Not legal advice: This article is general information, not legal advice. Israeli, EU and US marketing law changes over time and applies differently case by case — verify your specific obligations with a qualified lawyer before you rely on anything here.
Israel's "Spam Law" is Section 30A of the Communications Law (Bezeq and Broadcasting), 1982 — added by Amendment 40, passed May 27, 2008 and in force since December 1, 2008. It requires prior opt-in consent before sending commercial "advertising matter" by email, SMS, fax, or automated dialing system, and it's the single most litigated consumer-protection statute in Israel by message volume. It is a different law from the WhatsApp-focused Privacy Protection Law (Amendment 13) covered in our WhatsApp compliance guide — this one governs email, SMS and fax specifically.
The law itself is short, but the number everyone quotes from it — "1,000 NIS per email, no proof needed" — is usually repeated wrong. It's a ceiling a court may award, not a fee a sender automatically owes. This guide covers what Section 30A actually requires, what the statutory-damages number really means, and how it stacks up against GDPR and CAN-SPAM if you're marketing beyond Israel.
Key takeaways
- Amendment 40 requires real opt-in consent before commercial email, SMS, fax or autodialed calls — it's an opt-in regime, not opt-out.
- You can email existing customers without fresh consent only if all four statutory conditions are met — and only about products or services similar to what they already bought.
- Every marketing email needs the word "פרסומת" (advertisement) at the start of the subject line, real sender identification, and a working opt-out method.
- The famous "1,000 NIS per email" figure is a ceiling a court may award without proof of harm — not a fixed amount, not a minimum, and not automatic.
- Israel, the EU and the US all regulate marketing email differently: opt-in with a narrow existing-customer exception (Israel), opt-in with a similar "soft opt-in" exception (EU/GDPR), and opt-out with mandatory disclosures (US/CAN-SPAM).
- You'll see a widely repeated claim about roughly 13,000 spam lawsuits filed in Israel between 2016 and 2022 — we could not independently verify the underlying study, so we're not repeating it as fact.
What is Israel's Spam Law, and does it actually cover email?
Yes — email is one of the four channels the law names explicitly. Amendment 40 to the Communications Law (Bezeq and Broadcasting), 1982, added Section 30A, which restricts sending "advertising matter" (דבר פרסומת) by fax, automated dialing systems, electronic message (including email), or SMS, without the recipient's prior consent. It passed the Knesset on May 27, 2008, and took effect December 1, 2008.
A later amendment — Amendment 72, from May 23, 2018 — widened the definition further to cover automated calls designed to prompt a callback, even when no product or donation is being pitched directly. The core rule hasn't changed since 2008: no consent, no advertising message, full stop.
Don't confuse this with Israel's Privacy Protection Law, Amendment 13 (August 2025), which governs how you collect and use personal data generally — and which our WhatsApp compliance guide covers in more depth. Section 30A is narrower and older: it specifically targets unsolicited commercial messages sent through fax, autodialers, email and SMS.
What counts as valid consent under Amendment 40?
The law requires the recipient's express consent, given in advance, in writing — and "in writing" explicitly includes an electronic message, so a checkbox, a form submission, or a reply to a confirmation message all qualify. Silence, a pre-checked box, or an assumption that someone "probably wants this" doesn't.
Unlike GDPR, Section 30A doesn't require the consent to be freely revocable at zero cost forever in the same explicit terms — but it does require every message you send afterward to include a working opt-out (more on that below), and once someone opts out, sending them another advertising message is again unlawful without new consent.
- Get an affirmative action — a checkbox, a form, a reply — never a default-on setting.
- Keep a record of when and how consent was given; if it's ever challenged, the burden of proof is on you as the sender.
- Consent given for one purpose doesn't automatically cover unrelated marketing — see the existing-customer exception below for the one narrow carve-out.
Can you email existing customers without asking again?
There's one statutory exception, and it's narrower than most marketers assume. You may send an existing customer an advertising message without fresh opt-in only if all four conditions below are met at once — miss any one of them and you're back to needing consent.
| Condition | What it means in practice |
|---|---|
| The customer gave you their details during a purchase or purchase negotiation | A cold-scraped or purchased list never qualifies — the details have to come from your own transaction with that person. |
| You told them the details would be used to send advertising | Israeli case law allows this notice to come any time before the first ad is sent — it doesn't have to be simultaneous with the original data collection. |
| You gave them a chance to opt out at that time, and they didn't | A visible, working opt-out at collection — not just later — is what makes this condition provable. |
| The ad is for a product or service similar to what they bought or discussed | A store that took your details for a fridge purchase can email you about ovens; it can't email you about movie tickets it also happens to sell. |
All four have to hold at once. If a business can't show every condition, the safer and simpler move is to just ask for consent again — the exception is a narrow carve-out, not a general "existing customers are fair game" rule.
