A customer buys something from you. Their email address lands in your billing system. A few months later, you export the customer list into a newsletter tool and announce a new service. It feels like normal business administration. Whether it is lawful marketing depends on a question the software probably never asked: what permission did those people actually give you?
Australian spam laws are not just about stopping obviously dodgy bulk mail. They apply to ordinary businesses sending commercial email, SMS, MMS and instant messages with an Australian link. A polite subject line, a small audience and a genuinely useful offer do not remove the need to comply.
The practical starting point is three things: permission to send, clear identification of the business responsible, and an unsubscribe facility that actually works. This guide explains the rules and the system design needed to make them stick. Reviewed 2 October 2026; it is general business and technical information, not advice on a particular legal dispute.
What counts as a commercial electronic message?
Under section 6 of the Spam Act 2003, a message can be commercial if one of its purposes is to offer, advertise or promote goods, services, a supplier, land or a business or investment opportunity. The assessment includes the content, presentation and material accessible through links or contact details in the message. Marketing does not have to be its only purpose.
That covers more than newsletters. Sales emails, promotional SMS, some customer reactivation campaigns and commercial direct messages can fall within the rules. Sending a campaign to businesses rather than consumers does not create a blanket exemption. Neither does sending emails individually instead of through a bulk-mail platform.
An Australian link is broader than an Australian sending server. Section 7 covers several connections, including messages originating here and relevant Australian sender or recipient circumstances. Moving your marketing platform overseas is not a reliable way to escape the Act.
Voice telemarketing calls are outside this Act’s electronic-message definition. They have separate rules, including the Do Not Call Register regime and calling standards. Do not treat consent for email as a universal permission slip for calls, texts and every future brand you launch.
Rule 1: establish consent before marketing
Section 16 prohibits covered unsolicited commercial messages. Schedule 2 recognises express consent and consent that can reasonably be inferred from conduct and business or other relationships. The distinction matters because having a contact record is not the same as having a defensible reason to market to that contact.
Express consent: make the choice clear
Express consent is a person’s direct agreement. A clearly labelled newsletter sign-up, a voluntarily selected marketing checkbox or a recorded agreement given during a conversation can provide evidence. The person needs to understand what they are agreeing to, including who will send messages and the channel involved.
For a website form, a sensible design is an optional, unticked checkbox beside plain wording such as: Email me SenseICT news and practical technology tips. I can unsubscribe at any time. That is an example, not a magic legal formula. Adapt it to the actual campaign and business. Keep marketing separate from the acceptance needed to submit a support request or pay an invoice.
Store the wording version, date, source and address associated with the choice. Double opt-in can improve evidence and reduce accidental subscriptions, but do not describe it as a universal Spam Act requirement. Evidence collection should be proportionate: recording consent is not a reason to collect a pile of unnecessary personal information.
Inferred consent: a relationship, not wishful thinking
Inferred consent needs a reasonable basis in the person’s conduct and relationship with you. An ongoing customer relationship and relevant messages may support it; a single old purchase or a quotation enquiry is not an automatic entitlement to send every future promotion. Ask what the person would reasonably expect from the relationship, not what would be convenient for your campaign.
A business card, a LinkedIn connection or silence after your first email is not a dependable substitute for permission. If you cannot explain the basis for inferred consent and produce supporting records, a large send is the wrong place to experiment.
Publicly listed addresses have a narrow rule
Schedule 2 clause 4 says publication of an electronic address alone does not establish consent. There is a narrower provision for conspicuously published work addresses where the specified conditions are satisfied: the address relates to a person’s work role, there is no accompanying statement against unsolicited commercial messages, and the message is relevant to that person’s work, functions or duties.
That is not permission to scrape every address on a company website and pitch unrelated products. An address published for invoices or support should not be casually repurposed as a sales target. Document the specific basis if you rely on the provision; use a deliberate subscription or enquiry path wherever practical.
You cannot fix a cold list by emailing for permission
ACMA’s guidance on avoiding spam explains that an electronic message asking for consent to receive marketing is itself a commercial message. A request to send offers is not a loophole if you lack permission to send it. A website sign-up, customer-initiated request or suitable offline process is a better way to obtain consent. Any phone-based approach still needs to comply with the rules for that channel.
