Slip 1 · The Spam Act
Consent under the Spam Act
Before you send a commercial email, SMS or instant message, you need the consent of the person who will receive it, and that consent is either express or, in narrower cases, inferred. Once you have it, each message has to identify you, give your contact details and make it easy to unsubscribe.
General information, not legal advice. The rules are in the Spam Act 2003 and the Spam Regulations, and the ACMA, which enforces them, explains them on Avoid sending spam.
Which messages count
business.gov.au describes a commercial electronic message as an email, SMS, MMS or instant message of any kind that offers, advertises or promotes a business, good or service. The ACMA adds two points that catch people out. A message with more than one purpose is commercial if one of those purposes is to sell or promote, and a link to a web page with commercial content is likely to make the message commercial too.
Its list of common mistakes includes shipping emails that also advertise, automated “welcome journeys” to new and prospective customers, messages trying to win back customers who cancelled, and messages encouraging people who have withdrawn consent to resubscribe. The ACMA also notes that for e-marketing, consent must be obtained before messages are sent, including to businesses.
One rule shapes how a lead is first asked: you cannot send an electronic message to ask for consent, because that message is itself a marketing message. So the asking happens elsewhere, in the ways the ACMA lists for giving express consent: completing a form, ticking a box on a website, by phone or in person.
The two kinds of consent
| Question | Express consent | Inferred consent |
|---|---|---|
| What it means | The person knows that marketing emails or messages will come from you, and accepts that. | The person knowingly and directly gave their address, and it is reasonable to believe they would expect marketing from your business. |
| How it arises | Completing a form, ticking a box on a website, by phone, or in person. | Usually a provable, ongoing relationship, such as a subscription, an account or a membership, with marketing directly related to it. It does not extend to messaging someone simply because they have just bought something from you. |
| The ACMA’s view | Best practice. Keep a record of who gave it, when and how. | Not as reliable as express consent. |
| Where it stops | When the person unsubscribes, which has to be honoured within 5 working days. | When the person unsubscribes, which has to be honoured within 5 working days. |
The ACMA’s own example of inferred consent is a savings bank telling a customer about another savings account with higher interest. The same relationship, it says, would not cover the bank trying to sell that customer insurance. It also warns that automatically adding addresses to a marketing list after a one-off purchase, or after someone simply emails an enquiry, may breach the consent requirements.
For a business whose leads arrive through a form, this guide’s reading is that express consent is the natural fit: the form is where the person can see what they are agreeing to and say yes to it.
What every message carries
In the message itself
- Your name or business name, accurately identified
- Correct contact details for you or your business
- If someone else sends it for you, your business named as the one that authorised it, using its correct legal name, or your name and ABN
- Details that stay correct for at least 30 days after the message is sent
Getting someone else to do the sending does not move the duty. The ACMA says that even when another party sends your marketing, you must still have consent from each person who receives it.
The unsubscribe rules
Under the Spam Act, every commercial message must contain an unsubscribe option. The ACMA lists what that option has to do:
- present the unsubscribe instructions clearly;
- honour a request to unsubscribe within 5 working days;
- not require payment of a fee;
- cost no more than it normally costs to use that address (a standard text charge, for example);
- keep working for at least 30 days after the message was sent;
- not require the person to give extra personal information, or to log in to or create an account.
Text messages need particular care. A branded sender name at the top of an SMS generally cannot receive replies, so asking people to reply to it to unsubscribe means the process does not work, and the ACMA says that breaks the law. Separately, since 1 July 2026, texts sent with an organisation’s name at the top need that branded sender ID registered on the ACMA’s SMS Sender ID Register.
What the Act rules out entirely
- Using or supplying a list made with address-harvesting software
- Using or supplying address-harvesting software
- Helping, encouraging or being knowingly concerned in someone else breaking the spam rules
If a business breaks the rules, the ACMA can take enforcement action, and it publishes its recent investigations and penalties on its compliance and investigations page.