Email advertising compliance and your legal obligations in Australia

Every marketing email your business sends in Australia is regulated. The moment you hit send on a campaign, the Spam Act 2003 (Cth) imposes three duties on you as the sender: obtain the recipient's consent, identify who authorised the message, and provide a working unsubscribe facility. The content of the email is also caught by the Australian Consumer Law (ACL), set out in Sch 2 of the Competition and Consumer Act 2010 (Cth), if it misleads, and the way you collect, store and use email addresses falls within the Privacy Act 1988 (Cth) where your business is an "APP entity".

These duties are actively enforced. The Australian Communications and Media Authority (ACMA) has issued penalties ranging from $412,500 against Uber to $7.5 million against the Commonwealth Bank in the last few years, mostly for failures to honour unsubscribes and to keep proper consent records. This guide sets out who the rules apply to, the five duties your email program must meet, what non-compliance can cost, and a checklist you can work through this week.

Who the email rules apply to

The Spam Act applies to any "commercial electronic message" with an Australian link. In practice that means emails that advertise or promote goods, services or a business, including newsletters with calls to action, sale announcements and re-engagement messages such as "we miss you, here is 10% off". The link requirement is broad: the Act applies if the message originates in Australia, if the sender is based here, or if the recipient is in Australia when they access the message. An email sent from an overseas marketing agency to an Australian customer is covered, and so is a business-to-business email. There is no general exemption for business addresses.

Purely transactional messages are treated differently. Factual emails such as receipts, order confirmations and shipping notices are "designated commercial electronic messages" under Schedule 1 of the Spam Act, which exempts them from the consent and unsubscribe rules. They must still identify the sender. And the exemption is lost the moment you add promotional content: a cross-sell banner in a receipt makes the whole message a commercial one.

The ACL applies to any conduct in trade or commerce, which covers promotional emails regardless of size or industry. The Privacy Act applies to "APP entities", but many small businesses are exempt: under s 6D, a business with an annual turnover of $3 million or less in the previous financial year is generally a "small business" outside the Act. Exceptions apply, including for health service providers, businesses that trade in personal information and credit reporting bodies, and Parliament has legislated to remove the small business exemption, so exempt businesses should plan for the Privacy Act to apply to them in the near future.

The central rule is in s 16 of the Spam Act: you must not send an unsolicited commercial electronic message unless the recipient consented. Consent can be express or inferred from the recipient's conduct and their business or other relationship with you, and if you are challenged it is up to you to show the consent existed.

The safest approach is express, recorded consent. In practice that means:

Sign-up forms: consent boxes unticked by default, with plain wording such as "send me news and offers by email".
Double opt-in: a confirmation email the subscriber must click, which protects against typos, bots and false addresses.
Consent records: keep the date, the source (web form, in-store tablet, event sign-up) and the exact wording the person agreed to. If you cannot later show what someone consented to, you cannot rely on it.
Separate consent per stream: if you run several brands or lists, explain what each sign-up covers rather than bundling them.

Publication of an address is never enough on its own: under Schedule 2 of the Spam Act, consent cannot be inferred from the mere fact that an email address is published. There is a narrow exception for a conspicuously published work address of an employee, director, officer or partner, where it is reasonable to assume the publication was agreed and the message relates to their role. Treat that as a limited allowance, not a licence to cold-email business contacts, and avoid purchased or rented lists entirely. Consent is not transferable, so a list you bought was almost certainly not consented to you.

Duty 2: Identify the sender in every email

Under s 17 of the Spam Act, every commercial electronic message must clearly and accurately identify the individual or organisation that authorised the sending, and include accurate information about how the recipient can readily contact them. That information must remain valid for at least 30 days after the message is sent.

There is no requirement to include your ABN. Your business or trading name in the "from" field and footer, plus a working email address, contact form or phone number, satisfies the rule. Practical extras worth doing regardless: send from a consistent domain, and set up SPF, DKIM and DMARC so your emails authenticate and are less likely to be spoofed or filtered.

Duty 3: Give recipients a working unsubscribe

Every commercial email must include a functional unsubscribe facility: a clear and conspicuous statement of how to unsubscribe, using an address that is capable of receiving unsubscribe messages for at least 30 days after the email is sent. That last point matters if you use campaign tools that expire links quickly.

When a recipient unsubscribes, their withdrawal of consent takes effect at the end of five business days after they send the request. From that point the person must be suppressed from future sends, across all your brands and tools, not just the list they unsubscribed from. Maintain a central suppression list and make sure agencies and contractors respect it. A one-click unsubscribe link, with an "unsubscribe from all" option rather than only granular preferences, is the standard to aim for.

Duty 4: Keep the content honest

The ACL applies to your subject lines, body copy, pricing and testimonials. Section 18 of the ACL prohibits misleading or deceptive conduct in trade or commerce, and the prohibition is broad: "final days" sales that run for weeks, "from $10" prices where only one size qualifies, and "free" offers with hidden conditions can each be misleading.