Rule 2: identify who authorised the message
Section 17 requires clear, accurate identification of the individual or organisation that authorised the sending, plus information that lets the recipient readily contact them. Those details must be reasonably likely to remain valid for at least 30 days after the send.
A familiar trading name is useful, but an obscure agency name or a generic sender address can leave the recipient unable to work out which business is responsible. Use consistent business identification and a genuine contact route. If an agency sends on your behalf, your business should not disappear behind the agency’s email infrastructure.
Check the actual delivered message, not just the campaign editor. Footer details can vanish in a plain-text version, break on mobile or point to a retired domain. Your control of the business domain and email accounts is part of keeping that contact route reliable.
Rule 3: make unsubscribe straightforward
Section 18 requires a clear, conspicuous unsubscribe statement and a functional electronic address for receiving requests. It must remain capable of receiving requests for at least 30 days after the message is sent. A button that works on launch day but expires next week is not enough.
Regulation 7 of the Spam Regulations 2021 adds specific conditions. The process must not require a premium service, cost more than the usual cost of using that kind of electronic address, charge an unsubscribe fee, require extra personal information beyond the destination address, or make the person log in or create an account.
For email, a clear link to a working opt-out action is usually more useful than a buried preference centre. For SMS, a reply option such as STOP only works if the sending number can receive replies and the platform processes them. A branded alphanumeric sender ID may not support replies; provide an alternative working unsubscribe route instead of inviting replies that go nowhere.
Do not make the recipient remember a password, complete a survey or speak to sales before leaving. A preference centre can offer narrower choices, but a straightforward way to stop the relevant marketing should not be hidden behind those choices. Make the control keyboard-accessible, readable and usable on mobile; the web accessibility guide explains why visual appearance alone is not a sufficient test.
The five-business-day rule: stop promptly
Schedule 2 clause 6 governs when withdrawal of consent takes effect. For an electronic request, it takes effect at the end of the five-business-day period beginning on the day the request is sent. This is the statutory source of the familiar five-business-day rule, rather than a deadline written into section 18 itself.
Operationally, process opt-outs immediately wherever possible. Five business days is not a target for leaving someone in an automated campaign. Stop queued marketing, synchronise the suppression across sending systems and keep an audit record. A later CRM import must not quietly put the person back on the list.
Invoices and service notices: keep the promotion out
A factual invoice, security notification or service notice is not necessarily subject to the same consent and unsubscribe requirements as a promotion. Schedule 1 provides a designated-message category for qualifying factual-information messages with limited permitted additional details. The conditions are narrower than simply labelling a message transactional.
The danger is mixed content. An invoice with a discount offer, an outage notice with an upgrade pitch or a billing reminder promoting another service can have a commercial purpose. Classify messages by what they actually contain and link to, not by the sending platform’s label.
Keep essential service communications and promotional campaigns in separate templates and workflows. Someone can stop marketing without losing the operational notices needed for an existing service. That separation is useful for the customer and much easier to defend than a template where every message doubles as an upsell.
Bought lists, scraped addresses and outsourced campaigns
Buying a list is not the same as buying consent. Before using third-party contacts, you need a defensible basis for sending your particular messages. A supplier’s fully compliant badge does not establish that every recipient agreed to hear from your business about this topic through this channel.
Part 3 of the Act separately prohibits specified supplying, acquiring and using of address-harvesting software and harvested-address lists. Consent arguments do not make internet address scraping a safe shortcut. Be particularly wary of automated prospecting tools whose main selling point is extracting email addresses from websites.
Outsourcing a campaign does not remove the authorising business’s obligations. Give the agency documented consent requirements, suppression rules and template constraints. Require access to records and test the unsubscribe process yourself. If the agency cannot explain the provenance of its audience, do not let it send under your name.
Exemptions are specific, not blanket permission
Schedule 1 contains designated-message provisions for qualifying factual information and certain messages authorised by government bodies, registered political parties, registered charities and educational institutions. The organisation-based categories have conditions about the goods or services involved; educational messages also have specified student or household connections.
