Running a subscription business in Australia and your legal obligations

If you sell software, content, memberships or products on a recurring basis, every subscriber is entering into a continuing contract with you, and a cluster of Australian legal obligations attaches to that arrangement from day one. The centrepiece is the Australian Consumer Law (Cth) (ACL), which reaches virtually every subscription business regardless of size. Around it sit privacy law for many operators, plus payment system rules, spam rules and GST obligations that apply depending on your turnover and how you bill.

The good news is that the duties are predictable, and most are satisfied by getting your terms, billing processes and record keeping right before you launch. This guide sets out who the obligations apply to, the thresholds that bring a business within scope, the specific duties you must meet, and what is at stake if you miss them.

Who these obligations apply to

Not every rule applies to every subscription business. The main triggers to check against your own situation are:

• Misleading conduct: the prohibition on misleading or deceptive conduct in s 18 of the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) applies to anyone acting in trade or commerce, so it catches every subscription business from the first day.
• Unfair contract terms: the unfair terms regime applies to standard form consumer contracts and small business contracts. A small business contract is one where a party employs fewer than 100 people or has turnover under $10 million, so the regime captures many more businesses than most operators assume.
• Consumer guarantees: the guarantees in the ACL apply when you supply goods or services to a consumer, which includes an individual acquiring for personal, domestic or household use.
• Privacy law: the Privacy Act 1988 (Cth) generally applies once your annual turnover exceeds $3 million, and to some smaller businesses in particular sectors or activities.
• GST: you must register for GST once your GST turnover reaches $75,000 or more, on the ATO's rules.
• Payments and marketing: the payment scheme rules that apply to your billing method, and the consent and unsubscribe rules for email and SMS marketing, apply regardless of size.

If you are a solo founder selling a small subscription, your obligations start with the ACL and the marketing and payment rules. Once you scale past the privacy and GST thresholds, a second layer of duties switches on.

Don't mislead subscribers

The core duty is simple to state and easy to breach: your advertising, pricing, trial offers, renewal notices and terms must not be misleading or deceptive, or likely to mislead or deceive, under s 18 of the ACL.

For a subscription business the recurring trouble spots are the fine print around offers. A "free trial" that silently converts to a paid plan, a headline price that excludes compulsory fees, a discount that applies only to the first billing cycle, or a renewal notice that buries the new price, are all claims about the deal the customer is actually getting. The ACL also separately prohibits false or misleading representations about goods, services, pricing and promotional offers under s 29, which carries its own penalties.

The practical standard is that the information a reasonable subscriber would rely on, such as what they will be charged, when, and for what, must be accurate and presented where it will actually be seen, not only in a document they are unlikely to open.

Keep your standard terms fair

Under s 23 of the ACL, a term of a standard form consumer or small business contract is void if it is unfair. A term is unfair when it causes a significant imbalance in the parties' rights and obligations, is not reasonably necessary to protect your legitimate interests, and would cause detriment to the subscriber if relied on. A term that penalises the customer but not you, or that lets you change the price or service at will with no corresponding customer right, is the classic shape of an unfair term.

The regime bites because online subscription sign-ups are standard form contracts in practice. The customer is presented with terms on a take-it-or-leave-it basis, which is exactly the situation the regime was designed to catch. A court can declare an unfair term void, and since late 2023, proposing or relying on an unfair term in a standard form consumer or small business contract is itself a contravention that can attract a pecuniary penalty under s 224 of the ACL.

Two drafting consequences follow. First, terms that let you change prices, features or the service generally need notice periods, and the customer needs matching rights to cancel or exit. Second, review your templates against the regime before you launch rather than after a regulator or a customer's lawyer points at a clause.

Honour the consumer guarantees

The ACL implies a set of non-excludable guarantees into consumer transactions, and subscription supply is no exception. Services, including software platforms, streaming and professional memberships, must be rendered with due care and skill under s 60, and reasonably fit for the purpose the customer made known under s 61. Physical goods in a subscription box must be of acceptable quality under s 54, meaning they are fit for their common purposes, free from defects, safe and durable, as a reasonable consumer would regard as acceptable.

Section 64 of the ACL makes any term void to the extent it purports to exclude, restrict or modify these guarantees. Your terms cannot contract out of them, and stating that you do is worse than pointless because it is itself a misleading statement about the customer's rights. What you can do is describe your remedies accurately, such as how refunds, credits or replacements work when a guarantee is not met, provided those remedies do not override the guarantees themselves.

Be transparent about renewals, cancellation and cooling-off

Australian law does not impose a blanket ban on auto-renewing subscriptions. The obligation is transparency and fairness: tell subscribers when the renewal happens, what they will pay, and how to cancel, and do not design the cancellation path so it is harder to leave than it was to join.

Cooling-off rights are not universal. They attach in specific situations rather than as a general right to change your mind on an online purchase. One situation where they do apply is an unsolicited consumer agreement, such as a subscription sold through door-to-door selling or a cold call, where the consumer can terminate within ten business days under s 82 of the ACL. For an ordinary online sign-up, there is usually no statutory cooling-off period, so whatever you promise in your terms, such as a money-back window, is what governs. State your position in plain English and make the process match the promise.

Protect subscriber personal information

If your subscription collects names, emails, payment details or usage data, and your annual turnover exceeds $3 million, the Privacy Act 1988 (Cth) applies and the Australian Privacy Principles (APPs) govern how you collect, use, store and disclose that information. The small business exemption means businesses with turnover of $3 million or less are generally outside the Act, but the exemption does not apply to every small business, including health service providers, businesses that trade in personal information and certain other categories.

