Korea Marketing Message Consent 2026: Checklist for Foreign E-Commerce Companies

Table of Contents

Why marketing-message compliance matters before Korea launch

Foreign e-commerce brands, SaaS companies, app developers, online marketplaces, and subscription services often enter Korea through performance marketing first. They localize a landing page, collect Korean emails, run social ads, build a waitlist, or send discount codes by SMS or KakaoTalk before forming a Korean company.

That order can create avoidable legal risk. Korea has strict rules for electronic marketing, personal information processing, consumer protection, and online sales. If your company sends promotional emails, SMS messages, app push notifications, messenger campaigns, or retargeting notices to Korean users, you should treat consent architecture as part of market entry, not as a late-stage marketing task.

The practical issue is simple: a campaign that feels normal in the United States, Europe, or Southeast Asia may be non-compliant in Korea if it lacks prior consent, clear identification, easy opt-out, or accurate subscription cancellation flows.

Which laws are relevant?

Marketing-message compliance in Korea is not governed by one statute only. Several regimes can overlap:

• The Personal Information Protection Act (PIPA) governs collection, use, outsourcing, overseas transfer, retention, and deletion of personal information.
• The Act on Promotion of Information and Communications Network Utilization and Information Protection contains rules on commercial advertising information transmitted through information and communications networks.
• The Act on Consumer Protection in Electronic Commerce affects online sellers, subscription flows, cancellation rights, disclosures, and misleading online interfaces.
• The Act on Fair Labeling and Advertising can apply to false, exaggerated, deceptive, or unfair advertising.
• Platform rules from Kakao, app stores, payment gateways, and marketplaces may add contractual requirements.

For foreign companies, the key point is that Korea compliance is both a data issue and a consumer-protection issue. You need lawful contact data, but you also need honest message content, transparent pricing, and a clean unsubscribe or cancellation path.

What counts as a marketing message?

A marketing message is not limited to a classic newsletter. In Korea-facing operations, review any message that encourages a user to buy, subscribe, renew, upgrade, install, book, join, or claim a commercial benefit.

Examples include:

• Discount codes, seasonal sales, launch offers, and coupon reminders.
• Cart-abandonment emails or texts that promote purchase completion.
• Subscription renewal prompts with an upsell component.
• App push notifications promoting paid features.
• KakaoTalk channel messages advertising products or events.
• Referral-program invitations.
• Cross-sell messages sent after a user buys one product.
• Re-engagement campaigns sent to dormant users.

Transactional messages are different. A payment receipt, delivery update, password reset, safety notice, or service outage alert may be necessary for service performance. But if a transactional message includes promotional content, the marketing rules may become relevant. Korean campaigns should separate service notices from advertising whenever possible.

Consent: Korea is not a casual opt-out market

Foreign teams sometimes assume they can send marketing until the user unsubscribes. That assumption is risky in Korea. For commercial advertising information, prior consent is generally expected unless a narrow exception applies. If a user withdraws consent or has not consented, promotional messages should not be sent.

A compliant consent flow should answer five questions:

1. Who collected the consent?
2. Which channel was covered: email, SMS, phone, app push, KakaoTalk, or another channel?
3. What type of marketing was described?
4. When and how was consent obtained?
5. How can the user withdraw consent easily and free of unnecessary friction?

Consent should be separate from essential service terms. Do not hide marketing consent inside a general terms acceptance checkbox. If the product also collects personal information for account creation, delivery, payment, analytics, or customer support, keep marketing consent distinguishable from those purposes.

Email, SMS, KakaoTalk, and app push: channel-by-channel planning

Each communication channel has practical differences. A single global CRM setting may not be enough for Korea.

The safest approach is to build a Korea segment in your CRM. Korean users should not be mixed into global marketing automations unless the automation is configured for Korean consent, Korean-language notices, and local unsubscribe handling.

How this affects company formation strategy

Marketing compliance can influence whether a foreign company should incorporate in Korea. A company can sometimes test demand from abroad, but local operations become more attractive when marketing, customer support, payment, and return handling become serious.

A Korean subsidiary may help when you need:

• Local contracting with agencies, influencers, affiliates, and platforms.
• Korean tax invoices and payment-gateway settlement.
• Korean-language customer support for cancellation, refund, and personal-data requests.
• Clear responsibility for privacy notices, consent logs, and regulator response.
• Local employees managing CRM, customer success, or e-commerce operations.

