EDM marketing compliance in Australia, your obligations under the Spam Act, Privacy Act and ACL

EDM marketing, short for electronic direct mail, means sending targeted email (and sometimes SMS) campaigns to customers and prospects who have agreed to hear from you. Done well, it is one of the cheapest and most effective channels an Australian business has. But every campaign you send sits at the intersection of three legal regimes: the Spam Act 2003 (Cth), the Privacy Act 1988 (Cth), and the Australian Consumer Law (ACL), which is Schedule 2 of the Competition and Consumer Act 2010 (Cth).

The obligations that matter most are: get consent before you send, identify yourself accurately, provide a working unsubscribe, handle personal information transparently, and keep your marketing claims honest. This guide sets out who those obligations apply to, what each one requires in practice, the penalties for getting it wrong, and a checklist you can run against your next campaign.

Who must comply with the email marketing rules

The three regimes bite at different thresholds, so work through each one separately.

Spam Act: There is no size threshold. The Act applies to any commercial electronic message with an Australian link, which under s 7 includes any message sent from Australia, sent by a person or organisation in Australia, or accessed on a device located here. In practice, that means almost every Australian business that emails customers is covered, from a sole trader to a listed company.
Privacy Act: The Australian Privacy Principles (APPs) apply to organisations with annual turnover above $3 million (s 6D), and to smaller businesses that fall within an exception, such as health service providers, businesses that trade in personal information, and bodies corporate related to an APP entity. Even if you are exempt, larger customers or platform partners often require APP-level compliance by contract.
ACL: The consumer law applies to every business acting in trade or commerce. There is no turnover threshold, so your subject lines, offers and pricing claims are regulated whether or not the Privacy Act applies to you.

The core rule in s 16 of the Spam Act 2003 (Cth) is simple: you must not send an unsolicited commercial electronic message that has an Australian link. A message is unsolicited unless the recipient consented to receiving it.

Consent can be express or inferred. Schedule 2 of the Act defines consent as express consent, or consent reasonably inferred from the recipient's conduct and their business or other relationships with you. Inferred consent is narrow. In particular, cl 4 of Schedule 2 provides that consent may not be inferred from the mere fact that an email address has been published, so scraping addresses from a website directory or a social media page does not give you permission to market to them.

Record how and when consent was given: Note the source (web form, checkout, event, in-store tablet), the date and time, and exactly what the person agreed to receive. This record is what you show a regulator if a complaint is made.
Make opt-ins genuine: A clear, un-ticked checkbox with plain language about what the person will receive is the safest path. Pre-ticked boxes and consent buried in terms and conditions create real doubt about whether consent was ever given.
Be very cautious with purchased lists: You can only rely on consent that covers your specific marketing. If a list vendor cannot document consent for each contact, and that the consent extends to your business and your messages, using the list puts you in breach from the first send.

Your second obligation: identify yourself and provide a working unsubscribe

Two further rules apply to every commercial electronic message you send, whether or not the recipient consented.

Accurate sender information (s 17): each message must clearly and accurately identify the individual or organisation that authorised the sending, include accurate contact details, and the information must be reasonably likely to remain valid for at least 30 days after sending. A generic "no-reply" address with no way to contact the business will not satisfy this.
Functional unsubscribe (s 18): each message must include a statement, presented clearly and conspicuously, telling the recipient they can use an electronic address in the message to unsubscribe. That address must be reasonably likely to keep working for at least 30 days after the message is sent, and must be capable of receiving a reasonable number of unsubscribe messages from other recipients.

When a recipient does unsubscribe, the withdrawal of consent takes effect at the end of five business days after the request (cl 6 of Schedule 2). That means you can lawfully finish sending messages already in flight during that window, but after it, marketing to that person must stop. In practice, most businesses action unsubscribes immediately and keep a suppression list so the person is never contacted again.

The best practice is to make unsubscribing easy: a one-click link or a simple reply address, with no requirement to log in or supply further personal information. It keeps you compliant, and it keeps complaints down.

Your third obligation: handle personal information under the Privacy Act

If the Privacy Act applies to you, the APPs add another layer on top of the Spam Act, because the same campaign that must comply with spam rules also involves handling personal information.

