email · 8 september 2026 · 8 min read

the Spam Act and email marketing in Australia: what you can actually send

Most guidance on Spam Act email marketing in Australia is three bullet points and a warning about buying lists. The warning points at the wrong risk. ACMA publishes every spam enforcement outcome it reaches, and across the last four years not one of the businesses it named is described as buying a list. They were established brands emailing their own customers, and the thing that appears most often in the breach descriptions is the unsubscribe link.

Before anything else: this is a plain-English summary, not legal advice. We are a marketing company, not a law firm. Every claim below links to the regulator's own page or to the Act itself so you can check it, and anything with real money riding on it deserves a conversation with the ACMA or your own adviser.

what the Spam Act requires of email marketing in Australia

ACMA's guidance reduces to three duties, and they apply in order. Consent first. Then every message you send has to identify you and let people leave.

• Consent, before the first message. ACMA is blunt about the burden: "Under the Spam Act, it's up to you to prove that you have a person's consent."
• Accurate sender information. The message must identify your business by its correct legal name, or your name plus your ABN, with contact details that stay correct for at least 30 days after you send it.
• A working unsubscribe in every commercial message, honoured within five business days.

Two details in the consent rule catch people out. The first is that you cannot email someone to ask for their consent, because that email is itself marketing. The second is that paying someone else to send for you does not move the duty: ACMA states that even if someone else sends your messages, you still need consent for every person who receives them.

the consent rule most Australian marketing advice gets wrong

Ask around and you will be told that any business email address published on a website is fair game in Australia. That belief comes from a real provision, and it is much narrower than it sounds.

Schedule 2 of the Spam Act 2003 starts from a flat no. Consent "may not be inferred from the mere fact that the relevant electronic address has been published." The exception that follows, headed "conspicuous publication", then attaches conditions. The address has to belong to a person in a work role. It has to have been conspicuously published. It has to be reasonable to assume it was published with that person's agreement. The publication must not sit next to any statement that they do not want unsolicited commercial messages. And even when all of that holds, the consent only covers messages that are "relevant to the work-related business, functions or duties" of the person you are writing to.

That last condition does most of the work. A published address does not buy a general licence to pitch. It buys permission to write to someone about their job, so the test is not whether you found the address but whether your offer belongs in that person's working inbox.

Worth noticing too: ACMA's own current plain-English page on avoiding spam does not lead with conspicuous publication at all. It describes inferred consent as something that arises from "a provable, ongoing relationship with your business", where the marketing is directly related to that relationship. It uses a bank telling an existing savings customer about a higher-interest savings account as the example, and says the same inference would not stretch to selling that customer insurance. Then it adds the line that surprises most small businesses: inferred consent "does not cover sending messages after someone has just bought something from your business."

A single purchase is not a subscription. If you want to email customers after they buy, ask at the counter or the checkout and record that they said yes.

what ACMA actually fines businesses for

ACMA publishes its spam and telemarketing investigation outcomes year by year, with the company, the breach and the amount. We read every spam outcome published from 2023 to date. Eighteen of them.

Not one is described as buying a list, scraping addresses or emailing strangers. Every named business had a relationship with the people it was messaging. Across the breach descriptions, consent appears in sixteen of the eighteen, a missing or broken unsubscribe facility in fourteen, and inadequate sender contact information in five. Those are our counts from ACMA's table, not a figure ACMA states.

The recent entries make the pattern concrete. In March 2026 Lululemon Athletica Australia was issued a $702,900 infringement notice for sending marketing emails without a functional unsubscribe facility, and that was the whole breach. In April 2026 Latitude Finance Australia was issued one of $3,960,000 over marketing SMS sent without adequate sender contact information and without a functional unsubscribe facility, again with no consent breach in the description. Consent failures still dominate the longer record, including a $7,502,610 notice to the Commonwealth Bank in October 2024, but the mechanical failures sit right alongside them.

