Under Australia's Spam Act 2003, you need consent before you send anyone a marketing email or text. Every message must also identify your business accurately and include a working unsubscribe option that's honoured within 5 working days. The ACMA enforces the rules, and it's up to you to prove you had consent.
The Spam Act is stricter than many business owners expect. You can't email someone to ask for permission, because that request is itself a marketing message. And a one-off order on its own doesn't give you permission to keep marketing to someone.
Here's how consent works, what every message needs, and the unsubscribe rules in detail.
The three rules
| Rule | What it means |
|---|---|
| Consent | Have express or inferred consent from every person you send to |
| Identify | Show your name or business name and correct contact details |
| Unsubscribe | Include a clear, free unsubscribe that works and is honoured within 5 working days |
These apply even when someone else sends the messages for you. You still need consent from each recipient, and the message must still name you as the business that authorised it.
Express consent
Express consent means the person knows and accepts that they'll get marketing emails or messages from you. The ACMA calls it best practice. People can give it by:
- filling in a form,
- ticking a box on a website,
- saying yes over the phone,
- agreeing face to face.
Keep a record of who gave consent, when and how. Under the Spam Act, the burden of proof is on you.
Inferred consent
Sometimes you can infer consent, if the person knowingly gave you their address directly and would reasonably expect marketing from you. The ACMA says this usually means a provable, ongoing relationship, such as someone who's signed up to your service, holds an account or is a member, and the marketing has to relate directly to that relationship.
Two limits from the ACMA's own guidance:
- A bank can tell a savings customer about another savings account, but inferred consent wouldn't cover trying to get them to take out insurance.
- It doesn't cover messaging someone just because they bought something from you once.
Inferred consent is less reliable than express consent, so if you can, ask people to opt in. A short line on your account sign-up page, inviting customers to tick a box for news and offers, turns a grey area into a clear yes.
You can't email to ask for consent
This is the rule that trips up the most small businesses. Sending an email or text asking whether someone would like your marketing is itself a marketing message, so you need consent to send it. Collect consent where people already are: your website form, checkout, a sign-up at an event or a conversation.
Bought and borrowed lists
The ACMA warns to take care when you get or use a marketing list from anyone else. You're still responsible for having consent for every address on it. If a list arrives without proof of how each person agreed, treat it as unusable. Our guide on why a ready-made email list is a bad idea explains the deliverability side too.
Identify yourself
- Accurately identify your name or business name. Use your correct legal business name, or your name and ABN.
- Include correct contact details for you or your business.
- Keep that information correct for at least 30 days after you send the message.
Unsubscribe rules
Every commercial message must contain an unsubscribe option that:
- presents clear unsubscribe instructions,
- is honoured within 5 working days,
- is free to use, apart from the normal rate for something like a standard text,
- keeps working for at least 30 days after the message is sent,
- doesn't make people give extra personal information, log in or create an account.
A practical SMS point from the ACMA: alphanumeric sender names, where your business name shows instead of a number, generally can't receive replies. So a reply STOP option won't work with them, and you need another unsubscribe method.
Sending texts? Read about the SMS sender ID register.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Good ways to collect consent
Since you can't email strangers to ask, build consent into the places people already meet you:
- A sign-up form on your website that says exactly what people will get and how often.
- A tick box at checkout that isn't pre-ticked, so it's a real choice.
- A paper or tablet sign-up at events, with the wording on the sheet.
- Asking during a phone call or in person, then noting the date and what they agreed to.
Whichever you use, save the record. If a complaint ever reaches the ACMA, that record is what shows you did it right.
Phone marketing has separate rules, covered in the Do Not Call Register rules.
A quick Spam Act checklist
- Can you show how and when each person agreed?
- Does the message clearly name your business and give contact details?
- Is there a free, simple unsubscribe that'll still work in 30 days?
- Are unsubscribes removed within 5 working days, including from any tool a contractor uses?
If you send newsletters, the same habits help your emails land in the inbox. See why emails get marked as spam. My take: a smaller list of people who said yes will always beat a big list of people who didn't.
Frequently asked questions
What does the Spam Act 2003 require?
Consent before sending marketing emails or texts, accurate sender identification, and a working, free unsubscribe honoured within 5 working days.
Can I email someone to ask for consent in Australia?
No. The ACMA says a message asking for consent is itself a marketing message, so you need consent before sending it.
What is inferred consent under the Spam Act?
Consent you can reasonably infer from an ongoing relationship, like an account or membership, where the marketing relates directly to it.
How quickly must I process an unsubscribe in Australia?
Within 5 working days, and the unsubscribe option must keep working for at least 30 days after you send the message.
Does the Spam Act apply to SMS?
Yes. It covers marketing emails and messages, including texts, and the same consent, identify and unsubscribe rules apply.
Am I responsible if an agency sends my emails?
Yes. The ACMA says you still need consent from each recipient, and the message must still identify your business as the one that authorised it.
Can I use a list I got from another business?
Only if you can show consent for every address on it. The ACMA says you're still responsible for consent on any list you use.
