Unsolicited email in Australia and your obligations under the Spam Act

If your business sends marketing emails, text messages or instant messages, you are regulated by the Spam Act 2003 (Cth). The Act makes it unlawful to send an unsolicited commercial electronic message unless the recipient has consented to it, and every message you send must also identify you accurately and carry a working unsubscribe facility.

There is no size threshold. A one-person consultancy and a listed company face the same three duties, and the Australian Communications and Media Authority (ACMA) actively enforces them. In a recent action, ACMA found multiple breaches of spam and telemarketing laws by Tabcorp, which paid more than $2.7 million in penalties (acma.gov.au). This article sets out who the rules catch, the three duties you must meet, what it costs to get it wrong, and the practical steps to stay compliant.

Does the Spam Act apply to your business?

The Act catches a message only if it is all three of the following: an electronic message, commercial in purpose, and carrying an Australian link. If any element is missing, the Act does not apply, but the three tests are broad.

An electronic message

Under s 5 of the Act, an electronic message is a message sent over an internet or other carriage service to an email, instant messaging or telephone account. That covers email, SMS and MMS, and most in-app messaging. Ordinary voice calls are excluded and are dealt with under separate telemarketing rules.

A commercial purpose

Under s 6, a message is commercial if its purpose is to offer, advertise or promote goods, services, land, or a business or investment opportunity. Courts look at the content, how it is presented, and what the links and contact details lead to. A newsletter that pushes your products is commercial, even if it also contains helpful content. The Act carves out some "designated commercial electronic messages" in Schedule 1, but those still must comply with the identification rules.

An Australian link

Section 7 gives the Act its reach. A message has an Australian link if any of the following applies:

Originates in Australia: the sender is physically in Australia when the message is sent
Central management and control: the sending organisation's central management and control is in Australia
Access location: the message is accessed using a computer, server or device located in Australia
Recipient location: the recipient is in Australia when the message is accessed, or is an organisation carrying on business in Australia

In practice, if you are an Australian business emailing Australian customers, the Act applies to you. It still applies if you send through an overseas email platform: you are the sender who authorised the message, and the Australian link test focuses on you and your recipients, not your software provider.

Section 16 of the Act provides that you must not send a commercial electronic message to a person unless they have consented. Consent is defined in Schedule 2 and comes in two forms.

Express consent is the clearest and safest. It exists where someone actively agrees to receive your messages, such as ticking a box on a sign-up form, entering their email with a clear statement that they are subscribing to marketing, or confirming through a double opt-in email.

Inferred consent is narrower than most businesses assume. Under clause 2 of Schedule 2, consent can be inferred only from the recipient's conduct and their business or other relationships with you. Examples include a recent paying customer receiving product update emails, or a business contact whose conspicuously published work address suggests they expect related messages. Clause 4 is explicit that consent cannot be inferred from the mere fact that an address has been published. If you are relying on inference, ask whether a reasonable person in the recipient's position would expect your message. When in doubt, get express consent.

Two further points matter:

Burden of proof: under s 16(5), you bear the evidential burden of showing consent existed. If ACMA asks, good intentions are not enough. Record the date, the method, the source page and the exact consent wording for each subscriber.
Withdrawal of consent: under clause 6 of Schedule 2, if a recipient asks you to stop, their withdrawal of consent takes effect at the end of five business days after the request. From that point, further messages are unlawful.

The Act also targets list quality at the source. Part 3 prohibits supplying, acquiring or using address-harvesting software, and lists produced with it. Purchased or rented lists are dangerous for a different reason: the seller's consent does not transfer to you, so you cannot verify that the people on the list agreed to hear from your business.

Duty two: identify who you are in every message

Section 17 requires every commercial electronic message to clearly and accurately identify the individual or organisation that authorised the sending, and to include accurate information about how the recipient can readily contact them. The contact information must be reasonably likely to remain valid for at least 30 days after the message is sent.

This is why "no-reply" addresses cause problems. If your email comes from a no-reply address and the message gives the recipient no working way to contact you, you risk breaching s 17 even if you have consent. Use your business or trading name and a genuine reply address or telephone number. A physical street address is not required by the Act, although many businesses include one anyway as a trust signal.

Duty three: give every recipient a working unsubscribe

Section 18 requires every commercial electronic message to include a statement that the recipient can send an unsubscribe message to you, presented clearly and conspicuously. The address you give must be capable of receiving unsubscribe messages for at least 30 days after the message is sent, and must be legitimately obtained.