The practical reading for a small business is this. The risk is not that you decide one day to spam strangers. It is that the list you already have quietly stops being compliant: an unsubscribe link that breaks after a template change, a form that no longer records what people agreed to, a sender name that stopped matching your registered entity. None of that feels like spamming. All of it is what the enforcement record is made of.

Keep the fear proportionate, though. Those figures belong to national brands sending millions of messages, and the Act sets its penalties per contravention with a cap on the total for any single day, so those totals reflect volume as much as anything else. ACMA's stated options also include formal warnings and court-enforceable undertakings, both of which appear in its table without a dollar figure. A local business with a list of four hundred people is not facing a seven-figure notice. It is facing a complaint, an investigation it has to answer, and the need to produce consent records it may never have kept.

the unsubscribe rules that catch normal businesses

ACMA sets out what the unsubscribe option has to do. Each item maps to a way real businesses break it:

• Instructions presented clearly. Not four-point grey text under the logo.
• Honoured within five working days. The Act counts business days, excluding weekends and public holidays. If your removals are manual, that is a real deadline over a long weekend.
• Free, and no more than the usual cost of using the address. A standard text charge is fine. A premium number is not.
• Functional for at least 30 days after you send. This is the one that breaks silently. Retire a campaign, change a domain or let a landing page 404, and last month's emails become non-compliant without anyone touching them.
• No account, no login, no extra personal information. Making someone sign in to leave your list is a breach, not a retention tactic.

One Australian wrinkle on SMS: ACMA notes that alphanumeric headers, the kind showing your brand name instead of a number, generally cannot receive return messages. If your SMS says "reply STOP" and the header cannot receive a reply, your unsubscribe does not work. Give a number or a link.

it is not only email, and not only Australian senders

Two scope points catch people who assume this is an email law for Australian senders.

First, the Act defines an electronic message by the account it is sent to: email, instant messaging, telephone, or "a similar account". SMS and MMS are in. So are messages sent through messaging platforms, which is how ACMA's own table comes to include a case covering WhatsApp messages. Voice calls made on a standard telephone service are specifically excluded from the Act; unwanted calls are dealt with separately, through the Do Not Call Register.

Second, the Act applies to any commercial electronic message with an "Australian link", and that test is deliberately wide. It is satisfied if the message originates in Australia, but also if the device used to access the message is in Australia, or if the recipient is physically present in Australia when they open it. A business in Auckland, Manchester or Toronto emailing Australian prospects is inside the Spam Act. Sitting offshore is not a defence, which is the mirror image of the position we describe in our guide to CASL and Canadian email marketing.

what to do this week

None of this needs a project. It needs an hour and a written answer to five questions.

1. For each list, how did these people say yes? If the answer is "they bought something" or "the address was on their website", read the consent section again and decide honestly whether it holds.
2. Can you produce the record? Date, method, and what the person was told they were agreeing to. The burden is yours.
3. Send yourself the last campaign and click unsubscribe. Check the address actually came off, and time how long it took.
4. Open an email you sent five weeks ago and click the unsubscribe link in that one. The 30-day rule is about old messages, not new ones.
5. Read your footer. Correct legal name or ABN, and contact details that will still reach you in a month.

If a question fails, fix that one thing and move on. This is maintenance, not a project, and it stays fixed once the plumbing is right.

the honest takeaway

Spam Act email marketing in Australia comes down to a duty that is easy to state and easy to let rot: get permission you can prove, say who you are, and make leaving effortless and reliable. The enforcement record says the businesses that get caught are not the ones who set out to spam anyone. They are the ones who stopped checking.

The deeper point is that all three duties describe a list people are glad to be on. Permission you can evidence, a sender they recognise and an exit they can find are also the conditions under which email works commercially, which is the argument our guide to email that does not get deleted makes without mentioning the law once, and the same thinking runs through our piece on social media marketing for Australian small businesses. Build for the person receiving it and the regulator is rarely your problem.