Online marketing in Australia and the legal obligations your business must meet

If your business markets online in Australia, you are not just running ads and sending emails. You are also carrying a set of legal obligations that sit across the Australian Consumer Law (Cth) (the ACL), the Spam Act 2003 (Cth), the Privacy Act 1988 (Cth) and state and territory gaming laws. These obligations apply whether you market through search ads, social media, email, SMS, influencers, competitions or customer reviews, and they apply whether or not you knew about them.

Getting them wrong can cost you penalties in the millions, regulator investigations and the trust of your customers. This guide sets out who those obligations apply to, what each duty actually requires, and what is at stake if you miss them. It is written for small and medium business owners who want to market confidently rather than cautiously.

Who must comply, and when the rules bite

Most of these rules do not depend on your size or turnover. If you promote goods or services to Australian customers, you are in scope. A few thresholds matter, though:

Australian Consumer Law: applies to any business acting in trade or commerce. There is no turnover threshold. If an ad, social post, landing page or checkout could mislead a reasonable customer, the ACL applies to you.
Spam Act 2003: applies to commercial electronic messages, including email, SMS and MMS, sent to Australian recipients, regardless of your size. A message that advertises, offers or promotes goods or services is commercial even if only part of a longer message is promotional.
Privacy Act 1988: generally applies to businesses with an annual turnover above $3 million, plus smaller businesses that fall within specific exceptions, such as handling health information or acting as a credit reporting body. If you are covered, the Australian Privacy Principles (APPs) govern how you collect, use and store personal information.
Telemarketing laws: apply to any business making phone calls for marketing purposes, with extra rules where a number is on the Do Not Call Register.
State and territory gaming laws: apply when your competition or giveaway is a lottery, meaning a game of chance, rather than a game of skill.

If your business is not yet covered by the Privacy Act, plan as if you will be. The small business exemption has been under sustained review, and building APP-compliant habits now is far cheaper than retrofitting them later.

Truthful advertising and substantiated claims

Section 18 of the ACL, which sits in Schedule 2 of the Competition and Consumer Act 2010 (Cth), is the backbone of Australian marketing law. It prohibits a person, in trade or commerce, from engaging in conduct that is misleading or deceptive or is likely to mislead or deceive. The test is whether the overall impression a reasonable customer takes from your advertising, in context, is false or misleading. A claim that is technically true in one place can still mislead when read together with your landing page, reviews and checkout flow.

Section 29 of the ACL goes further and bans specific false or misleading representations: about the standard, quality or value of goods or services, about price, about testimonials, and about sponsorship, approval or affiliation, among others. Both provisions reach what you omit as well as what you say. Burying a key condition in fine print does not cure a headline that misleads.

Before anything goes live, ask whether you can substantiate the claim. The ACCC can issue substantiation notices requiring you to prove claims about performance, quality, composition or price. If you cannot produce the evidence, do not run the claim.

Transparent pricing and honest discounts

Price is one of the most common sources of ACL trouble. Was/now and from-price advertising must reflect genuine savings. A reference price should be real, recent and representative of what you actually charged, with enough sales at that price to make the comparison fair. A from price should be a price you can genuinely sell at, not a headline figure for a product you have no stock of.

Display the total price customers will actually pay, and make conditions prominent: minimum terms, add-on fees, subscription renewals and auto-renewals. These belong before the customer commits, not behind a link or in footer fine print. If you sell online, remember that consumer guarantees under the ACL cannot be excluded, and that unfair terms in standard form consumer and small business contracts are void and can now attract civil penalties in their own right.

Under the Spam Act 2003, every commercial electronic message needs three things: consent, accurate sender identification and a working unsubscribe.

Consent is either express or inferred. Express consent, given by filling in a form, ticking a box or agreeing over the phone, is best practice. Inferred consent arises only in narrow cases, such as where a customer has knowingly given you their address and has an ongoing relationship with you that makes marketing reasonably expected. A one-off purchase is not enough to infer consent. You carry the burden of proving consent, so record who consented, when and how, and never send a message asking for consent, because that message is itself marketing. Do not buy email lists, and never use or supply address-harvesting software.

Every message must accurately identify you as the sender, using your name or ABN and correct contact details that remain accurate for at least 30 days. Each message must carry a clear unsubscribe facility that is honoured within 5 working days, costs nothing, functions for at least 30 days after sending, and does not require the recipient to log in, create an account or provide extra personal information. The ACMA's guidance sets these expectations out in practical terms.

Collecting and using customer data

If the Privacy Act applies to you, the Australian Privacy Principles set the standard for everything your marketing touches: analytics, pixels, contact forms, email lists, remarketing and payment pages. In practice, that means:

publishing a privacy policy that states what you collect, why, and how people can complain (APP 1);
collecting only what you need for your stated purpose (APP 3);
using and disclosing personal information only for the purposes you told people about (APP 6);
giving people a simple way to opt out of direct marketing (APP 7);
keeping the information secure against misuse and loss (APP 11).