Even where the exemption applies, your obligations are not zero. A clear, accessible privacy policy explaining what you collect and why is expected practice, and the Notifiable Data Breaches scheme creates notification duties for those inside the Act when a data breach is likely to result in serious harm. The consequences of getting this wrong are now substantial, with civil penalties for serious or repeated interference with privacy reaching up to $50 million for a body corporate, or three times the benefit obtained, or 30 per cent of adjusted turnover, as set out in the OAIC's regulatory guidance.

Authorise recurring payments properly

Recurring billing needs a clear legal basis for each charge. For direct debits from bank accounts, the customer's authority should be documented in a direct debit request that sets out the amount, frequency and how the authority can be revoked, and your bank's scheme rules will require you to handle failed payments and disputes in a defined way. For card-based billing, the card scheme rules apply to recurring transactions, and the ePayments Code administered by ASIC sets standards for many consumer payment products.

Your terms should also cover the operational realities: what happens when a payment fails, how many retries you will attempt, whether late fees apply, and how a customer cancels the payment authority. A customer who cannot work out how to stop being charged will complain, and a pattern of hard-to-cancel billing attracts regulator attention under the misleading conduct and unfair terms provisions.

Comply with email and SMS marketing rules

Marketing emails and SMS to subscribers are commercial electronic messages under the Spam Act 2003 (Cth). Each message needs the recipient's consent, must accurately identify you as the sender, and must include a functional unsubscribe facility that you honour promptly. Consent can be express or inferred, but transactional messages about a subscription they already hold are different from marketing messages, and relying on one to send the other is a common mistake. The unsubscribe link in every marketing message is the cheapest compliance control you will ever build.

Register for GST at the threshold

Once your GST turnover reaches $75,000, you must register for GST and generally do so within 21 days of becoming required. For a subscription business, GST turnover includes the value of your recurring supplies, so a growing subscriber base can cross the threshold faster than annual revenue projections suggest, and a business that fails to register on time can owe GST on supplies made before it registered, plus penalties.

Registered businesses must charge GST on taxable subscription supplies, display GST-inclusive pricing to consumers, and issue tax invoices for business customers. Cross-border subscriptions, whether you are selling to overseas customers or buying platform services from overseas suppliers, add another layer of complexity where a tax professional's advice is worth the cost.

Keep records of how subscribers accepted your terms

Online acceptance, such as a tick box or an "I agree" button at checkout, is generally effective when the terms are available to read and the customer has a genuine opportunity to do so. What protects you later is the record: keep a timestamped log of which version of the terms each subscriber accepted, when they accepted it, and what plan and price applied at that time. Version control matters because a subscriber who joined under one set of terms cannot later be bound by a materially different set, and your records are the evidence of what was agreed.

What happens if you get it wrong

The consequences of non-compliance range from void terms to seven-figure penalties, and several regulators can act against the same conduct:

• ACL penalties: under s 224 of the ACL, contraventions of the unfair terms provisions or the unfair practices provisions can attract pecuniary penalties for a corporation of up to $100 million, or three times the benefit obtained, or 30 per cent of adjusted turnover, with up to $2.5 million for an individual. Misleading conduct under s 18 can draw injunctions, damages and other court orders even though it is not itself a penalty provision.
• Privacy penalties: serious or repeated interference with privacy can attract up to $50 million for a body corporate, or three times the benefit, or 30 per cent of adjusted turnover, with the OAIC also able to accept enforceable undertakings and issue infringement notices.
• Consumer guarantees: a court can order refunds, replacements or compensation, and your terms cannot limit that exposure.
• GST: failing to register when required means the ATO can assess GST on supplies back to the date you should have registered, with penalties and interest.
• Reputation and chargebacks: complaints, chargebacks and regulator inquiries are themselves a cost. A subscription business with a pattern of disputed renewals spends its time defending charges rather than growing.

A practical compliance checklist

Work through these items before launch, and again before every renewal cycle:

• Confirm your marketing claims, trial terms and renewal disclosures are accurate and visible before checkout.
• Review your terms against the unfair contract terms regime, including the small business thresholds of fewer than 100 employees or under $10 million turnover.
• Check your remedies and refunds language against the non-excludable consumer guarantees.
• Document how renewals, price changes and feature changes are notified, with notice periods and customer exit rights.
• Publish a privacy policy and, if you are inside the Privacy Act, comply with the APPs and the Notifiable Data Breaches scheme.
• Put a direct debit or card billing authority in place that explains amounts, frequency and how to cancel.
• Add a functional unsubscribe mechanism to every marketing email and SMS.
• Register for GST once turnover reaches $75,000, and display GST-inclusive prices to consumers.
• Keep versioned terms and timestamped acceptance records for every subscriber.

Where a lawyer can help

The drafting work that most subscription businesses get wrong is the terms themselves: clauses that overreach on liability, auto-renewal and unilateral variation, or that describe customer rights inaccurately. A commercial lawyer will review your terms against the unfair contract terms regime and the consumer guarantees, redraft the clauses that put you at risk, and check that your billing authority, privacy policy and marketing consent flows line up with your actual processes. If you are near the privacy or GST thresholds, or you sell across borders, that review should happen before you scale rather than after a regulator or a subscriber's lawyer finds the gap.

The threshold that catches subscription businesses by surprise

The obligation most often missed is not any single clause but the small business unfair contract terms threshold itself. Because the regime now covers contracts where a party employs fewer than 100 people or has turnover under $10 million, a mid-sized subscription business that thought it was too large for the regime is squarely inside it, and the same business may sit just below the $3 million privacy threshold and the $75,000 GST threshold without realising how quickly subscription revenue crosses them. The first action this week is to pull out your subscription terms and ask three questions: what can I change unilaterally, what happens when the customer wants out, and what do my records show each subscriber actually agreed to. Answering those three questions will show you exactly where your obligations currently sit.