Email and SMS marketing in Australia: the Spam Act rules agencies should follow

Email and SMS marketing are two of the most cost-effective channels available to Australian businesses, but they are also two of the more heavily regulated, and the rules genuinely differ from what businesses may have encountered marketing into other countries. The Spam Act 2003, enforced by the Australian Communications and Media Authority, sets out specific requirements for what is called a commercial electronic message, which covers marketing email, SMS and other electronic messages, and getting the basics wrong can carry real consequences for a business and, by extension, for the marketing agency running the campaign on its behalf.

The starting requirement is consent, and it has to exist before a marketing message is sent, not be assumed. The Spam Act recognises two forms: express consent, where someone has clearly and knowingly agreed to receive marketing messages, and inferred consent, which can apply where there is an existing relationship and it is reasonable to expect marketing contact, for example a customer who provided their email during a recent purchase where receiving marketing was a reasonable expectation at the time. Inferred consent is not permanent, though, and reasonably weakens the longer it has been since that relationship or interaction took place, which is why simply having someone's email address on file from years ago is not, on its own, a safe basis for an ongoing marketing campaign.

Every commercial electronic message also needs to clearly identify the business sending it, using accurate, currently correct contact details, commonly the business's correct legal name or its name together with its Australian Business Number, alongside a working way to get in touch such as an email address, phone number or physical or PO box address. This identifying information needs to stay accurate for at least thirty days after the message is sent, which matters for businesses that change trading names, contact details or ownership structures without updating existing email or SMS platform settings.

An unsubscribe or opt-out function is required in every message, and it has to actually work, not just exist as a token link. It needs to be free, or at standard message rate for SMS, and needs to keep functioning for at least thirty days after the message was sent. Once someone opts out, that request needs to be honoured within five business days, and continuing to message someone after they have unsubscribed is one of the more straightforward ways a business can end up in breach.

The consequences for getting this wrong are not hypothetical. ACMA has issued some genuinely large penalties over the years for Spam Act breaches, including a $3,552,000 infringement notice against a major bank alongside an enforceable undertaking to overhaul its e-marketing systems, a $2.5 million notice against an online betting operator, and a $2,011,320 notice against a food delivery platform, among other significant enforcement actions. Civil penalties under the Act scale with the number of non-compliant messages sent in a single day and the current value of a Commonwealth penalty unit, meaning a business sending a genuinely large volume of non-compliant messages is exposed to a correspondingly large potential penalty, not a token fine.

Spam Act compliance sits alongside a related but separate set of obligations under the Privacy Act 1988 and the Australian Privacy Principles, which govern how a business collects, stores, uses and discloses the personal information behind a marketing list in the first place, including data gathered through website tracking, sign-up forms and customer accounts. The direction of recent and expected reform has been toward wider coverage, treating technical identifiers such as IP addresses, device IDs and tracking cookies more clearly as personal information, and expecting consent that is genuinely voluntary, informed, current, specific and unambiguous rather than assumed from a pre-ticked box or buried in fine print. A long-standing exemption for small businesses under the Privacy Act has also been flagged for phase-out, meaning obligations that once applied mainly to larger organisations are moving toward covering a wider range of Australian businesses over time.

For a business running email or SMS marketing directly, or through an agency, the practical takeaway is to keep a genuine, documented record of how and when consent was obtained for each contact, make sure sender details and unsubscribe functions are current and actually tested, and treat customer data used for marketing and tracking as something covered by real legal obligations rather than a purely technical or creative decision. This article is general information about how the Spam Act and Privacy Act apply to marketing, not legal advice for your specific situation — ACMA and the Office of the Australian Information Commissioner are the right places to go for guidance on your own compliance obligations. Our directory lists Australian digital marketing agencies if you are looking for one to run these campaigns for you.

Frequently asked questions