However, incorporation does not automatically fix past consent problems. If an overseas parent collected Korean contacts without proper consent, transferring those contacts to a new Korean subsidiary may require privacy and overseas-transfer analysis. Market-entry planning should therefore align data collection, entity setup, and campaign timing.

Building a Korean consent record

A consent record is only useful if it can be explained later. For Korea-facing campaigns, store at least:

• User identifier, email address, or phone number.
• Consent status by channel and purpose.
• Date, time, IP address, form version, and language of consent.
• The exact consent text shown to the user.
• Source of collection, such as website, event, marketplace, app, or partner campaign.
• Withdrawal date and suppression status.
• Evidence of periodic confirmation if your process requires it.

If a partner, distributor, influencer, or lead-generation agency collects contacts for you, the contract should state who obtains consent, what wording is used, how records are delivered, and who handles deletion or withdrawal requests. Do not buy Korean lead lists casually. Purchased or scraped contact data is a common source of regulatory and reputational risk.

Dark patterns and subscription cancellation risk

Marketing-message compliance also connects with subscription design. Korean consumer authorities have focused on online practices that make users pay more than expected or make cancellation harder than sign-up. Public discussions around dark patterns include hidden renewal, drip pricing, pre-selected options, misleading button hierarchy, cancellation obstruction, and repeated interference.

Foreign subscription businesses should review:

• Whether free trials clearly disclose the paid conversion date and price.
• Whether renewal reminders are accurate and timely.
• Whether cancellation is as easy to find as sign-up.
• Whether discount pop-ups or retention offers pressure users after they choose cancellation.
• Whether the final payment price includes mandatory fees before checkout.
• Whether marketing claims match the actual refund, return, and cancellation policy.

This is especially important for apps, SaaS memberships, online education, digital content, beauty boxes, supplements, games, and cross-border e-commerce subscriptions.

Practical launch checklist

Before sending Korean marketing messages, complete this checklist:

• Map every channel: email, SMS, KakaoTalk, app push, phone, retargeting, and affiliate campaigns.
• Separate marketing consent from terms of service and privacy consent.
• Prepare Korean-language consent text and withdrawal instructions.
• Configure CRM suppression lists for Korean users.
• Keep consent records by channel, not only by user account.
• Confirm whether personal data is stored overseas and update privacy notices accordingly.
• Review outsourcing contracts with agencies, CRM providers, SMS vendors, and customer-support providers.
• Test unsubscribe, opt-out, cancellation, refund, and account-deletion flows in Korean.
• Check whether the business needs Korean e-commerce reporting, telecom-related filings, or a local payment setup.
• Decide whether remote sales, a Korean subsidiary, or another local structure fits the scale of operations.

Common mistakes foreign companies make

The first mistake is collecting emails through an English landing page and later using them for Korean promotional campaigns without reviewing the original consent language.

The second mistake is assuming email consent covers SMS, KakaoTalk, phone calls, and app pushes. Korea-facing consent should be channel-specific.

The third mistake is importing a global CRM workflow that automatically sends abandoned-cart, win-back, upsell, and renewal messages to Korean users.

The fourth mistake is relying entirely on a marketing agency. Agencies can execute campaigns, but the advertiser remains responsible for the compliance strategy, message content, data source, and customer response.

The fifth mistake is treating cancellation as a product-design issue only. In Korea, a difficult cancellation path can become a consumer-protection issue and damage trust quickly.

FAQ

Can a foreign company send marketing emails to Korean users before incorporating?

Sometimes, but it must still comply with Korean consent, privacy, advertising, and consumer-protection rules. Incorporation is not the starting line for compliance.

Is a newsletter signup enough for SMS marketing?

Usually no. SMS marketing should have its own clear consent record unless the original consent specifically covered SMS promotional messages.

Do we need Korean-language consent text?

If you target Korean users, Korean-language notices are strongly recommended. Users should understand what they are consenting to and how to withdraw.

Can we use contacts collected by a Korean reseller or influencer?

Only if the collection, consent wording, transfer, and campaign purpose are legally supportable. Put these duties in the contract and verify evidence before sending.

Should we form a Korean company before launching campaigns?

Not always. But if Korea will involve local payment, customer support, returns, employees, agency contracts, or significant CRM operations, a Korean subsidiary may be the cleaner long-term structure.

Need help?

SMA Lawfirm assists foreign e-commerce companies, SaaS providers, app developers, and subscription businesses with Korea company formation, privacy compliance, e-commerce reporting, marketing-consent review, and market-entry contracts.

📩 Contact us at sma@saemunan.com