Email marketing in Australia and the legal obligations for your business

Every marketing email your business sends is regulated by federal law, whether you run a two-person consultancy or a national retailer. Three regimes overlap. The Spam Act 2003 (Cth) governs unsolicited commercial email. The Privacy Act 1988 (Cth) governs what you do with the addresses and personal information you collect. And the Australian Consumer Law (the ACL), which sits in Schedule 2 of the Competition and Consumer Act 2010 (Cth), stops you misleading the people you email.

These are not optional extras. The Australian Communications and Media Authority (ACMA), which enforces the Spam Act, has made spam one of its compliance priorities. In the past few years it has secured payments of $7.5 million from the Commonwealth Bank, $2.5 million from Pizza Hut Australia and $1.5 million from Luxottica for email and SMS marketing failures. This guide sets out who the rules apply to, the five duties that come with every campaign, what happens if you get them wrong, and a checklist you can act on this week.

Who the rules apply to

The three regimes bite at different points, and one of them applies to every business regardless of size:

Spam Act: applies to any person or business that sends a commercial electronic message with an Australian link, which broadly means a message sent to an Australian electronic address or from an Australian connection. There is no turnover threshold or employee headcount test. A newsletter sent from your laptop is captured the same way a bank's campaign is.
Privacy Act: applies to most businesses whose annual turnover for the previous financial year was more than $3 million. Smaller businesses are generally exempt from the Australian Privacy Principles (APPs), although exceptions apply, for example if the business trades in personal information or provides health services. Most email marketing platforms are not themselves exempt, and the way they process your lists can pull you into obligations indirectly.
ACL: applies to conduct "in trade or commerce", which captures virtually all marketing to customers. It does not depend on business size at all.

If you send marketing emails at all, the Spam Act and the ACL apply to you. The Privacy Act applies unless you are a small business that falls outside the carve-outs. That is the starting point for working out your obligations.

Section 16 of the Spam Act 2003 (Cth) provides that you must not send an unsolicited commercial electronic message. The key defence is consent: the rule does not apply if the recipient consented to receiving the message. In practice, consent is the whole game in Australian email marketing, because the ACMA has made clear it expects businesses to be able to demonstrate consent, not simply assert it.

The Act recognises two kinds of consent. Express consent is a clear, active opt-in: the customer ticks an unchecked box, submits a subscribe form, or otherwise asks to receive your emails. Inferred consent is limited and situational, for example an existing customer relationship where marketing is reasonably expected. Most small businesses should aim for express consent for every address, because it is easier to prove and harder for a regulator to challenge.

Two things the Act and the ACMA are firm about. First, consent cannot be inferred just because an address was published, for example on a website or a directory. Second, pre-ticked boxes do not count. Consent has to be active, which means the customer does something, not fails to untick something.

If a recipient complains to the ACMA, the burden of showing consent will come back to you. Log the date, the method and the source of each opt-in, for example "web form on checkout page, 12 March 2025". Most email platforms record this automatically, but only if you capture the consent through them rather than importing a spreadsheet.

Consent is not transferable. The ACMA's position is that consent given to one business does not carry over to a business that buys or rents the list, which means purchased lists almost never come with valid consent for your campaigns. There is also the risk that a bought list is full of harvested addresses, and the Spam Act separately prohibits the supply and use of address-harvesting software and harvested-address lists. Build your own list through genuine opt-ins and you avoid the problem entirely.

Duty two: identify yourself in every message

Section 17 of the Spam Act requires every commercial electronic message to clearly and accurately identify the individual or organisation that authorised the sending of the message, and to include accurate contact details. That information has to be reasonably likely to remain valid for at least 30 days after the message is sent.

In practice this means your trading name in the from line and the body, plus a working way to contact you such as a reply address or a business address. An unidentifiable sender also hurts deliverability, because recipients mark unknown senders as spam and the platforms learn to filter you.

Duty three: give every recipient a working unsubscribe

Section 18 of the Spam Act requires every commercial electronic message to include a statement, presented clearly and conspicuously, that the recipient can send an unsubscribe message to an electronic address set out in the message. That address must be reasonably likely to keep working for at least 30 days after the message is sent.

The unsubscribe link has to be visible and functional, and it has to be honoured. The Act does not prescribe a set number of days, but the ACMA expects opt-outs to be processed quickly and across all of your marketing lists and platforms, not just the list the message came from. Luxottica paid $1.5 million in April 2024 after the ACMA found it had sent more than 91,000 emails without a functional unsubscribe facility. Test your unsubscribe link before every campaign, and make sure your platform applies opt-outs everywhere, including any lists you maintain in a spreadsheet or CRM.

Duty four: handle the personal information you collect properly

If the Privacy Act applies to you, the APPs shape how you can collect and use email addresses. Four of them matter most for email marketing.

Tell people what you are collecting and why

Australian Privacy Principle 5 requires a collection notice at the point of collection: a short statement of what you are collecting, why, how the person can access and correct it, and how they can complain. For a sign-up form, that is usually a short notice plus a link to your privacy policy, which APP 1 requires you to maintain and make available.

