The Spam Act checklist for Australian business emails

Which emails does the Spam Act cover?

The Spam Act 2003 applies to commercial electronic messages: emails, SMS and instant messages that offer, advertise or promote goods or services. The ACMA's fact sheet notes that if only one part of a message is promotional, the message is still commercial.

That catches more than newsletters. The ACMA specifically calls out welcome journeys (automatic emails to new subscribers and customers), shipping emails that also advertise other products, and messages trying to win back customers who have cancelled. A bill or account notice can be commercial too, if it carries promotional content.

Messages with no advertising, such as appointment or payment reminders and notices about a service someone uses, are generally not spam, according to the ACMA. Every commercial message has to meet three rules: consent, identify, unsubscribe.

Rule 1: Do you have consent to email them?

You need consent from each person before you send them marketing, and under the Spam Act it's up to you to prove it. That stays true when someone else sends the emails for you: the ACMA is clear that a business can't outsource its obligations. There are two kinds of consent.

• Express consent: the person knowingly agrees to receive your marketing, for example by filling in a form, ticking a box on a website, over the phone or face to face. The ACMA calls this best practice.
• Inferred consent: in limited cases, where someone has knowingly given you their address and would reasonably expect marketing from you. That usually means an ongoing relationship, such as a subscription, account or membership, and marketing directly related to it. The ACMA says it doesn't cover emailing someone because they have just bought something from you.

Consent mistakes the ACMA sees

The ACMA recommends express consent based on clear terms that explain what the marketing is for, who will use it, how long it will be used and how to withdraw. Keep a record of who gave consent, when and how, because you must be able to produce it if the ACMA asks. These are mistakes its guidance warns about:

• Adding people to the marketing list automatically after a one-off purchase, or after they send an enquiry.
• Signing people up to marketing as a side effect of emailing them a receipt.
• Sending an email to ask for consent. That email is itself a marketing message.
• Buying or borrowing a list. You are still responsible for consent for every address on it, and lists built with address-harvesting software are banned outright.
• Emailing people who have unsubscribed to encourage them to re-subscribe.

Rule 2: Do your emails identify you?

Each message must accurately identify you or your business and include correct contact details. If an agency or platform sends on your behalf, the message must still identify you as the business that authorised it. The ACMA's advice is to use the correct legal name of your business, or your name and ABN.

Those details must stay correct for at least 30 days after the message is sent. If you change your contact details, keep the old ones working for at least 30 days after the last email that carried them.

Rule 3: Does your unsubscribe work?

Every commercial message must include an unsubscribe option that meets all of these:

• It presents clear instructions on how to unsubscribe.
• Requests are actioned within 5 working days.
• It costs nothing, beyond the usual cost of sending a reply.
• It keeps working for at least 30 days after the message was sent.
• It doesn't make the person log in, create an account or give extra personal information.

Setting up the Spam Act rules in your email platform

On addresses first: the ACMA's guidance asks for correct contact details and doesn't specify a street address. We include a mailing address anyway. Klaviyo recommends it, and some overseas laws, such as the US CAN-SPAM Act, require one.

In Klaviyo, the rest of the setup looks like this. Other platforms have equivalents.

• Sign-up forms say in plain words what people are signing up for, right next to the field, with a link to the terms.
• The platform records when and how each person subscribed, and you know how to export that record if you are ever asked for evidence of consent.
• The footer uses {{ organization.name }} and {{ organization.full_address }}, filled in under Settings > Organization. Enter the business's legal name, or your name and ABN, so the identification is accurate.
• Every email links to {% unsubscribe_link %} with wording that plainly says unsubscribe, plus {% manage_preferences_link %} for people who only want fewer emails.
• Automated emails get the same footer as campaigns: welcome series, abandoned cart and post-purchase emails included.
• Receipts and shipping emails stay free of promotions, or they are treated as commercial and given an unsubscribe.
• If you send marketing from more than one tool, such as your store platform and a separate email platform, an unsubscribe in one also stops the other within five working days. Treat any clear request to stop, however it arrives, the same way.

What happens if you get it wrong?

The ACMA investigates complaints and can take enforcement action. In July 2024 it reported that businesses had paid more than $15 million in spam and telemarketing penalties over the previous 18 months. It also says that if you realise you have broken the rules, telling it may help fix the issue quickly, and it may be resolved without further action.

Common questions

Do I need consent to email my existing customers?

Not automatically. The ACMA says inferred consent doesn't cover marketing to someone just because they bought from you. It usually relies on an ongoing relationship, such as an account or membership, with marketing directly related to it. Asking for express consent at checkout is the safer route.

How quickly do I have to process an unsubscribe?

Within 5 working days. The unsubscribe option in each message must also keep working for at least 30 days after that message was sent.

Can I email people to ask if they'd like to join my list?

No. The ACMA says you cannot send an electronic message to ask for consent, because that message is itself marketing.

Do welcome emails and receipts count as marketing?

Welcome journeys do: the ACMA says they often contain commercial content and must comply. A receipt or shipping notice with no promotion is generally not spam, but adding advertising to it makes it commercial.

Is this legal advice?

No. It's general information based on the ACMA's published guidance as at 30 September 2026. For advice on your own situation, speak to a lawyer or contact the ACMA.