculation: The problem where scheduled transmissions are delayed and pass 9:00 PM. Ensure the transmission engine knows the night-time rules for each medium and stops the moment they are exceeded.
3. Channel expansion: The problem of expanding the same campaign from email to app push while applying night-time exceptions as they are. Separate rules by medium.
4. Temptation of Optimization: "Optimization" that makes opt-out procedures complicated to lower the opt-out rate. This is avoidance or interference prohibited by law.

What can and cannot be done with pseudonymous information

Pseudonymous information broadens avenues for data utilization, but in marketing, its boundaries are clear. The statistical compilation referred to in Article 28-2 involves creating aggregated results that do not identify a Specific individual, leaving room to utilize it for analyzing purchase trends or tallying campaign effectiveness. For specific scopes and procedures, check the Personal Information Protection Commission's guidance on processing pseudonymous information. However, the moment the output is directed toward a "Specific individual"—that is, the moment it becomes an individualized target list or a personalized message—it falls outside the scope of the pseudonymous information system. Pseudonymization is not a means to bypass consent, but a Safe mechanism used for tasks where there is no need to identify individuals.

At work

Sea Village Seafood: Holiday gift CRM campaign

Seafood online shopping mall 'Sea Village Seafood' intended to create gift Recommendation messages for each customer using generative AI ahead of the Lunar New Year gift season. The target consisted of three groups: ① 20,000 members who had consented to receiving advertisements, ② 6,000 customers who had purchased a gift set during the previous Chuseok (four months earlier) but had not consented to advertisements, and ③ 10,000 customers who had been inactive since their last purchase a year and a half earlier. The marketing team suggested sending them by text message at 9:30 PM, when response rates were favorable.

The person in charge applied the decision matrix to each group. Group ① had advertising consent, but sending text messages at 9:30 PM required separate night-time consent. Those who gave night-time consent accounted for 25%. The person in charge submitted two proposals together: sending messages at 9:30 PM only to those who gave night-time consent while postponing the rest to 9:00 AM the next day, and changing all transmissions to email to send at 9:30 PM. The team chose the first option on the grounds that text messages had higher response rates.

Group ② involved customers who had directly transacted four months earlier and concerned the same category of goods—gift sets—so it fell under the transaction relationship exception. However, because night-time regulations were not exempt, they decided to send to this group during daytime hours. A marketer argued, "They are exempt customers anyway, so we can send to them at night," but the person in charge pointed out that night-time regulations applied notwithstanding Paragraph 1. Group ③ did not qualify for the exception because six months had passed since the termination of transactions, and lacked consent as well, so they were excluded from the advertising text message targets.

They also organized the data side. For AI copy generation, they input only recently purchased items and preferred price ranges, while having names and phone numbers combined in the transmission system. They decided to use only enterprise environments for the AI service that had completed entrustment contracts and website disclosures. Finally, they included night-time consent verification methods and opt-out reflection cycles in the contract with the transmission agency, and added a step to cross-check the opt-out list again immediately before transmission.

Book-Eating Hippo: Child members and tailored Recommendation

Children's book subscription service 'Book-Eating Hippo' intended to create book Recommendation messages tailored to each child using AI and push them to parents' apps. Member data included children's names, ages, reading records, and parents' contact information. The planning team suggested using records where children directly checked 'Receive recommendations' in the app as consent.

The person in charge first divided the processing targets. Because a child's reading record was personal information of a child under 14 years of age, processing it for promotional purposes required obtaining consent from a legal representative and verifying that consent. The child's check did not satisfy this requirement. The person in charge created a screen to obtain Consent to processing for promotional purposes separately from parents' accounts, and decided to include only consenting households in personalization targets. Households that did not consent continued to receive the subscription service as before.