Direct marketing (APP 7): an organisation must not use or disclose personal information for direct marketing unless it collected the information from the individual, the individual would reasonably expect that use, the organisation provides a simple way to opt out, and the individual has not already opted out. Those allowances apply to non-sensitive information; using sensitive information, such as health details, for marketing requires the individual's consent.
Transparency (APPs 1 and 5): you need a clearly expressed and up-to-date privacy policy, and a concise collection notice at the point you collect an email address telling people what you collect, why, and how to opt out or complain.
Use limited to your stated purpose (APP 6): you can only use the information for the purpose you collected it for, unless another lawful basis applies. If you collected an address for order confirmations and then start sending weekly offers without telling people, that is a use outside the disclosed purpose.
Access and correction (APPs 12 and 13): individuals can ask to see the personal information you hold about them and ask you to correct it.
Security (APP 11): you must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. If you outsource to an email platform, that platform is a third party handling personal information on your behalf, and your contract should deal with security, sub-processors and breach notification.
Data breach notification (Part IIIC): if you experience an eligible data breach, broadly an unauthorised access, disclosure or loss of personal information that is likely to result in serious harm, you must notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable.

Your fourth obligation: keep your marketing claims honest under the ACL

The ACL applies to what you say in your emails, not just how you send them. Section 18 prohibits conduct that is misleading or deceptive or likely to mislead or deceive, and the unfair practices provisions, including s 29 on false or misleading representations, cover the specific claims you make.

Substantiate every claim: Discounts, "limited time" offers, "best price" statements and comparison claims must be accurate and supportable. If you say a price is discounted, the comparison price must be a genuine price you actually charged.
Keep pricing statements clear: Component pricing rules require prominent display of the single total price, so avoid advertising a headline price and burying fees.
Honour what you promote: If your emails promote refunds, warranties or consumer guarantees, you must actually deliver them. Advertising a right you do not honour is itself misleading.

What happens if you get it wrong

The regulators enforce these regimes separately, and the penalties are substantial.

Spam Act: the Australian Communications and Media Authority (ACMA) can issue formal warnings, infringement notices and enforceable undertakings, and can seek civil penalties in the Federal Court. Under s 25, a body corporate that sends unsolicited messages can face up to 2,000 penalty units per day for a first contravention, which is roughly $626,000 a day at the current value of a penalty unit, and up to 10,000 penalty units per day for repeat conduct. The caps for failing to identify yourself or provide a functional unsubscribe are lower, up to 1,000 penalty units per day for a body corporate, but they are still significant.
Privacy Act: the OAIC can investigate, accept enforceable undertakings, and seek civil penalties. A serious interference with privacy under s 13G can cost a body corporate up to $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover, whichever is greatest. Other interferences attract up to 2,000 penalty units, and certain APP breaches, including failing to provide a simple opt-out from direct marketing, attract up to 200 penalty units.
ACL: the ACCC and state and territory fair trading agencies enforce the consumer law. For a body corporate, a contravention of the unfair practices provisions can attract a penalty of up to $100 million, three times the benefit obtained, or 30 per cent of adjusted turnover (s 224 of the ACL). Individuals can be liable for up to $2.5 million.

On top of the statutory penalties, a spam complaint or data breach is reputationally expensive, and every complaint is a data point a regulator can use to build a pattern of non-compliance.

A compliance checklist for your next campaign

Run through each item against your next campaign before you send:

Consent: can you produce a record showing how and when each recipient consented, and what they agreed to receive? If not, do not send.
Identification: does every template clearly name your business and include current contact details?
Unsubscribe: is there a clear, conspicuous unsubscribe facility in every message, tested to keep working for at least 30 days after sending?
Opt-out processing: do you action unsubscribes within five business days and sync suppression lists across every tool you use?
Privacy materials: is your privacy policy current, and is a collection notice shown wherever you collect email addresses?
Claims and pricing: is every offer, discount and price comparison accurate and substantiated?
Vendor contracts: do your agreements with email platforms and other processors deal with security and breach notification?
Incident response: do you have a plan for detecting and responding to a data breach, including who notifies the OAIC?

When you need a lawyer

A lawyer is most useful at three points: when you are buying or inheriting a mailing list and need to know whether the consent on it can be relied on; when you are putting together the privacy policy, collection notices and vendor agreements your campaign depends on; and when a complaint, infringement notice or regulator inquiry arrives, because how you respond in the first weeks often determines whether the matter ends with a warning or a penalty. A practitioner can also audit an existing program and tell you, campaign by campaign, where the exposure sits.

If a regulator ever asks about your email marketing, the first thing they will request is your consent records. Every other obligation, from the unsubscribe facility to the privacy policy, can be fixed quickly, but consent that was never properly obtained cannot be manufactured after the fact. Before you send another campaign, pull a sample of your list and ask one question: for each contact, can you show how, when and for what purpose they agreed to hear from you? If the answer is no for any of them, the cheapest fix is to remove them and rebuild with clean opt-ins, because an unsolicited send under the Spam Act can cost hundreds of thousands of dollars a day, and no marketing campaign is worth that.