Respect the direct marketing limits

Australian Privacy Principle 7 restricts direct marketing using personal information. In general, you can only use personal information for direct marketing where the individual would reasonably expect it, and you must give them a simple way to opt out. The opt-out rules are not soft law: failing to provide a simple opt-out, or failing to give effect to an opt-out request within a reasonable period, is itself a civil penalty provision under section 13K of the Privacy Act.

Keep the data secure and report breaches

Australian Privacy Principle 11 requires you to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. If a breach occurs and there are reasonable grounds to believe it is an eligible data breach, Part IIIC of the Privacy Act requires you to prepare a statement and give it to the Office of the Australian Information Commissioner, and to notify affected individuals, as soon as practicable. An email list lost through a compromised marketing account is exactly the kind of event this regime is aimed at.

Know where your email platform stores data

Australian Privacy Principle 8 makes you accountable for personal information you disclose to an overseas recipient. Many email platforms store data in the United States or elsewhere offshore, so check where your provider processes data and make sure your privacy policy explains it. If you rely on a platform that has committed to APP-equivalent protections, document that reliance.

Duty five: don't mislead, and show the real price

Section 18 of the ACL provides that a person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive. That applies to subject lines, body copy and prices. A subject line that says "Last chance" when the sale runs for another month, or an offer that buries a significant condition in fine print, can be misleading conduct. The ACMA flagged misleading spam messages as a key compliance issue for 2024 to 2025, so regulators are looking at this.

Pricing has its own rule. Section 48 of the ACL requires that when you state a component of the price of goods or services ordinarily acquired for personal, domestic or household use, you must also state the single total price in a prominent way as a single figure. That is the anti drip-pricing rule: you cannot quote $49 and add a booking fee later in the email unless the total is shown up front. There is a parallel offence provision in section 166 of the ACL, so this is not just a civil concern.

What happens if you get it wrong

The ACMA has a graduated enforcement toolkit under the Spam Act. It can issue formal warnings, issue infringement notices, accept enforceable undertakings and take civil penalty proceedings in the Federal Court. The statutory caps in section 25 of the Spam Act are expressed in penalty units: for a body corporate with no prior record, up to 100 penalty units per contravention of the no-spam rule, capped at 2,000 penalty units in a day, and for repeat offenders up to 500 penalty units per contravention, capped at 10,000 penalty units in a day.

The recent outcomes show how expensive this can get in practice:

The Commonwealth Bank paid $7.5 million in October 2024 after an ACMA investigation found it sent more than 170 million marketing emails that did not comply with the spam rules between November 2022 and April 2024.
Pizza Hut Australia's operator paid $2,502,500 in May 2024 for sending more than 10 million texts and emails without adequate consent.
Luxottica, owner of the OPSM, Oakley and Sunglass Hut brands, paid $1,512,500 in April 2024, including for emails sent without a functional unsubscribe.
Binance Australia paid $2 million in December 2022 and Sportsbet paid $3.7 million in penalties and refunds in February 2022 for spam breaches.

On the privacy side, the OAIC can investigate complaints, and the courts can impose civil penalties for interferences with privacy, capped at 2,000 penalty units for a contravention of section 13H of the Privacy Act and significantly higher for serious or repeated interferences under section 13G. The ACCC can also take action for misleading or deceptive conduct, including seeking injunctions, penalties and compensation orders.

Beyond the fines, non-compliance has commercial costs: complaints to the ACMA and OAIC can trigger audits of your whole marketing operation, and poor deliverability quietly strangles a channel that should be your cheapest way to reach customers.

A compliance checklist for your next campaign

Work through this before you hit send:

Consent: confirm every address on the list has consent, preferably express, and that you can show when, how and where it was given.
Sign-up forms: use unchecked boxes with clear wording, never pre-ticked boxes, and record the consent in your platform.
Sender identification: include your trading name and a working contact method in every email.
Unsubscribe: test the link, keep it visible, and make sure opt-outs apply across all lists and platforms.
Collection notice: show what you are collecting and why at every sign-up point, with a link to your privacy policy.
Content: keep subject lines accurate, show any conditions clearly, and state the single total price.
Segmentation: only send what people opted into, and use a preference centre where subscribers want control over frequency or topics.
Data breach plan: know who investigates a compromised account, and when the OAIC and affected individuals must be notified.
Review: spot-check templates, footer details and consent wording every few months, and again whenever you change platforms.

When to bring in a lawyer

A lawyer's value here is in the setup and the incident, not in reviewing every campaign. Get help drafting a privacy policy and collection notice that match how your business actually collects and uses data, and with reviewing your consent capture and unsubscribe flows before you launch a serious email program. If you run giveaways or lead magnets, competition terms and conditions need to comply with state and territory trade promotion laws, which a lawyer can draft properly. And if the ACMA or the OAIC comes knocking, or you have a data breach involving your list, legal input early can stop a compliance problem becoming a penalty.

The duty that catches Australian businesses most often is not sending the email itself. It is proving consent afterwards. The ACMA published a Statement of Expectations on consent for direct marketing in July 2024, and the consistent thread is that businesses must be able to demonstrate consent, with records, not just claim it in a privacy policy. So the first action this week is a consent audit: export your list, check where every address came from, and delete anything you cannot account for. Turn off every pre-ticked box, make your subscribe forms log consent automatically, and treat every address without a provenance as unsolicited. If you cannot show where an address came from, the safest assumption under the Spam Act is that you may not email it.