Australia does not have a GDPR-style cookie consent law, but the OAIC treats identifiers that can be linked to a person, including IP addresses and some cookie and pixel identifiers, as personal information. If you use tracking, your privacy policy should describe it, and a cookie banner that explains what you do with visitor data is expected practice rather than optional polish. Direct marketing by email or SMS must also satisfy the Spam Act rules above, whatever your turnover.

Telemarketing and cold outreach

Telemarketing is its own regime. You must not call a number listed on the Do Not Call Register, except for the limited categories the Act exempts, such as charities, research calls and government bodies. Even for numbers not on the register, the Telemarketing and Research Calls Industry Standard 2017 limits calls to 9am to 8pm on weekdays and 9am to 5pm on Saturdays, and effectively rules out Sundays and public holidays without consent. Your scripts must not mislead, and callers must honour opt-out requests. If your cold outreach is by text message, the Spam Act applies instead.

Competitions, giveaways and influencer campaigns

Giveaways are a fast way to grow an audience, but if your promotion is a game of chance, state and territory laws require a permit before you run it. Each state operates its own regime: New South Wales, for example, requires an authority to conduct a trade promotion lottery under the Community Gaming Act 2018 (NSW). A game of skill generally does not need a lottery permit, but it still must not mislead. Before launch, decide which category your promotion falls into, check each state or territory where it will be offered, and lock down written terms covering eligibility, entry method, judging or draw mechanics, prize details and how winners are notified. Keep records of the draw.

Influencer and affiliate campaigns carry their own duties. The ACL has no sponsored-content safe harbour: an undisclosed advertisement can mislead, and you are responsible for claims made by creators on your behalf whether or not you wrote them. Give creators a written agreement covering deliverables, required disclosures such as an Ad or Sponsored label placed prominently, claims they may and may not make, approval rights, IP ownership and termination. Provide examples of acceptable disclosure wording for each platform, because a caption disclosure that works on one network may be invisible on another.

Reviews and testimonials

Under section 29 of the ACL, testimonials must be genuine. Posting or commissioning fake reviews, editing out material information, or suppressing negative feedback can each amount to a false or misleading representation. If you incentivise reviews, disclose that fact and keep the reviews honest and balanced. Respond to complaints promptly and keep records: a measured response to a false or defamatory review beats a reactive one every time.

What happens if you get it wrong

The enforcement stakes have risen sharply in recent years. For false or misleading representations under the ACL, courts can order a body corporate to pay a civil penalty of the greater of $100 million, three times the benefit obtained, or 30 per cent of adjusted turnover, and individuals up to $2.5 million. Misleading conduct itself under s 18 does not carry a pecuniary penalty, but the ACCC can seek injunctions, damages for consumers, compensation orders, non-party redress and adverse publicity orders, and the cost of responding to an investigation is significant on its own.

Under the Privacy Act 1988, a serious interference with privacy can attract a penalty for a body corporate of the greater of $50 million, three times the benefit, or 30 per cent of turnover, with lesser interferences capped at $626,000 (2,000 penalty units). The ACMA polices the Spam Act with infringement notices and court penalties: a body corporate faces up to $626,000 per day for a first offence and up to $3.13 million per day where it has a prior record. In March 2025, for example, Telstra paid a $626,000 penalty after the ACMA found it had sent close to 10.5 million text messages with non-compliant unsubscribe arrangements.

These figures are maximums, not starting points, and regulators regularly accept cooperation, enforceable undertakings and remediation. But the practical cost of a spam finding or a misleading advertising action usually exceeds the fine: deliverability suffers, ad accounts are restricted, and customer trust is hard to rebuild.

A working compliance checklist

Run through these items before any campaign goes live:

Map your channels and data flows: list every tool, including your email platform, CRM, analytics and pixels, and what each collects.
Review ads and landing pages together: assess the overall impression, and keep a substantiation file for every claim you make.
Check pricing: genuine reference prices, total price upfront, conditions prominent before checkout.
Set up consent records and unsubscribe handling: before you send the first campaign.
Publish a privacy policy that matches what you actually do: update it whenever you add a tool.
Get written terms for competitions and influencer campaigns: before they go live.
Brief your team: acceptable claims, disclosure wording, how to handle customer data, and when to escalate.

When to bring in a lawyer

A lawyer's value here is mostly preventive. A practitioner can review your ad claims and pricing against current ACCC guidance, draft a privacy policy and website terms that match your actual data flows, prepare competition terms that work across the states and territories, and put influencer and affiliate agreements in place. They can also help if a regulator comes knocking: deciding how to cooperate, what an enforceable undertaking should look like, and whether exposure can be reduced. If you are launching a national campaign or a new tracking setup, a short review before launch is usually far cheaper than fixing a breach after it.

The obligation that most often slips

The duty that most often slips in practice is the quiet one: being able to prove consent and substantiation later, when you need to. Regulators assume nothing. Under the Spam Act the burden of proving consent sits with you, and under the ACL a claim without evidence is a liability waiting to be found. The first action this week is to write down, for each marketing channel, exactly what consent you have on file and exactly what evidence backs your main claims. If you cannot answer both questions for every channel, fix that before your next campaign, not after a complaint arrives.