Two federal laws decide whether an Australian marketing email is lawful. The Spam Act 2003 controls the message itself: who may receive it, what it must contain and how people stop receiving more. The Privacy Act 1988 controls the personal information behind it: how you collect names, emails and phone numbers, how you store them and where you send them. This page explains how the two fit together. It is general information, not legal advice; for your own situation, speak to an Australian lawyer.
The Spam Act 2003 at a glance
The Spam Act applies to any “commercial electronic message” with an Australian link, meaning it was sent from Australia, sent to an Australian address or number, or sent by an organisation that operates in Australia. It covers email, SMS, MMS and instant messaging. It does not cover voice telemarketing calls, which fall under the separate Do Not Call Register Act 2006.
A message is commercial if it offers, advertises or promotes goods, services, land or business opportunities, or promotes the sender. A message counts as commercial even if promotion is only part of its purpose. That detail matters: several of the largest ACMA cases involved “service” messages that also carried a promotion.
Rule 1: consent
You need the recipient’s consent before you send. Consent is either express (the person actively agreed, for example by ticking an unticked box on your subscription form) or inferred from an existing business relationship where the person would reasonably expect to hear from you. The burden of proving consent sits with the sender, so keep records. Our page on permission to send email campaigns walks through both types.
Rule 2: identify
Every commercial message must clearly identify the individual or organisation that authorised it and include accurate contact details, which should stay valid for at least 30 days after sending.
Rule 3: unsubscribe
Every commercial message needs a functional unsubscribe facility that works for at least 30 days after the message is sent. Requests must be honoured within five working days, and unsubscribing must not cost the recipient more than the usual cost of replying. Mailpro adds an unsubscribe link to every campaign and removes the address from future sends, which helps you stay inside the five-day window.
Exemptions to be careful with
“Designated commercial electronic messages” sent by government bodies, registered charities, registered political parties and educational institutions (to current and former students and their households) are exempt from the consent and unsubscribe rules, but must still identify the sender. The exemption is narrow, so most businesses should assume all three rules apply.
The Privacy Act 1988 and the Australian Privacy Principles
The Privacy Act applies to businesses and not-for-profits with annual turnover above $3 million, and to some smaller entities, such as health service providers and businesses that trade in personal information. The OAIC regulates it through 13 Australian Privacy Principles (APPs). The ones that matter most for email marketing are:
- APP 5: tell people, at or before collection, who you are and why you want their details.
- APP 7: rules for direct marketing, including a simple opt-out. Where the Spam Act applies to an email or SMS, it generally takes over from APP 7 for that message.
- APP 8: take reasonable steps before disclosing personal information to an overseas recipient, including a cloud platform.
- APP 11: protect the information you hold against misuse, loss and unauthorised access.
The Privacy and Other Legislation Amendment Act 2024 strengthened the regime. Since December 2024 the OAIC can issue infringement notices for some APP breaches, and a statutory tort for serious invasions of privacy commenced in 2025. The Notifiable Data Breaches scheme, in place since 2018, also requires you to notify affected people and the OAIC when a breach is likely to cause serious harm.
How the ACMA enforces the rules
The ACMA investigates complaints, issues formal warnings and infringement notices, accepts court-enforceable undertakings and can take matters to the Federal Court. It publishes its results, and the figures have risen steadily:
- Commonwealth Bank paid $7.5 million in 2024 after sending more than 170 million marketing messages without a way to unsubscribe. It had already paid $3.55 million in 2023.
- Pizza Hut Australia paid $2.5 million in 2024 for almost six million texts and emails sent to people who had not consented or had withdrawn consent.
- Lululemon Athletica Australia paid $702,900 in 2026 for more than 370,000 marketing emails with no unsubscribe option.
- Tabcorp (TAB) paid more than $2.7 million in 2026 after sending over 217,000 marketing emails and SMS to customers who had unsubscribed.
The common thread is not exotic legal theory. It is missing unsubscribe links, messages wrongly classed as “service” messages, and opt-outs that did not reach every system. Our page on whether email campaigns are legal in Australia turns these cases into a practical checklist.
A compliance routine that works
Most businesses that end up in ACMA reports did not set out to spam anyone. Their processes failed at scale. A simple routine reduces that risk:
- Classify every template. Mark each email and SMS template as commercial or purely transactional. If a template contains any promotion, treat it as commercial.
- Record consent at the source. Every sign-up form, checkout and in-store capture should record when and how consent was given.
- Centralise opt-outs. Make one list the master record of unsubscribes and sync it to every system that sends marketing, before each campaign.
- Check footers after design changes. A new template or a new platform is the moment unsubscribe links go missing.
- Review third parties. If an agency or affiliate sends on your behalf, the messages are still authorised by you. Check their lists and processes.
- Train the team. Sales staff who add business-card contacts to the newsletter list are a common source of non-consented addresses.
Keep a record of these checks. If the ACMA ever contacts you, a documented process makes a difference to how the matter is treated.
Sending to people outside Australia
If your list includes people in the EU or the UK, the GDPR or UK GDPR may apply as well. Mailpro is GDPR-native and hosts data in Switzerland, which holds an EU adequacy decision; see our GDPR compliance page. If you are sending into North America, look at the US CAN-SPAM Act and Canada’s CASL, which is stricter on consent than the Spam Act.
Where Mailpro fits
Mailpro gives you the tools to meet these obligations: double opt-in with timestamps, automatic unsubscribe links and suppression, sender identification in every template, and Swiss hosting on private infrastructure, outside US jurisdiction, which gives you a clear answer for APP 8. The obligations themselves remain yours as the sender.