Qualifying designated messages are exempt from the Act’s consent and unsubscribe provisions, but section 17’s sender-identification rule still applies. A commercial business is not exempt simply because it supports a charity, provides educational content or works for government. Get advice if your campaign depends on one of these categories instead of assuming the organisation’s label settles the question.
The 2026 SMS Sender ID change is a separate check
ACMA’s SMS Sender ID Register commenced on 1 July 2026. Its guidance says messages using unregistered branded sender IDs are labelled Unverified. Businesses using a name rather than a normal mobile number should check the registration and authorised sending arrangements with their SMS provider.
Registration addresses sender impersonation; it does not establish consent, make an offer non-commercial or replace an unsubscribe facility. Treat sender verification and Spam Act compliance as separate checks. Ask the provider how a recipient can opt out when your branded sender cannot receive a STOP reply.
Spam compliance, privacy and deliverability are different jobs
A small business should not confuse a Privacy Act exemption with a Spam Act exemption. The Spam Act has no general small-business turnover exemption. The OAIC’s direct-marketing guidance also explains that Australian Privacy Principle 7 does not apply to the extent the Spam Act or Do Not Call Register Act applies. Other applicable privacy obligations can still matter when you collect, store, share or transfer contact data.
Technical email authentication is another separate issue. SPF, DKIM and DMARC help receiving systems evaluate the source of your mail; they do not prove the recipient consented. A perfectly authenticated unsolicited campaign is still unsolicited. Likewise, keeping spam complaints low is good practice, not a substitute for the legal requirements.
A pre-send checklist that a small business can use
- Classify the message. Review the subject, body, offers and linked material. Is any purpose commercial?
- Check permission. Record express consent or the specific reasonable basis for inferred consent. Exclude contacts whose basis is unknown.
- Apply suppression. Check opt-outs across the CRM, billing platform, newsletter tool, SMS service and agency lists.
- Identify the business. Use clear authorising-business details and a contact route expected to stay valid for at least 30 days.
- Test unsubscribe. Try the delivered email and SMS on a real device. Confirm no login, extra personal information or special fee is needed.
- Check processing. Confirm the opt-out stops automation and queued marketing, and does not disappear during the next import.
- Separate service mail. Remove cross-selling from essential notices where you rely on their factual purpose.
- Check branded SMS. Confirm Sender ID registration, sending authority and a usable opt-out route with the provider.
- Keep evidence. Retain the sent template, audience selection, consent basis and test outcome, with appropriate access controls.
If your old database has no credible consent records, pause marketing to the uncertain contacts. Do not send a re-permission campaign as a supposed cure. Establish a lawful way to rebuild the audience and preserve opt-outs when migrating systems.
Website legal documents are a separate task
If you are reviewing your website’s terms and privacy documents, Legal123 is an Australian legal-document provider to assess for that separate job. A document package does not establish marketing consent, operate your unsubscribe system or guarantee Spam Act compliance. Use the legislation and ACMA guidance above for the rules, and obtain advice where your campaign needs an individual legal assessment.
Why this is a systems problem, not just a footer problem
The Act provides for civil penalties, infringement notices, injunctions and enforceable undertakings. Penalty amounts depend on the provision, circumstances, history and applicable penalty-unit value; copying an old maximum-dollar figure into a policy can be misleading. The more useful question is whether your business can explain each send and reliably stop when asked.
A compliant-looking footer cannot repair a consent record that never existed or an unsubscribe event that never reached the CRM. Start with one owner for the process, a clear source of consent data and suppression that survives imports, automation changes and vendor migrations.
I can help review how your forms, business systems and email or SMS tools pass contact data and opt-outs between them. That is technical workflow work, not a legal determination that your campaign is compliant. Contact Matt at SenseICT if the process currently depends on someone remembering to update several lists by hand.
For a longer independent explanation of the statutory structure, Recording Law’s Australian Spam Act guide is useful further reading. For decisions about a specific campaign, start with the current legislation and ACMA guidance linked above.
Featured photograph: Austin Distel / Unsplash.
Affiliate Disclosure: This article contains affiliate links. If you click an affiliate link and make a purchase, SenseICT may earn a commission. Product links are not a guarantee of suitability or compliance; assess each product against your requirements.