The practical points are:

Make it visible: a faint link in tiny grey text at the bottom of the footer may not satisfy the "clear and conspicuous" standard, and it invites complaints.
Act within five business days: because withdrawal of consent takes effect at the end of five business days, you must stop sending to that recipient within that window. Faster is better.
Suppress across every system: if you unsubscribe someone from one campaign but keep them on another list, you are still sending without consent.
Do not add friction: requiring a log-in, payment or further personal information to unsubscribe makes the facility harder to use and undermines the very purpose of s 18.

What happens if you breach the Spam Act

ACMA investigates complaints and conducts its own compliance checks. Its toolkit includes formal warnings, infringement notices, enforceable undertakings and proceedings in the Federal Court for civil penalties.

Civil penalties

Under Part 4 of the Act, the Federal Court can order pecuniary penalties for each contravention, capped by s 25. At the current penalty unit value of $330 (Crimes Act 1914 (Cth) s 4AA), the caps for a company that breaches the consent rules are up to $660,000 per day, rising to more than $3.3 million per day where the company has a prior record. Breaches of the identification and unsubscribe duties carry lower caps of $330,000 per day, or $1.65 million per day for repeat conduct. Smaller caps apply to individuals. The Court can also order compensation to people affected by the breach and strip out any financial benefit gained from it.

Infringement notices

For less serious matters, ACMA can issue infringement notices. For a body corporate, a notice relating to 50 or more contraventions of the consent rules can reach 1,000 penalty units, or $330,000 at the current unit value.

Consumer law still applies to your content

Misleading or deceptive conduct is prohibited by s 18 of the Australian Consumer Law, which is Schedule 2 of the Competition and Consumer Act 2010 (Cth). It applies to subject lines, claims and promotions, not just to your list practices. In ACCC v FitBit LLC [2023] FCA 1535, the Federal Court declared that FitBit had contravened s 18 by misleading consumers about their warranty rights through customer service representatives. Overstated results, fake urgency and buried conditions in your emails carry the same risk.

Beyond penalties, breaches hurt deliverability. Complaints and bounces push your domain toward spam folders, so a non-compliant list quietly stops working even before the regulator gets involved.

A practical compliance checklist

Before you send

Put these in place before your first campaign goes out:

Collect express consent with clear, specific wording at the point of sign-up
Store consent records: the date, the method, the source page and the exact wording
Link your sign-up form to a privacy collection notice that explains what you do with the data
Configure your platform's sender name, reply-to address and unsubscribe handling before your first campaign
Build your list through genuine sign-ups and customer relationships, not purchased or scraped data

Every message you send

Build these habits into every campaign you send:

Identify your business or trading name and give accurate contact details
Include a visible, functional unsubscribe link that works without a log-in or payment
Make sure the subject line and sender name are accurate and not misleading
Check offers and testimonials against the misleading and deceptive conduct rules in the Australian Consumer Law

Ongoing governance

Compliance is a running operation, not a one-off exercise. Keep these practices going:

Process unsubscribe requests within five business days and suppress addresses in every system
Audit your lists regularly and remove hard bounces and stale contacts
Train your team on how consent is captured, how complaints are handled and what records to keep
If you use an overseas email platform or support team, review the contract and make sure data handling and cross-border transfer are addressed
Keep your privacy policy current, because consent records and privacy practice are judged together

When you need a lawyer

A lawyer's role here is not to write your emails. It is to check the systems around them. That includes reviewing your sign-up forms and consent wording, assessing whether any inferred consent you rely on would survive scrutiny, drafting agreements with email platforms and data processors, and making sure your handling of subscriber data meets the Privacy Act 1988 (Cth). The Privacy Act applies to businesses with annual turnover above $3 million and to some smaller businesses that handle health information, trade in personal information or act as credit reporting bodies (s 6D), so consent records usually need to satisfy two regimes at once.

Legal help is also the point of entry when things go wrong. If ACMA contacts you about a complaint, issues an infringement notice or proposes an enforceable undertaking, advice before you respond can materially change the outcome, including the size of any penalty.

Every year, the same gap appears in ACMA's enforcement: businesses that genuinely believed they had permission, but cannot show it. Because s 16(5) puts the evidential burden on you, consent you cannot prove is consent you do not have in a regulator's eyes. That is the duty to focus on first. This week, audit how consent is captured and stored on your current sign-up forms, confirm the exact wording is on file for your existing subscribers, and check that every email template in your system carries a working unsubscribe. Those three checks cover the duties that ACMA actually investigates, and they cost nothing to run.