Affiliate marketing compliance in Australia and your legal obligations

Running an affiliate program, or promoting other businesses' products for a commission, brings you inside three overlapping legal regimes at once. The Australian Consumer Law (the ACL) requires your advertising to be truthful and your commercial relationships to be visible. The Privacy Act 1988 (Cth) governs how you collect and use customer data through tracking links and analytics. The Spam Act 2003 (Cth) sets the rules for the emails and texts you send to promote those links. None of it is optional, and none of it depends on you being a large business.

This guide sets out who these obligations apply to, what each regime actually requires day to day, what the penalties look like when things go wrong, and the practical steps to get compliant. If you are a brand running a program, an agency managing influencers, or an affiliate promoting products yourself, the same rules apply to you.

Who these obligations apply to

The three regimes have different starting gates. None of them uses a headcount threshold, and only one uses a turnover figure:

Australian Consumer Law: The misleading conduct and false representation rules apply to any person acting in trade or commerce. There is no turnover test. The ACCC has confirmed that paid influencers and affiliates promoting products are engaging in trade or commerce, and that brands and marketers using them can be caught as well.
Spam Act: The rules apply to any commercial electronic message with an Australian link, which in practice means any email, SMS or social message promoting goods or services to a recipient in Australia, regardless of where your business is based or how small it is.
Privacy Act: The Australian Privacy Principles (the APPs) bind APP entities. In practice that means most businesses with annual turnover above $3 million, plus businesses below that line that trade in personal information, provide health services, or fall within another listed exception. From 10 December 2026 the small business exemption is due to be removed, bringing most businesses under the $3 million threshold into the full APP regime.

Advertising truthfully under the Australian Consumer Law

Section 18 of the ACL, which sits in Schedule 2 of the Competition and Consumer Act 2010 (Cth), prohibits conduct in trade or commerce that is misleading or deceptive, or likely to mislead or deceive. The prohibition is not limited to deliberate lies. An honest mistake, a claim you cannot substantiate, or an omission that creates a false impression can all breach it.

Section 29 of the ACL then targets specific false or misleading representations, including representations about a product's standard or quality, testimonials, sponsorship or approval, affiliation, and price. That last category matters in affiliate marketing. A claim that you have an affiliation you do not have, or a testimonial that does not reflect a real experience, sits squarely within the section.

In practice the ACCC expects claims to be substantiated before they are published, and it can issue substantiation notices requiring you to produce the evidence behind claims you have made. A discount code that does not produce the advertised price, a "limited time" offer that never ends, or a review presented as independent when it was paid for can each amount to misleading conduct, even when nobody intended to deceive.

The ACCC's own compliance work shows how often these rules are missed. In an internet sweep of 118 social media influencers in 2023, the ACCC found 81 per cent were making posts that raised concerns under the ACL, most commonly by failing to disclose brand relationships, using vague labels such as "sp" or "spon" instead of "sponsored", or formatting posts so the disclosure was hard to notice. In a companion sweep of online reviews, 37 per cent of the 137 businesses reviewed showed concerning conduct, including undisclosed incentivised reviews and manipulation of negative feedback.

Disclosing affiliate and influencer relationships

The disclosure duty follows directly from the ACL. Where a commercial arrangement exists, whether a commission, a free product, or a paid post, the relationship must be disclosed in a way that is immediately obvious to the consumer. The ACCC's guidance is that the disclosure should appear before the affiliate link or in the first lines of a post, in plain language such as "ad", "paid partnership" or "I earn a commission if you buy through this link". Burying it in a caption, among hashtags, or in a profile bio that users never see does not do the job.

Both sides carry the obligation. The ACCC has said influencers and brands may break the law if they do not take reasonable steps to ensure consumers are not misled into thinking sponsored posts are genuine. For brands that means telling influencers what the rules are, not providing scripts that require them to overstate their experience, and acting quickly when a post goes out without a disclosure. The industry codes point the same way. The Australian Association of National Advertisers' Code of Ethics, for example, requires that advertising is clearly distinguishable as such.

Privacy obligations when you handle customer data

Affiliate programs are built on tracking. Cookies, pixels and analytics collect device identifiers, browsing data and purchase behaviour, and that data is often shared with ad-tech partners. If you are an APP entity, the APPs impose specific duties:

APP 1: Have a clearly expressed and current privacy policy, and manage personal information openly and transparently.
APP 5: Notify individuals, at or before collection, about what you collect and why, who it may be shared with, and how they can complain.
APP 7: Do not use or disclose personal information for direct marketing unless an exception applies, and always provide a simple opt-out.
APP 11 and APP 13: Take reasonable steps to secure personal information, and destroy or de-identify it once it is no longer needed.

If a data breach is likely to result in serious harm, the Notifiable Data Breaches scheme requires you to notify the Office of the Australian Information Commissioner (the OAIC) and affected individuals. Data flows through an affiliate program, from the site to the affiliate platform to the email provider, need to be mapped so the privacy policy actually matches what happens in practice.

