Slip 3 · Australian Privacy Principle 7

Direct marketing and privacy

Australian Privacy Principle 7 says an organisation covered by the Privacy Act must not use or disclose personal information for direct marketing unless an exception applies. Wherever an exception does apply, the organisation must let people opt out of the marketing and must honour the request.

General information, not legal advice. The OAIC regulates the Privacy Act; its APP guidelines, chapter 7 and its direct marketing guide are the places to check.

Who APP 7 applies to, and when

The Privacy Act applies to Australian Government agencies, to organisations with an annual turnover of more than $3 million, and to some other organisations. Most small businesses, those with a turnover of $3 million or less, are not covered, but some are regardless of turnover, including health service providers and businesses trading in personal information. The OAIC has a privacy checklist for small business on that page for working out which side of the line you are on.

APP 7 also steps aside where the Spam Act or the Do Not Call Register Act applies, and it still applies to whatever those Acts exempt. In practice the OAIC says it generally covers calls to numbers not on the register, mail and door-to-door marketing, targeted online marketing that uses a person’s information, and marketing through a mobile app that uses personal information to target it.

What “direct” means

Direct marketing uses or discloses personal information to communicate directly with a person to promote goods and services. A catalogue addressed to someone by name, or a social media ad chosen using data from cookies about websites they viewed, is direct marketing. A catalogue addressed “To the householder”, promotional flyers hand-delivered to local residents’ letterboxes, and website ads not selected using personal information are not.

Two ways in

For personal information that is not sensitive, APP 7 offers two exceptions, and which one you are under depends on where the information came from.

Collected from the person, who would expect the marketing

APP 7.2

You collected the information from the person
They would reasonably expect it to be used for direct marketing
You give a simple way to opt out
They have not opted out

From a third party, or without that expectation

APP 7.3

The person consented, or getting consent is impracticable
You give a simple way to opt out
Every marketing message carries a prominent statement that they can opt out
They have not opted out

The OAIC names the sources that put information behind the second door: data list providers, third-party mobile apps, and third-party lead generation and enhancement data. “Impracticable” is a high bar: an organisation is not excused from getting consent only because doing so would be inconvenient, time-consuming or cost something.

The “reasonably expect” test is objective, and the organisation has to be able to justify its conduct. The OAIC warns against assuming someone would welcome marketing because of their profession, interest or hobby.

Sensitive information

Sensitive information, which the OAIC describes as including health, political opinions, racial or ethnic origin and sexual orientation, can be used for direct marketing only with the person’s consent. That holds even where there is an existing relationship, and even where getting consent is impracticable or impossible.

The Privacy Act defines consent as express or implied consent, and the OAIC gives four key elements:

the person is adequately informed before giving it;
they give it voluntarily;
it is current and specific;
they have the capacity to understand and communicate it.

When a person makes a request

To stop the marketing. The organisation must not charge for it and must act within a reasonable period, which the OAIC says would generally be no more than 30 days.
To stop passing their information to others for marketing. The same rules apply: free, and within a reasonable period.
To know where their information came from. The organisation must say, unless that is impracticable or unreasonable, generally within 30 days.

The OAIC describes a simple opt-out as one that is clearly explained in plain English, takes minimal time and effort, uses a straightforward channel such as the one the marketing arrived by, and costs nothing or no more than a nominal amount.

Changes to the Privacy Act, as the OAIC describes them

The Privacy and Other Legislation Amendment Act 2024 changed the Privacy Act. The OAIC says the changes start on various dates, and that it is updating its pages to reflect them. Nothing in the summaries below is a change to the text of APP 7 itself; they are the OAIC’s own account of the wider reforms.

29 November 2024: The OAIC welcomed the passing of the Bill, listing among its measures a statutory tort for serious invasions of privacy, new tiers of civil penalties and the power to issue infringement notices, a Children’s Online Privacy Code, and a requirement for privacy policies to contain information about substantially automated decisions that significantly affect people’s rights or interests.
11 December 2024: The majority of the amendments within the Information Commissioner’s remit commenced.
10 December 2026: Organisations covered by the APPs must set out in their privacy policy any arrangement for a computer program to make, or help make, decisions that could significantly affect people’s rights or interests using their personal information. The OAIC published fact sheets and updated APP 1 guidelines on 30 September 2026.

Whether that last obligation touches a particular lead process, such as one that scores or filters enquiries automatically, depends on the facts; the OAIC’s fact sheet and flowchart are the place to start.