The ACL also prohibits false or misleading representations about goods and services under s 29, which covers claims about quality, price, benefits and the like. Make sure discounts are genuine, "from" prices are available at that price, conditions are stated in the email rather than buried in a link, and any testimonials are real and substantiated. There is a practical difference in the consequences, covered below: misleading conduct under s 18 attracts injunctions, damages and corrective orders, while false representations under s 29 can also carry pecuniary penalties.

Duty 5: Handle the personal information on your list properly

If you are an APP entity, the Australian Privacy Principles govern how you collect, use and disclose the personal information behind your list, including email addresses. You need a clear privacy policy, a collection notice at the point of sign-up, and reasonable security for the data, and you must honour deletion and unsubscribe requests. The Notifiable Data Breaches scheme also requires you to notify affected individuals and the Office of the Australian Information Commissioner when a data breach is likely to cause serious harm.

Even where the Privacy Act does not strictly apply, the same practices are expected by customers and by email platforms. Publish a privacy policy that explains what you collect, how it is used and whether you use tracking pixels or analytics; secure your email platform with multi-factor authentication and role-based access; and have a plan for handling a breach. If you send to recipients in the European Union or the United Kingdom, the GDPR and local cookie consent rules can apply to the same campaigns.

What happens if you get it wrong

ACMA has a range of enforcement tools under the Spam Act. It can issue infringement notices, with amounts that scale with the number of contraventions, and it can take senders to the Federal Court for civil penalties, which for a body corporate with a prior record can reach 10,000 penalty units a day, roughly $3.3 million at current values. It can also accept court-enforceable undertakings that commit the business to independent compliance reviews and reporting.

The recent enforcement record shows the scale of exposure:

Kmart paid a $1,303,500 infringement notice in 2023 for sending 212,471 marketing emails to customers who had previously unsubscribed, and gave a two-year court-enforceable undertaking.
DoorDash paid $2,011,320 in 2023 for sending more than one million texts and emails in breach of the rules.
Luxottica, owner of OPSM and Sunglass Hut, paid $1,512,500 in 2024 for marketing messages sent without consent and without a functional unsubscribe.
Pizza Hut Australia paid $2,502,500 in 2024 after sending more than 10 million marketing messages over four months.
Commonwealth Bank paid $3.55 million in 2023 and then a further $7.5 million in 2024 after sending more than 170 million emails that did not comply.

ACMA reported in late 2023 that businesses had paid more than $12.5 million in spam and telemarketing penalties in the preceding 18 months, and it has continued to issue notices since, including $4 million against Tabcorp in 2025. The pattern across these cases is rarely malice. It is systems failures: unsubscribed addresses left on lists, consent captured without records, and marketing content added to transactional emails.

There is also exposure beyond the Spam Act. False or misleading representations under the ACL can attract pecuniary penalties for a body corporate of up to $100 million, three times the benefit obtained, or 30% of turnover, whichever is greater, and misleading conduct under s 18 can expose you to injunctions, damages and corrective advertising orders. Separately, major email platforms can suspend or close accounts based on complaint rates alone, which can end a channel your business depends on overnight.

A practical compliance checklist

Work through each item with whoever owns your email program:

Consent: confirm every address on your list was captured with express consent you can evidence; record time, source and wording.
Forms: consent boxes unticked by default; separate opt-ins for separate streams; collection notice shown at sign-up.
Unsubscribe: one-click unsubscribe in every commercial email; requests actioned within five business days; central suppression list respected across brands and tools.
Identification: accurate sender name and contact details in every email, valid for at least 30 days.
Content: review subject lines, pricing and testimonials against the ACL before each campaign; state conditions in the email.
Privacy: privacy policy and collection notice in place; multi-factor authentication on the email platform; breach response plan documented.
Third parties: agency and platform agreements require Spam Act and ACL compliance and prohibit using addresses without valid consent.
Audits: test your unsubscribe link monthly and review campaigns against these rules quarterly.

When a lawyer should review your email program

A compliance review is worthwhile before you launch a list, when you scale up or start sharing data with agencies, and after any restructure or platform change. A lawyer can check your consent wording and records, review your privacy policy and collection notices against the Privacy Act, and draft the agency and supplier agreements that keep responsibility for compliance where it belongs. If ACMA contacts you with an investigation or a draft infringement notice, get legal advice before responding: the way you engage with the regulator can affect both the penalty and whether an enforceable undertaking is offered.

Why the unsubscribe log is the first thing ACMA asks for

Across the major penalties of the last few years, the recurring failure is record-keeping around consent and unsubscribes. Kmart, DoorDash and the Commonwealth Bank were all caught not because they deliberately spammed, but because unsubscribed or non-consenting addresses flowed back into campaigns through system and procedural gaps. The single most useful thing you can do this week is trace what happens after someone unsubscribes: confirm the request is suppressed within five business days, across every brand and tool you use, and start keeping a consent register you could produce to ACMA tomorrow. If you can show consent and an unsubscribe trail, you have answered the two questions every investigation starts with.