An amendment to the Act on Promotion of Information and Communications Network Utilization and Information Protection (the “Network Act”) was passed on March 31, 2026, to substantially strengthen sanctions against businesses transmitting commercial advertising information. Most notably, the amendment introduces a revenue-based administrative surcharge regime for illegal spam violation, taking effect on October 1, 2026.
 
To implement this framework, the Korea Media and Communications Commission (“KMCC”) announced a proposed amendment to the Enforcement Decree and a new Public Notice on August 3, 2026. Under these proposals, administrative surcharge can range from 1% and 6% of relevant revenue (or a fixed amount of KRW 100 million to KRW 2 billion if revenue cannot be calculated).
 
The key takeaways and compliance priorities are outlined below.
 

• General Businesses Are Liable: Article 50 of the Network Act establishes that “no person” may transmit commercial advertising via electronic media without prior express consent. General businesses promoting their own products or services via text messages, email, app push notifications and fax are directly within scope.

• Outsourcing Does Not Shield Advertisers: Even if a company outsources marketing or messaging to an external marketing agency, the advertiser or actual sender can still face significant surcharge exposure depending on their role and involvement.

• Service Provider Obligations: Entities providing messaging, email or platform or other transmission functionality have separate legal duties to take preventive measures against illegal spam. Crucially, a technology or platform provider cannot avoid liability merely because it did not directly transmit the illegal spam; failing to block illicit content or take appropriate contractual and remedial measures after becoming aware of service misuse can trigger severe regulatory exposure.
  
   

• Transmitting ads without express prior consent (Article 50 (1)).

• Continuing to send ads after a recipient opts out or withdraws consent (Article 50 (2)).

• Sending ads between 9:00 p.m. and 8:00 a.m. without separate nighttime consent (Article 50 (3)).

• Omitting required sender details, opt-out mechanisms, or failing to process/notify opt-out requests properly (Article 50 (4)).

• Evading opt-outs, concealing sender identity, deceiving recipients, or shifting opt-out costs to recipients (Article 50 (5)).

• Automatically generating or registering telephone numbers or email for use in transmitting ads (Article 50 (5)).

• Failing to properly notify recipients of the outcome of processing their consent, opt-out request or withdrawal of consent (Article 50 (5)).

• Failing to periodically re-verify consumer consent in compliance with statutory timeframes (Article 50 (8)).
  
   

• Infrastructure providers must take the following measures: immediately suspend illegal spam, terminate agreements, remediate security vulnerabilities, improve terms of use and services and establish recurrence prevention plans upon discovering misuse.
  
   

• Installing advertising/data-collection programs without user consent (Article 50-5).

• Posting ads on websites without the administrator’s consent (Article 50-7).

• Transmitting advertisements for goods or services prohibited by law (Article 50-8).
  
   

• 1% to 4% for violations of Article 50(1) through (4), Article 50(6) through (8), Article 50-4, Article 50-5 and Article 50-7.

• 3% to 6% for more severe violations of Article 50(5) and Article 50-8.

• KRW 100 million to KRW 2 billion (fixed amount) where revenue is absent or objectively difficult to calculate.
  
   

• Repeated Violations: Penalties increase if the violator has been penalized for the same offense within the preceding three years (making recurring consent-management errors a high-risk compliance issue).

• Investigation Obstruction: Refusing material submissions/inspections, destroying evidence, or providing false information can trigger an additional penalty of up to 30%.
  
   

• Comprehensive Compliance Review: Before October 1, 2026, companies should audit their advertising transmission workflow processes and marketing-database management systems.

• Legislative Timeline: The KMCC is accepting public comments on the proposed subordinate legislation through August 25, 2026, prior to formal promulgation and implementation in October. 

[Korean Version]