Email and direct marketing under the Spam Act

Whether you are a brand emailing customers or an affiliate emailing a newsletter list, every commercial electronic message you send to a recipient in Australia must satisfy three rules under the Spam Act 2003 (Cth):

Consent (s 16): The recipient must have consented, either expressly or by inference from their conduct and relationship with you. Purchasing a list does not constitute consent.
Accurate sender identification (s 17): The message must clearly identify who authorised it and include accurate contact details that remain valid for at least 30 days.
A functional unsubscribe (s 18): Every message must include a clear and conspicuous way to unsubscribe, and the mechanism must work. Once a recipient asks to stop, their withdrawal of consent takes effect within five business days, so sending should stop promptly.

Penalties and enforcement for getting it wrong

Each regime carries real financial exposure:

Australian Consumer Law: Breaches of the false representation rules in s 29 are civil penalty provisions. For a corporation the maximum pecuniary penalty is the greater of $100 million, three times the benefit obtained from the conduct, or 30 per cent of adjusted turnover during the breach period. For an individual it is $2.5 million. Misleading conduct under s 18 is enforced through court orders including injunctions, corrective advertising and damages. Businesses that are knowingly concerned in a contravention, including brands whose affiliates mislead consumers, can be exposed under the same provisions.
Privacy Act: Serious or repeated interference with privacy attracts penalties for a corporation of the greater of $50 million, three times the benefit, or 30 per cent of adjusted turnover, and up to $2.5 million for an individual. The OAIC can also make determinations requiring action or compensation.
Spam Act: Civil penalties are set in penalty units, which are indexed over time and are higher for corporations. A first-time corporate offender can face up to 2,000 penalty units per day of contravention, and a repeat offender up to 10,000 penalty units per day. The ACMA can also issue infringement notices without going to court.

The enforcement climate is tightening. The ACCC has said it will move from guidance to a renewed focus on enforcement in influencer and online review advertising, and it has prioritised manipulative or deceptive advertising practices in the digital economy. These are not theoretical exposures for large companies only. The sweep results show small operators are squarely in the regulator's sights.

Putting the program rules in writing

Much of the compliance work happens before a single post goes live, in the documents that govern the program. An affiliate marketing agreement should set out the commission structure and attribution window, require affiliates to comply with the ACL and the program's disclosure standards, prohibit specific practices such as bidding on the brand's trademarks or sending spam, and give you termination rights for breaches. Website terms should deal with acceptable use, intellectual property and liability limits, and should be consistent with the affiliate rules rather than contradicting them. If you run separate referral or partner tiers, a distinct referral agreement can set different commission mechanics and approval processes.

A practical playbook helps as well: approved disclosure language affiliates can copy, brand usage guidelines, and a content approval process for high-risk claims.

A compliance checklist for your affiliate program

Work through the checklist below, which covers the most common compliance gaps in affiliate programs:

Audit current content: Review your own posts and your affiliates' posts for missing or hidden disclosures, starting with high-traffic placements.
Substantiate claims: Keep evidence for performance, price and availability claims, and refresh evergreen content when claims go stale.
Publish privacy and cookie information: Make your privacy policy match your actual data flows, and tell users what tracking technologies you use.
Check your email flows: Confirm consent is recorded, sender details are accurate, and every message carries a working unsubscribe.
Put the rules in writing: Have affiliates accept current program terms, and keep records of approvals, takedown requests and term updates.
Plan for December 2026: If your turnover is under $3 million, budget now for the removal of the small business exemption.

Where a lawyer can help

Compliance in this area is layered, and the documents need to match the way the program actually runs. A lawyer can draft or review your affiliate agreement and website terms, check that your privacy policy and consent flows reflect your real data practices, and advise on whether a specific campaign, claim or incentive structure carries misleading conduct risk. If you receive a substantiation notice, a complaint referral, or an inquiry from the ACCC, the OAIC or the ACMA, early advice on how to respond is usually worth far more than its cost.

There is also a planning question worth raising with a lawyer now: what the removal of the small business exemption means for your business from 10 December 2026, particularly if you collect customer data through affiliate tracking.

The disclosure gap is the risk that costs most programs

The obligation most often missed in affiliate marketing is not a technical one. It is the simple duty to say, clearly and up front, that content is commercial. The ACCC's sweep found that the most common problem across influencer advertising was not false claims but missing disclosures, and the regulator has signalled that enforcement is coming. Disclosure is also the cheapest obligation to fix. A line before the link costs nothing.

Start this week by auditing your most visible affiliate content, your own and your affiliates', and by checking that your privacy policy describes the tracking you actually use. If you are under the $3 million turnover mark, put the 10 December 2026 changes on the calendar now. The brands and affiliates that treat disclosure and data handling as part of the product, rather than an afterthought, are the ones least likely to feature in the next sweep.