What has to be in every marketing email?
Beyond having consent (or qualifying for the exception above), Section 30A sets specific, mechanical disclosure requirements for the message itself. These aren't optional style choices — leaving one out is itself a violation, independent of whether you had consent to send the email at all.
- The word "פרסומת" (advertisement) — or "בקשת תרומה" for a donation ask — has to appear at the very start of the subject line, not buried in the body.
- The message has to clearly identify the advertiser: real business name and real contact details, not a generic "no-reply" sender.
- It has to tell the recipient, in plain terms, that they can opt out at any time, through a simple method — for email, a working reply-to or unsubscribe address is standard practice.
The opt-out has to work through the same channel the message arrived on. An email that tells someone to "call our office" to unsubscribe doesn't meet the bar half as well as a one-click link or a reply that's actually monitored.
The "1,000 NIS per email" number everyone misquotes
This is the statistic that made Section 30A famous, and it's usually repeated as if it's a guaranteed payout. It isn't. The statute's actual language sets a ceiling — "not exceeding 1,000 new shekels" (שלא יעלה על 1,000 שקלים חדשים) — that a court may award per unlawfully sent message, without the recipient having to prove they suffered any real harm. Courts retain discretion to award less, and in practice they often do, weighing the circumstances of the specific violation.
≤ ₪1,000
the statutory ceiling an Israeli court may award per unlawful advertising message under Section 30A, without proof of harm — a maximum a judge can reduce, not a fixed fee owed automatically.
Source: Communications Law (Bezeq and Broadcasting), 1982, Section 30A(י)(1), as summarized by Israeli legal commentary (e.g. felaw.co.il) and Hebrew Wikipedia's entry on the law
In December 2018, Israel's Supreme Court ruled — reported at the time by Globes — that damages under this section should be "meaningful and deterrent" rather than symbolic, and that organizations helping consumers file legitimate spam claims aren't doing anything improper by existing. That ruling cuts against senders who assume the number is always small; a court weighing a real, repeated violation isn't bound to award pocket change.
Is Israel really a hotspot for spam lawsuits?
Genuinely, yes — but the exact scale is harder to pin down than the numbers floating around online suggest. Section 30A claims can be filed in small claims court without a lawyer, damages don't require proof of harm, and the law explicitly allows class actions — all of which make it an unusually accessible statute to sue under, and Israel has a recognizable cottage industry of consumers and law offices built around exactly that.
One Israeli legal commentator, writing in Globes in 2021, put spam claims at roughly 28% of all small-claims-court filings in Israel and described an organized ecosystem — Facebook groups, filing guides, and senders who maintain multiple email addresses specifically to accumulate messages before suing. A separate, concrete example: in 2023, an Israeli court sanctioned an attorney who had built over 200 "trap" email addresses and filed hundreds of spam suits, ordering roughly 11,700 NIS in costs after the claim was withdrawn mid-examination.
You'll also see a specific claim online — roughly 13,000 spam lawsuits filed in Israel between 2016 and 2022, from an Israel Internet Association study. We tried to verify it directly and couldn't access the underlying data ourselves, so — in the spirit of not repeating numbers we can't check — we're flagging it as a claim you'll encounter, not a fact we're vouching for.
How does this compare to GDPR and CAN-SPAM?
If you sell beyond Israel, Section 30A isn't the only regime in play. The three major frameworks share the same instinct — don't email people who didn't ask for it — but differ in consent model, exceptions and how penalties are structured.
