Christmas shopping can bring with it a privacy risk, with stores signing people up for their mailing lists without consent.
1 NEWS is aware of incidents where retailers ask customers for their email address to supply them with their receipt, only for them to also be added to the retailer's mailing list without their knowledge or permission.
It's behaviour that's illegal under the Privacy Act and Consumer NZ chief executive Jon Duffy says it's not acceptable.
"Using sneaky ways to get people onto their marketing databases is just not on," he told 1 NEWS.
"It's not something consumers have to put up with."
He says if the customer's personal information was obtained for one purpose — such as sending a receipt — it can't then be used for marketing purposes without consent.
As well as the Privacy Act, it could breach the Unsolicited Electronic Messages Act, particularly if there isn't an easily available option to 'unsubscribe', Duffy says.
He encourages people to report any such breaches to the Privacy Commission.
"It's unlikely that there's direct harm resulting from this... It's important for the Office of the Privacy Commissioner to know about these things to look into whether there's a trend happening here, and have communications to retailers."
It echoes a similar issue that arose when businesses were required to have registers as contact tracing measures.
Allegations arose that the contact information was then being illicitly used to sign people onto mailing lists or otherwise contact customers in a way they hadn't consented to.
At the time, Privacy Commissioner John Edwards warned businesses to make sure they complied with the Privacy Act.
"This is not an opportunity for you to build up your mailing list, or to allow staff to contact customers for personal reasons," he said in a blog post.