Every marketing email, SMS, or instant message your business sends is regulated by the Spam Act 2003 (Cth) (the Act). The Act does not ban marketing messages. It sets three conditions that every message must meet: the recipient must have consented, the sender must be accurately identified, and the recipient must have a working way to unsubscribe.
The regulator, the Australian Communications and Media Authority (ACMA), enforces these rules actively. Since mid-2022 it has issued infringement notices and accepted enforceable undertakings against large brands including the Commonwealth Bank, DoorDash, Kmart, Telstra and Ticketek, in amounts ranging from hundreds of thousands to millions of dollars. A business of any size that sends marketing messages needs to know where it sits under the Act, what the three duties require in practice, and what happens when they are missed. This article sets all of that out, starting with whether the rules apply to you at all.
Who the spam rules apply to
The Act regulates commercial electronic messages with an Australian link. A message is a commercial electronic message if, having regard to its content, its presentation, and the links or contact details it carries, its purpose (or one of its purposes) is to offer, advertise or promote goods, services, land, or a business or investment opportunity: s 6 of the Spam Act 2003 (Cth). The definition is broad. ACMA has treated an email telling customers about a business's own app or service features as commercial, because it promoted that service. If any part of a message is promotional in nature, the whole message is treated as commercial.
An electronic message is one sent over an internet or other carriage service to an address connected to an email account, an instant messaging account, a telephone account (which covers SMS and MMS), or a similar account: s 5 of the Act. Voice calls are excluded and are dealt with separately under the Do Not Call Register Act 2006 (Cth). The "Australian link" requirement means the rules bite where the message is sent from Australia, sent by a person in Australia, or sent to a recipient in Australia: s 7 of the Act.
Use these three questions to check whether a planned send is caught:
- Channel: Is it an email, SMS, MMS or instant message? If yes, it is an electronic message. A voice call is not.
- Content: Does it promote goods, services, land, or a business or investment opportunity, even as one purpose among several? If yes, it is commercial.
- Reach: Is the message sent from Australia, by an Australian sender, or to an Australian recipient? If yes, it has an Australian link.
If you answered yes to all three, the message must satisfy the three duties below.
Duty 1: Get consent before you send
A person must not send a commercial electronic message unless the recipient consented to receiving it: s 16 of the Act. Consent under the Act is either express or inferred: Schedule 2, clause 2.
Express consent
Express consent is given when a person takes an active step indicating they want to receive your messages, knowing what they will receive. The clearest example is ticking a checkbox that is unticked by default, next to a statement such as "email me news and offers". A person who simply buys from you once has not given express consent.
Because the sender bears the evidential burden of showing consent if a complaint is made or ACMA investigates (s 16(5) of the Act), you should keep a record of how and when each consent was given: the wording the person agreed to, the date, and the source of the contact. A well-kept consent register is the first document a lawyer will ask for if ACMA comes calling.
Inferred consent
Consent can also be inferred from a person's conduct and their business or other relationship with you: Schedule 2, clause 2 of the Act. Inferred consent is narrower than many businesses assume. ACMA's guidance indicates that consent may be inferred where someone has subscribed to a service, holds an account or is a member, and the marketing is directly relevant to that relationship. A bank telling an existing saver about a higher-interest savings account is a classic example. The same bank trying to sell that saver insurance would generally not be covered, and neither would marketing to someone who made only a one-off purchase.
Two further limits matter. First, consent cannot be inferred from the mere fact that an address has been published, for example on a website or directory; there is a narrow exception for addresses conspicuously published in connection with a person's role: Schedule 2, clause 4 of the Act. Second, once a person has unsubscribed, any continued sending is a breach, because their consent has been withdrawn.
In practice, treat express consent as the default for any campaign and rely on inferred consent only for messages that are genuinely tied to an existing relationship. The safest approach is to build consent capture into every point where you collect a contact: sign-up forms, checkout pages and event registrations.
Duty 2: Identify who authorised the message
Every commercial electronic message must clearly and accurately identify the individual or organisation that authorised its sending, and must include accurate information about how the recipient can readily contact that person or organisation: s 17 of the Act.
Two details are easy to get wrong. First, the identification must be accurate: the sender name should be one the recipient recognises, not a department or a brand they have never dealt with. Second, the contact information must be reasonably likely to remain valid for at least 30 days after the message is sent. If your reply address bounces, your inbox is full, or your phone number changes within that window, the message is non-compliant even if everything else was right. Review sender details before each campaign and keep your contact information current.
Duty 3: Provide a working unsubscribe facility
Every commercial electronic message must include a functional unsubscribe facility: s 18 of the Act. The message must carry a statement, presented clearly and conspicuously, telling the recipient they can use an electronic address in the message to send an unsubscribe request. That address must be capable of receiving unsubscribe messages for at least 30 days after the message is sent.
The timing rule is where most businesses fall short. A withdrawal of consent takes effect at the end of five business days after the recipient's request: Schedule 2, clause 6 of the Act. In other words, once someone asks to be removed, you have five business days to stop sending to them. After that, every further message is unsolicited and breaches s 16, even if the original subscription was valid.
ACMA has made unsubscribe compliance its priority enforcement area. In 2022 it cited research finding that six in ten Australians were still contacted by businesses after they had unsubscribed. Enforcement has followed. Kmart paid a $1,303,500 infringement notice after sending 212,471 emails to customers who had previously unsubscribed, and also entered a court-enforceable undertaking requiring an independent review of its compliance systems. The Commonwealth Bank paid $3.55 million in 2023 partly because its unsubscribe process required customers to log in to their accounts. A working unsubscribe facility should therefore be tested before every send: the link must work, the removal must be actioned quickly, and the process must not put barriers in front of the recipient.