The planning team asked, "Then if we pseudonymize the data and use it, wouldn't it be permissible even without consent?" The person in charge replied that pseudonymous information could be used for statistical compilation and similar purposes, but could not be used for a Recommendation tailored to a specific child. Instead, they decided to compile popular book statistics by age group into pseudonymous information and use them as a general Recommendation list that could also be sent to non-consenting households. However, the person in charge left a note stating that sending that list via app push constituted transmitting advertising information, so parental consent to receive advertisements and night-time regulations had to be complied with separately.

Common mistakes

1. "Messages written differently for each customer by AI are not advertisements." If it encourages sales, it is commercial advertising information regardless of personalization.
2. "Since we obtained consent for service notifications, advertisements are also permitted." Consent is valid only within its scope. Consent for service notifications is not consent to receive advertisements.
3. "If the transaction relationship exception applies, messages can be sent at night as well." The exception exempts only Prior consent. Separate night-time consent, required disclosures, and opt-out provisions still apply as they are.
4. "Night-time exceptions apply to all messages." The only exempt medium is email. Text messages and app push require separate consent.
5. "Internal recording is sufficient for processing opt-outs." The processing results must be notified within 14 days from the date the intention was expressed.
6. "Since the contract states the transmission agency takes responsibility, we have no involvement." The entrustor has an obligation of management and supervision, and in compensation for damages, the trustee is deemed an employee of the entrustor.
7. "If pseudonymized, individualized advertisements can be conducted without consent." Pseudonymous information cannot be processed for the purpose of identifying a Specific individual.
8. "If marketing consent is not given, certain features may be blocked." Service provision cannot be refused on the grounds that consent for promotional purposes was not given.

Summary at a glance

Check the official docs

• Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection: Prior consent, exceptions, opt-out, night-time, required disclosures, prohibited acts, notification of processing results, periodic confirmation.
• Article 50-3 of the Act on Promotion of Information and Communications Network Utilization and Information Protection: Transmission qualification certification upon entrusting transmission, management and supervision, compensation for damages.
• Article 61 of the Enforcement Decree of the Act on Promotion of Information and Communications Network Utilization and Information Protection: 6 months, email exception, Attached Table 6. Read Article 62, Article 62-2, and Article 62-3 together.
• Personal Information Protection Act: Article 2 (Definitions), Article 3 (Principles), Article 18 (Restrictions on Use Beyond Purpose), Article 22 and Article 22-2 (Methods of Giving Consent, Children), Article 26 (Entrustment), Article 28-2 and Article 28-5 (Pseudonymous Information), Article 58-2 (Exclusion from Application).
• Article 28 of the Enforcement Decree of the Personal Information Protection Act: Matters to be included in entrustment documents, disclosure methods, methods of notification for promotional entrustment.

Self-check

3-1. State the three conditions under which the transaction relationship exception of the Information and Communications Network Act is established, and list three regulations that must still be observed even when the exception is established.

3-2. Explain the difference between email and app push when sending advertising information at 10:00 PM, along with the supporting legal provisions.

3-3. Write in order what the company must do after a recipient expresses an intention to refuse receipt, including the deadline and notification contents.

3-4. Select all of the following acts prohibited by Article 50 (5) of the Information and Communications Network Act. (A) A design where opting out is processed immediately upon clicking the opt-out link (B) A feature that generates a list of prospective customers by combining mobile phone number patterns (C) A setting that changes the calling number each time so that the source cannot be identified (D) A notice inquiring whether consent is maintained every two years from the date of consent.

3-5. Explain what each of "Consent to processing for promotional and marketing purposes" under the Personal Information Protection Act (PIPA) and "Consent to receive advertising information" under the Information and Communications Network Act is consent for, and give one problem that arises when only one of the two has been obtained.

3-6. State one marketing analysis that can be conducted using pseudonymized information and one marketing activity that must not be conducted using pseudonymized information, along with the supporting legal provisions.

3-7. (Design) When entrusting customer data to an external AI vendor to generate personalized copy, write six or more items to include in the entrustment contract and internal procedures.

Hands-on tasks