Owners of certain BMW models were contacted earlier this year as part of the Takata airbag recall and asked to provide their details to a dealership in order to have the repair work carried out.
No simple opt-out function is provided at the sign-up page - users are required to either phone BMW New Zealand or email their privacy department and ask to be excluded from advertising emails.
The policy said information would be passed on to dealers, but only if they complied with BMW New Zealand's policy.
A spokesperson for BMW New Zealand said "Auckland BMW and the BMW Group NZ prioritises the security of customer personal data and unreservedly apologises for any issue arising from this matter".
Do you have a news tip? Email firstname.lastname@example.org
They said the automatic process used to add the addresses to their database has now been changed and "a review of relevant procedures and processes has been initiated.
"Compliance training programs will be reviewed for both dealership and corporate staff."
Auckland City BMW Managing Director Ian Gibson told 1 NEWS "we take these matters very seriously and it is certainly not our intention to send out spam emails.
"We have stopped all marketing communications to customers whilst we review our data base processes."
A spokesperson for the Department of Internal Affairs, which is responsible for regulating the Unsolicited Messages Act, said while the practice did not appear to directly breach the Act, they were critical.
"[Users] have been directed to the platform because of a recall issue, which BMW are obliged to facilitate," the spokesperson said.
"Directing users to a platform which is necessary for product recall that then subscribes the user to receive further commercial electronic messages is not considered best business practice.
"It does not appear that the Act has been breached in this instance, however this does question the intentions of BMW to choose such a process and whether the wording of the Act and whether consent in particular, is appropriately defined to consider this type of activity."
A spokesperson for the Office of the Privacy Commissioner said "this isn't best privacy practice and I can see a lot of areas where BMW could improve ... allowing people to opt-in is better privacy practice than making them opt out".
Of the 35,000 vehicles that still need to be repaired as part of the compulsory airbag recall, almost 17,000 of those are in the Auckland region.
In July this year, optometrist and eyewear retailer Bailey Nelson also apologised for spamming customers after a number of people were signed up to its email marketing list without consent.
The practice is illegal in New Zealand under the Unsolicited Electronic Messages Act and carries a maximum fine of $500,000 for an organisation.