Email campaigns are legal in Australia. Unsolicited commercial email is not. The dividing line is drawn by the Spam Act 2003, enforced by the Australian Communications and Media Authority (ACMA), and the Privacy Act 1988, overseen by the Office of the Australian Information Commissioner (OAIC). This page answers the question practically: what makes a campaign lawful, and what has landed Australian brands with multi-million-dollar penalties. This is general information, not legal advice.
The short answer: three conditions
- Consent. The recipient agreed to receive marketing from you (express consent), or you have an existing relationship that makes marketing reasonably expected (inferred consent). You must be able to prove it.
- Identification. The message clearly names the business that authorised it and gives accurate contact details.
- Unsubscribe. A functional opt-out is included in every commercial message, keeps working for at least 30 days, and is actioned within five working days.
Meet all three for every commercial email and SMS, and your campaigns are on solid ground. The details of each rule are on our Australian email marketing law overview.
What the ACMA cases actually teach
The ACMA publishes its investigations, and they are the best guide to where real businesses go wrong.
“Service” emails that were really marketing
In 2024 the Commonwealth Bank paid a $7.5 million penalty after the ACMA found it had sent more than 170 million marketing messages without a way to unsubscribe, having classed millions of them as non-commercial. Some 34.8 million were also sent to people who had not consented or had withdrawn consent. If a message promotes a product or the brand, even in a footer, treat it as commercial.
Unsubscribes that did not stick
Pizza Hut Australia paid $2.5 million in 2024 after sending almost six million texts and emails to people who had not consented or had opted out. In 2026 Tabcorp (TAB) paid more than $2.7 million after sending over 217,000 marketing emails and SMS in 16 days to customers who had unsubscribed from those channels. Both cases point to the same weakness: opt-outs recorded in one system but not synchronised with the tool that sent the campaign.
Missing unsubscribe links
In 2026 Lululemon Athletica Australia paid $702,900 for more than 370,000 marketing emails that contained no way to unsubscribe. A template change can remove a footer silently, which is why checking the unsubscribe link belongs on every pre-send checklist.
A pre-send checklist for Australian campaigns
- Every address on the list came from a consented source. Purchased or scraped lists are a serious risk, and the Spam Act specifically prohibits using address-harvesting software or harvested lists.
- Your consent records show when and how each person subscribed. A form with an unticked box and double opt-in gives you both.
- The sender name, business name and a valid contact address appear in the email.
- The unsubscribe link works and removes the address from every list and every channel you use, including SMS.
- Anyone who opted out on another platform, such as your e-commerce store or CRM, has been imported into your suppression list before sending.
- If you are texting, the message identifies you and includes an opt-out. See SMS regulations in Australia for the SMS Sender ID Register rules that apply from 1 July 2026.
Don’t forget the Privacy Act
If your business turns over more than $3 million a year, or falls into one of the categories covered regardless of size, the Australian Privacy Principles apply to your subscriber data too. You need a privacy policy, a collection notice at sign-up, reasonable security and, under APP 8, reasonable steps before disclosing data to an overseas service provider. Since December 2024 the OAIC has been able to issue infringement notices for certain breaches.
Mailpro stores data in Switzerland on private infrastructure, outside US jurisdiction. Switzerland has an EU adequacy decision, and our Swiss data residency makes the APP 8 question straightforward to document.
What about subscribers outside Australia?
Australian law follows the message. When you email people in the EU or UK, the GDPR or UK GDPR may also apply; our GDPR guide explains the basics. For New Zealand, the Unsolicited Electronic Messages Act 2007 follows similar consent, identify and unsubscribe principles. If you have an international list, get local advice for each major market.
How Mailpro helps you stay on the right side
Every Mailpro campaign includes an unsubscribe link, and unsubscribed contacts are excluded from future sends. You can manage unsubscribes across all your lists, import suppression files from other systems, and keep sign-up timestamps from your forms. None of this replaces your own compliance process, but it removes the most common failure points the ACMA keeps finding.