| Israel — Section 30A | EU — GDPR / ePrivacy | US — CAN-SPAM | |
|---|---|---|---|
| Consent model | Opt-in required | Opt-in required | Opt-out — sending is allowed until they unsubscribe |
| Existing-customer exception | Yes — 4 cumulative conditions, similar product/service only | Yes — "soft opt-in": details collected during a sale, opt-out offered at collection and in every message | Not applicable — consent isn't the trigger under CAN-SPAM |
| Required disclosures | "פרסומת" at the start of the subject line, sender ID, opt-out method | Identity of the controller, lawful basis, opt-out in every message | Truthful headers, honest subject line, ad disclosure, physical postal address, opt-out link |
| Opt-out deadline | Not numerically specified — "at any time," simple method | "Without undue delay" | Must be honored within 10 business days |
| Penalty for violating | Up to 1,000 NIS per message, court-awarded, no proof of harm needed | Up to €20M or 4% of global annual turnover, whichever is higher | Up to $53,088 per separate violating email, FTC-enforced |
These penalty figures aren't apples to apples, even though they get compared online as if they were. Israel's 1,000 NIS is a private civil remedy an individual recipient can sue for; CAN-SPAM's figure is a regulatory fine the FTC can impose; GDPR's is a regulatory fine tied to company revenue. A single bad email campaign could realistically expose a business to more than one of these at once.
Which rules actually apply to your business?
The honest answer is often "more than one, simultaneously." These laws aren't mutually exclusive, and they apply based on where your recipients are, not where your business is registered.
- Emailing anyone in Israel: Section 30A applies, regardless of where your business is based.
- Emailing anyone in the EU/EEA: GDPR and the local ePrivacy implementation apply, again regardless of your location.
- Emailing anyone in the US: CAN-SPAM applies to that message.
- Selling internationally from Israel — which is common for otok.io customers — usually means designing your opt-in and unsubscribe flow to satisfy the strictest applicable regime, since it's simpler than running three different flows per region.
In practice, building to GDPR's opt-in standard with a clear, working unsubscribe link tends to satisfy Section 30A and CAN-SPAM's disclosure requirements too — the reverse isn't true, since CAN-SPAM alone wouldn't cover Israel or the EU's consent requirements.
How do you actually stay compliant without a legal team on retainer?
- 1Collect consent with an affirmative action that names your business — never a pre-checked box or a buried assumption in your terms of service.
- 2Start every marketing email's subject line with "פרסומת" if you're sending to Israeli recipients, and make sure the sender name and reply address identify a real business, not a no-reply address.
- 3Build one unsubscribe flow that actually works — a one-click link that suppresses the contact everywhere, not just in the tool that sent that one campaign.
- 4Log consent: when it was given, how, and for what. If a claim ever lands, this record is your entire defense.
- 5Re-verify existing-customer sends against all four Section 30A conditions before treating a purchase list as pre-approved for marketing — when in doubt, ask again instead of relying on the exception.
In oToK, opt-outs suppress a contact across every list and automation the moment they're processed — the same contact record, not a separate suppression list per campaign — which is the mechanical piece that actually keeps a "they unsubscribed" claim from becoming a spam claim.
Frequently asked questions
- Is Israel's Spam Law opt-in or opt-out?
- Opt-in. Section 30A requires the recipient's prior express consent before you send commercial email, SMS, fax or autodialed calls — the opposite of CAN-SPAM's US opt-out model, where sending is allowed until someone unsubscribes.
- Can I email past customers in Israel without asking again?
- Only if all four statutory conditions are met at once: they gave you their details during a purchase, you told them those details would be used for advertising, you gave them a chance to opt out at the time and they didn't, and the new message is about something similar to what they originally bought or discussed. If any one of those is missing, you need fresh consent.
- Is the "1,000 NIS per spam email" figure guaranteed compensation?
- No — it's a statutory ceiling a court may award without the recipient proving actual harm, not a fixed fee or a minimum. Courts have discretion to award less, and often do. A December 2018 Supreme Court ruling did push back on treating the number as merely symbolic, but it's still a maximum, not an automatic payout.
- How many spam lawsuits are actually filed in Israel each year?
- It's genuinely an active area of litigation — one legal commentator writing in Globes put spam claims at roughly 28% of small-claims-court filings — but a specific, widely repeated figure (about 13,000 lawsuits from 2016–2022, attributed to an Israel Internet Association study) couldn't be independently verified by us, so we're not repeating it as a confirmed fact.
- If I'm an Israeli business selling to EU or US customers, which law applies?
- Potentially all three, depending on where each recipient is. Israel's Section 30A applies to anyone you email in Israel, GDPR applies to anyone in the EU/EEA, and CAN-SPAM applies to anyone in the US — regardless of where your business is registered. Building your opt-in and unsubscribe flow to GDPR's stricter opt-in standard generally covers the other two as well.
