Picture someone at eleven at night, phone lit up in a dark lounge, knee throbbing after a weekend in the garden. They're scrolling, and an ad stops the thumb: a cream that promises relief by morning, dozens of five-star reviews underneath it. They buy it. What they don't realise is that the purchase itself just became a commodity, and not the cream.
That's a sucker list at work: a record of people known to respond to a particular kind of offer, built the moment someone buys, and traded as routinely as any other business asset. Merriam-Webster's own definition is blunt about it, describing a list of "names, addresses, and sometimes telephone numbers of persons who are likely to be purchasers or donors, to whom advertising matter might profitably be sent." Buy one hyped product, and you may have just written yourself onto one.
Anyone running a business in New Zealand or Australia should pay attention here. We assume our privacy laws keep us insulated from this sort of thing, and to a point, they do. But most of the products doing the hyping on our feeds aren't local, which puts a fair bit of that protection out of reach.
What a sucker list actually is
The clearest evidence of how blunt this industry can be came out of a 2013 US Senate Commerce Committee investigation into the data broker industry. Investigators found one broker selling lists with names like "Elderly Opportunity Seekers" (older people "looking for ways to make money"), "Suffering Seniors" (older people with cancer or Alzheimer's), and "Oldies but Goodies" (people described as gullible and hoping their luck will change). That's a mainstream data broker doing what a surprising amount of the industry treats as standard practice.
New Zealand and Australia’s privacy laws only go so far
New Zealand's Privacy Act 2020 makes this harder to pull off from here. A business needs informed, specific, freely given consent before sharing someone's details with an unrelated third party, not a line buried in the terms and conditions. Australia's equivalent goes further in one respect: Australian Privacy Principle 7, under the Privacy Act 1988, explicitly covers organisations whose business is collecting personal information to pass on to other entities, which is the data broker model exactly, and it gives people a right to opt out. The catch is that APP 7 only binds organisations with an annual turnover above three million dollars, so plenty of smaller operators sit outside it, and neither law can reach a business trading out of a country that never signed up to either.
That's the real gap. Most of what's hyped on New Zealand and Australian social feeds, the pain creams, the joint supplements, the "rank your business on Google in sixty seconds" pitches, comes from offshore, and the data those companies collect travels under looser rules than either country would allow at home. A Kiwi or Australian buyer isn't protected by their own privacy law the moment the transaction happens somewhere else.
The modern sucker list: one backend, many brands
The mechanism has moved a long way past the direct mail lists the Senate investigation uncovered. It now runs through affiliate marketing networks that openly advertise running more than fifty different branded pain-relief and supplement products off one shared backend, tracking every sale and upsell across the whole portfolio. Buy one knee cream through a funnel like that, and you're inside infrastructure built to route you toward the next branded product in the same stable, with a commission paid to whoever referred you along the way.
Where ethical marketing ends and hype begins
None of this makes using customer data illegal, and there's a genuine, defensible case for using it well. Someone who's truly lonely is better off being pointed toward a real community than left to keep scrolling. A business that understands what its customers need still has to decide whether it's offering a real answer to that need, or a shortcut dressed up as one.
Marketing has worked on people's genuine wants for as long as the trade has existed: relief from pain, belonging, safety, the desire to improve. Direct marketing leans on the same handful of human desires, sometimes summarised as survival, food, freedom from pain, companionship, comfort, protecting the people we love, approval, and the drive to achieve. Every one of those is a legitimate thing to market to. What turns it into a sucker list problem is the gap between what's promised and what actually gets delivered, and hype exists specifically to hide that gap.
What this means for your business
A few honest questions are more useful here than a policy document.
- Audit your own funnels for language you wouldn't want read back to you by a regulator.
- Use customer data to solve the problem you already know they have, not to find the next thing to sell them.
- Keep the guarantee real. If almost nobody would ever need to claim it, that's a sign the claim behind it needs work, not the guarantee.
- Treat "we can't back this up in plain language" as a reason to rewrite the claim, not to soften the wording around it.
Hype might buy a business a good month, but trust is what earns it a customer who comes back without needing to be sold to twice.
If you'd like an honest, outside look at where your own marketing sits on that line, that's exactly the conversation Iron Road exists to have.
