In Australia, the question is not whether you may send marketing, but whether you can prove the recipient agreed to receive it. Under the Spam Act 2003, consent is the first of three rules (consent, identify, unsubscribe), and if the ACMA asks, the burden of proving consent sits with you. This page explains the two kinds of consent the law recognises, the grey areas, and how to build a consent record that stands up. It is general information, not legal advice.
Express consent: the gold standard
Express consent means the person actively agreed to receive commercial messages from you. The ACMA describes it as best practice. Typical examples:
- Ticking an unticked box that says “Send me offers and news by email” on your checkout or sign-up form.
- Filling in a newsletter subscription form on your website.
- Texting a keyword to your number to join an SMS club, where the terms were shown.
- Giving written consent on a paper form at a market stall or trade show, which you keep.
A pre-ticked box, or a line buried in terms and conditions, is weak evidence. Consent should be specific to marketing and easy to understand.
Inferred consent: narrower than people think
Consent can be inferred where you have an existing business or other relationship with the person and they would reasonably expect to receive the kind of message you are sending. A customer who bought a surfboard from your online shop last month may reasonably expect news about wetsuits. A person who once asked for a quote three years ago, never bought, and never heard from you again is a weaker case.
There is also a narrow “conspicuous publication” basis: when a business address is published prominently, without a statement that it does not want marketing, you may send messages that relate directly to the person’s role. It does not cover consumers, and it does not cover a list of addresses copied from websites.
Inferred consent is legally valid but harder to prove. The practical approach is to use it sparingly and invite those contacts to confirm through express consent.
What is never consent
- A bought or rented list. The people on it agreed to hear from someone else, not you. Our article on why you should never buy email lists covers the deliverability damage as well.
- Addresses collected with harvesting software. The Spam Act prohibits supplying, acquiring or using harvesting software and harvested lists.
- Business cards dropped in a fishbowl at an event, unless the entry form stated that entrants would receive marketing.
- Someone who unsubscribed. Once a person opts out, consent is withdrawn and must be honoured within five working days.
Building a consent record that stands up
ACMA investigations usually ask the sender to show how particular recipients consented. A good record captures:
- Who: the email address or mobile number.
- When: the date and time of consent, captured with each form submission.
- How: the form or channel used, and the exact wording shown.
- Confirmation: ideally a double opt-in click, which proves the owner of the address agreed.
- Changes: any later unsubscribe, with its date, applied across email and SMS.
The difference between single and double opt-in is explained in our FAQ on opt-in versus double opt-in.
Consent under the Privacy Act
If the Privacy Act 1988 applies to your business, you also need a collection notice under APP 5 telling people why you are collecting their details and who you share them with, and a privacy policy under APP 1. When your email platform stores data overseas, APP 8 requires reasonable steps to ensure the recipient handles it consistently with the APPs. Mailpro hosts all data in Switzerland on private infrastructure, outside US jurisdiction, and never sells or rents contact data, which you can state plainly in your privacy policy.
SMS permission works the same way
The Spam Act treats commercial SMS exactly like email: consent, identify, unsubscribe. A customer’s mobile number on an invoice is not automatically permission to text promotions. Collect SMS consent separately and include an opt-out, such as “Reply STOP to opt out”, in every marketing text. From 1 July 2026, alphanumeric sender names that are not on the ACMA’s SMS Sender ID Register are overwritten with “Unverified”. See our FAQ on SMS regulations in Australia and our SMS marketing page.
Re-permission before a big campaign
If you are planning a large EOFY or Christmas campaign to an older list, consider a re-permission email first: explain who you are, why they are hearing from you, and ask them to confirm. The contacts who click are your cleanest audience. The rest can be suppressed, which protects both your compliance and your sender reputation. Our law overview has the wider context.