Definition
Australia's Spam Act 2003 regulates the sending of commercial electronic messages, including email, that have an Australian link. The Act defines a commercial message as one that offers to supply goods or services, advertises a supplier, or promotes a business opportunity. The Spam Act establishes a three-part compliance framework for commercial email: each message must be sent with consent, must include accurate sender identification, and must include a functional unsubscribe mechanism. The Act applies to messages sent from or to Australia, meaning international senders targeting Australian subscribers must comply.
Consent under the Spam Act can be express (the subscriber has explicitly opted in) or inferred from an existing business or other relationship. Inferred consent is a notable difference from the GDPR model: if a person has made a purchase, made an enquiry, or otherwise established a business relationship with you, you may be able to send commercial messages based on inferred consent for a reasonable period. However, inferred consent is limited and the onus is on the sender to demonstrate that a relationship exists. The ACMA (Australian Communications and Media Authority) has issued guidance on what constitutes a reasonable period, generally 3-12 months depending on the nature of the relationship.
The unsubscribe requirements of the Spam Act are specific and enforceable. Every commercial message must include a functional unsubscribe facility that is free to use (no premium SMS or paid phone numbers). The unsubscribe request must be actioned within 5 working days. The unsubscribe mechanism must be clearly and conspicuously presented. Additionally, each message must include the sender's identity and accurate contact details. These requirements apply to all commercial messages regardless of the consent basis. The Spam Act also prohibits the supply of address-harvesting software and the use of harvested address lists.
Best Practices
Implement a 3-working-day unsubscribe processing standard, faster than the 5-day legal requirement. Processing unsubscribes more quickly than legally required demonstrates good practice and reduces the risk of complaints. ACMA investigations often begin with spam complaints; faster unsubscribe processing reduces complaint volume. Automated real-time unsubscribe processing is the gold standard.
Document the basis of consent for every Australian subscriber, including whether it is express or inferred. If relying on inferred consent from an existing business relationship, document the nature of that relationship (purchase date, enquiry date, membership) and the reasonable period for which inferred consent applies. This documentation is essential for demonstrating compliance if the ACMA investigates.
Include accurate sender identification in every commercial email. The message must identify the sender (individual or business name) and provide accurate contact details that are functional for at least 30 days after sending. PO Box addresses are not sufficient contact details. A physical street address or a functional email address with a monitored reply mailbox satisfies this requirement.
Maintain a separate consent management system for Australian subscribers that tracks consent basis and expiry. Inferred consent expires when the underlying business relationship is no longer current. Implement automated consent expiry based on your documented reasonable periods. When inferred consent expires, either obtain express consent or stop sending commercial messages.
Monitor ACMA enforcement actions and industry guidance for compliance updates. The ACMA regularly issues infringement notices and Federal Court actions for Spam Act violations. Notable cases include the ACMA's action against Uber (AUD $600,000 penalty for 1.2 million marketing messages without adequate unsubscribe) and against Kia Australia (AUD $150,000 infringement notice). These cases provide practical guidance on compliance expectations.
Related Glossary Terms
Email B2B Consent
The legal requirements for B2B email marketing consent, covering GDPR legitimate interest, CASL implied consent, CAN-SPAM exemptions, and jurisdiction-specific best practices.
Email CASL
Canada's Anti-Spam Legislation requirements for commercial electronic messages, including consent types, record-keeping, and penalties up to $10 million per violation.
Email CCPA
California Consumer Privacy Act requirements for email marketing, including consumer rights to access, delete, and opt out of data collection and sale.
Email Consent Record
Email consent record-keeping captures proof of opt-in including timestamp, IP address, method, and exact wording shown. GDPR requires controllers to demonstrate consent upon request.
Email Crisis Management
Incident response procedures for email marketing, including the send halt kill switch, reputation recovery, compliance breach obligations, and disaster recovery planning.
Email Data Portability
Data portability under GDPR Article 20 gives subscribers the right to receive their email marketing data in a machine-readable format and transfer it to another provider. Common export formats are CSV and JSON.
Frequently Asked Questions
Express consent is a clear, affirmative opt-in action. Inferred consent is implied from an existing business or other relationship, such as a prior purchase, an enquiry, or membership. Inferred consent is more limited and the sender bears the burden of proving the relationship exists. The ACMA expects organisations to evaluate whether inferred consent remains current and reasonable.
The Spam Act requires unsubscribes to be actioned within 5 working days. This is a maximum; best practice is 24-48 hours. Automated real-time unsubscribe processing is strongly recommended. Failure to process unsubscribes within 5 working days is a violation of the Spam Act and can result in penalties.
Penalties are significant. For body corporates, the maximum penalty per day is AUD $2.22 million (as indexed). The ACMA can issue infringement notices (typically AUD $13,320 per notice), accept enforceable undertakings, or pursue Federal Court proceedings for civil penalties. Directors of companies found in breach may also face personal penalties.
Yes. The Spam Act applies if the commercial electronic message has an Australian link, which includes messages sent to an individual physically present in Australia. International organisations that send emails to subscribers with Australian email addresses or who provide Australian contact information must comply with the Spam Act.
The message must clearly identify the sender (the individual or business responsible for sending the message) and include accurate contact details. The contact details must be functional for at least 30 days after sending. A business name, Australian address, and a functional email address or phone number typically satisfy this requirement.