A guide to lawful lead generation
Generate leads with permission: what Australian law asks
Finding customers, with their permission
In Australian marketing law, permission does most of the work. Before you send a marketing email or text, the ACMA says you must first have consent from the person who will receive it, and once a number has been on the Do Not Call Register for 30 days, telemarketers can call it only with consent or under an exemption.
This guide, published by Dotto, sets out what the Spam Act, the Do Not Call Register Act and the Privacy Act ask of a business looking for new customers, and what the ACCC says about the claims and reviews that bring them in. It is general information, not legal advice: the regulators’ own pages, linked on every section, have the final word.
I agree to receive what it is for, and by which channels
from who will use it, partners included
for how long it will be used
and I can withdraw by how to withdraw
The box arrives empty. The ACMA lists pre-checked tick boxes among the practices that will generally not meet its expectations.
Which law covers which kind of contact
Several sets of rules share this ground, and the channel you use decides which one applies first. The OAIC’s guide to direct marketing draws the lines this way.
| How you reach someone | The main rules | Regulator |
|---|---|---|
| A commercial email, SMS, MMS or instant message | The Spam Act 2003: consent, sender identification and a working unsubscribe | ACMA |
| A telemarketing call | The Do Not Call Register Act 2006 for numbers on the register, and the telemarketing industry standard for calls to any Australian number, registered or not | ACMA |
| Addressed mail, door-to-door, targeted online advertising, and calls to numbers not on the register | Australian Privacy Principle 7, for the organisations the Privacy Act covers | OAIC |
| The ad, the landing page, the testimonial or review, in any channel | The Australian Consumer Law: claims must be accurate, truthful and based on reasonable grounds, and fake or misleading reviews are against the law | ACCC |
APP 7 reaches only organisations the Privacy Act covers. As the OAIC explains it, that means businesses and not-for-profits whose annual turnover is more than $3 million, and some small businesses, including businesses that buy or sell personal information and private sector health service providers.
Where APP 7 does not apply to a message, the OAIC suggests adopting its standards for all direct marketing anyway, as a way to meet customer expectations and show privacy best practice. That is the OAIC’s advice on good practice, not an extra legal duty.
What a fair permission slip looks like
The ACMA has published a statement of expectations on using consent in telemarketing and e-marketing. It calls itself an outcome-focused guide to better practice, not legal advice and not a definitive compliance guide, so read the lists below as the regulator’s view of good and poor practice rather than as the wording of the Acts.
Practices it says will generally meet the rules
- Express consent based on clear terms, readable where consent is given, not hidden in fine print or a long privacy policy
- Terms that say what the consent is for, who will use it, how long, and how to withdraw it
- Considering a double opt-in, such as a confirmation email
- Removing a person from call or marketing lists when they ask
- Acting on unsubscribe requests as quickly as practicable, and always within 5 business days
Practices it says will generally fall short
- Pre-checked tick boxes on forms
- Bundled consent: one request used for several purposes, with no choice about each
- Refer-a-friend arrangements, because consent must come from the person it applies to
- Treating a website visit or an email to the business as consent to a marketing list
- Messaging someone only because their address or number has been published
The six guides
Each one takes a single question and answers it from the regulator that owns it.
- Slip 1
Consent under the Spam Act
Express and inferred consent, naming yourself as the sender, and the unsubscribe rules for email, SMS and instant messages.
- Slip 2
The Do Not Call Register
What counts as a telemarketing call, when a registered number may be called, washing a list, and the permitted calling hours.
- Slip 3
Direct marketing and privacy
Australian Privacy Principle 7, and the changes to the Privacy Act as the OAIC describes them.
- Slip 4
Buying a list of leads
What the ACMA and the OAIC say about bought, rented and outsourced contact lists, and who stays responsible.
- Slip 5
Honest claims in ads
Misleading claims, fine print and fake reviews, as the ACCC explains them.
- Slip 6
Keeping consent records
What the ACMA says a record of consent should hold, and why proving consent falls to the sender.