Messages that are exempt from the consent and unsubscribe rules
Certain messages are designated commercial electronic messages and are exempt from the consent and unsubscribe duties: Schedule 1 of the Act. The main categories are:
- Factual messages: a message that consists of no more than factual information, plus only the name, logo and contact details of the sender, author or sponsor, where the message would not be commercial without that added information.
- Government, political and charitable messages: a message authorised by a government body, a registered political party or a registered charity, where that body is the supplier of the goods or services the message relates to.
- Educational messages: messages authorised by an educational institution in connection with its courses or services.
The exemptions are narrower than they look. An email that promotes a product is not factual just because it also states facts, and a charity selling goods commercially is not exempt merely because it is a charity. Note also that designated messages must still comply with the sender identification duty in s 17, even though they are freed from the consent and unsubscribe rules. If you are relying on an exemption, it is worth having a lawyer confirm the message fits before you send.
What happens if you breach the rules
ACMA's enforcement toolkit covers the full range from warnings to court proceedings. It can issue a formal warning, give an infringement notice, accept a court-enforceable undertaking, or take the matter to the Federal Court, which can order pecuniary penalties and injunctions.
Penalties and infringement notices
The Federal Court can order a pecuniary penalty for each contravention of a civil penalty provision, capped by the Act: ss 24 and 25. For a body corporate with no prior record, the cap is 100 penalty units for a single contravention, rising to a 2,000 penalty unit aggregate where two or more contraventions occur on the same day. With a prior record, the caps increase to 500 penalty units per contravention and a 10,000 penalty unit daily aggregate. Penalty units are currently worth $313 each (from 1 July 2023), so the 2,000 unit figure is about $626,000 and the 10,000 unit figure about $3.13 million.
Infringement notices are set by a penalty unit table in Schedule 3 of the Act, and the amounts ACMA has actually levied show how seriously it takes breaches: Telstra paid $626,000 in 2025, DoorDash $2,011,320 in 2023, Kmart $1,303,500 in 2023, and the Commonwealth Bank $3,552,000 in 2023 and a further $7,502,610 in 2024. Latitude Finance paid $3,960,000 in 2026. ACMA reported in 2023 that businesses had paid more than $12.5 million in spam and telemarketing penalties over the preceding 18 months.
Court-enforceable undertakings
Alongside a financial penalty, ACMA routinely accepts court-enforceable undertakings under Part 6 of the Act. These commit the business to compliance improvements, typically an independent review of its systems by a consultant, reporting obligations to ACMA, and sometimes staff training. Breaching an undertaking can itself lead to court enforcement. For most businesses, an undertaking will be offered after an investigation finds breaches, and negotiating its scope is a matter for a lawyer.
Address harvesting and how liability spreads
Separate rules prohibit the supply, acquisition and use of address-harvesting software and harvested-address lists: ss 20 to 22 of the Act. Buying a "leads list" that was scraped from the internet, or using software that collects addresses, is prohibited even if you never send a message yourself. Liability also spreads: it is a contravention to aid, abet, counsel or procure a breach, or to be knowingly concerned in one. That means the marketing agency or freelancer running your campaigns can be liable alongside you, and you can be liable for what they do on your behalf.
A compliance checklist for your next campaign
Before you send any campaign, run through these eight checks in order:
- Classify the message first: if it promotes anything, treat it as a commercial electronic message.
- Confirm consent for each recipient: express consent is safest; record the date, wording and source of every consent.
- Don't stretch inferred consent: a one-off purchase or a published address does not cover cross-sells or unrelated products.
- Check the sender details: accurate name and contact information, valid for at least 30 days.
- Test the unsubscribe link: it must work, be easy to find, and accept requests for at least 30 days after sending.
- Action unsubscribes within five business days: automate the removal and audit it regularly.
- Avoid purchased or scraped lists: address-harvesting software and harvested lists are prohibited under the Act.
- Keep records: a consent register and a log of unsubscribe requests are your first line of defence in an investigation.
When a lawyer should be involved
Most of the compliance work above can be done in-house, but a lawyer adds value at specific points. Before you launch a campaign that relies on inferred consent or an exemption, a lawyer can confirm the position in writing rather than leaving you to guess. If you buy a marketing list or engage an agency to send on your behalf, a lawyer should review how the list was compiled and how liability is allocated in the contract. And if ACMA contacts you, whether with an information request, a formal warning or an investigation, it is usually worth engaging a lawyer before you respond. The difference between an infringement notice and a negotiated outcome, or between a narrow and a sweeping enforceable undertaking, is often made in the first exchanges with the regulator.
Start with your unsubscribe process
The duty most often missed is not consent capture, which most businesses think about, but honouring unsubscribe requests. It is the area ACMA has expressly prioritised, it is where the largest recent penalties have landed, and it is easy to get wrong: a broken link, a removal that takes a fortnight, or a marketing database that was not updated when someone opted out. The first step to take this week is to send a test email to yourself, click the unsubscribe link, and time how long it takes for a further message to be blocked. If the answer is more than five business days, you have found the gap that the ACMA is looking for. Fix it before you send another campaign, and if the process involves systems you do not fully control, have a lawyer review how it is documented.