Your business just drafted a new campaign brief. The creative team is excited, the copy is punchy, and the launch date is locked in. The question that usually surfaces at this point — "do we actually need a lawyer to look at this?" — is worth answering before the ads go live, not after the ACCC has made contact.
Marketing compliance in Australia draws on at least four separate regulatory regimes: the Australian Consumer Law 2010 (Cth) (ACL), the Spam Act 2003 (Cth), the Privacy Act 1988 (Cth), and — for businesses selling health products — the Therapeutic Goods Advertising Code. State-based permit rules add another layer for anyone running a competition or giveaway. None of these regimes are optional, and none of them map neatly onto one another.
The real question is not whether any of this applies to you — it almost certainly does — but which obligations are live right now, given what your business actually does, and how much of that you can manage in-house versus when you need specialist advice.
The false choice most businesses make
Many small businesses treat marketing compliance as a one-time box-tick: they download a privacy policy template, add an unsubscribe link to their email footer, and consider the job done. Others do the opposite and assume that every campaign needs a lawyer present from brief to publish. Both positions are wrong.
The underlying question is not "do I need a marketing lawyer?" in the abstract. It is: "at this particular growth stage, with these particular marketing activities, is my current legal setup adequate?" That framing produces a sharper answer because it forces you to look at what you are actually doing rather than what you assume marketing compliance looks like generically.
There is also a category of obligation that is easy to confuse with optional best practice. Carrying an unsubscribe link in marketing emails is not a matter of professional courtesy — it is required by s 18 of the Spam Act 2003 (Cth). Using a customer's email address for a promotional campaign you did not tell them about at collection is not aggressive marketing — it may breach Australian Privacy Principle 7 (APP 7) under the Privacy Act 1988 (Cth). These are not grey areas that get resolved by good intentions.
The laws that govern your campaigns
What the ACL prohibits in your campaigns
The ACL's three main advertising provisions are s 18, s 29, and s 33. Section 18 is the broadest: it prohibits conduct, in trade or commerce, that is misleading or deceptive or likely to mislead or deceive — regardless of intent. Section 29 prohibits specific false or misleading representations about goods or services, covering claims about quality, benefits, characteristics, and price. Section 33 addresses misleading conduct about the nature of goods themselves.
The practical consequence for campaigns is that subjective puffery ("the best coffee in town") sits in a different category from verifiable factual claims ("scientifically proven to reduce cholesterol by 20%"). The second type requires substantiation. Comparative advertising, "was/now" pricing, testimonials, and environmental or sustainability claims all carry elevated risk of a s 18 or s 29 breach. If your upcoming campaign contains any of these elements, a legal review before launch is cheaper than an ACCC investigation after.
The ACCC is the primary enforcement body. Civil penalties under the ACL for serious contraventions can reach the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover — figures that make even a brief legal review look economical.
Whether you send commercial electronic messages
The Spam Act 2003 (Cth) sets three requirements for commercial electronic messages (emails, SMS, instant messages):
- Consent: the message must be sent with the recipient's express or inferred consent (s 16). Purchased lists typically do not satisfy this requirement.
- Identification: the message must include accurate information identifying the sender (s 17).
- Unsubscribe facility: the message must contain a functional unsubscribe mechanism that operates for at least 30 days after the message is sent (s 18).
Inferred consent has a shelf life. If someone gave you their email address when enquiring about a product three years ago, that inference does not extend indefinitely. If your email list has not been audited against these requirements, that is a compliance gap worth addressing before your next send.
The Australian Communications and Media Authority (ACMA) enforces the Spam Act. Penalties for serious or repeated breaches can reach into the millions.
How you collect and use customer data for marketing
APP 7 of the Privacy Act 1988 (Cth) applies to organisations with an annual turnover above $3 million and to all health service providers regardless of size (among other categories). Under APP 7, an organisation must not use or disclose personal information for direct marketing unless certain conditions are met.
The clearest path to compliance is: you collected the information directly from the individual, they would reasonably expect you to use it for marketing, and you provide a simple way for them to opt out. If you sourced the data from a third party, or if the original purpose of collection was something other than marketing, you generally need explicit consent before using it for direct marketing.
The opt-out obligation under APP 7 is not satisfied by burying an unsubscribe link. The mechanism must be simple, free, and actioned within a reasonable period — the OAIC guidance treats 30 days as a practical outer limit.
For businesses below the $3 million turnover threshold, the Privacy Act may not apply, but the Spam Act consent and unsubscribe requirements still do, and so does APP 7 if you fall into one of the exempt categories (health, credit, tax file numbers).
Whether you run competitions or giveaways
Trade promotions that involve an element of chance — prize draws, sweepstakes, random giveaways — are regulated by state and territory gambling legislation, not the ACL alone. The permit thresholds vary:
| Jurisdiction | Permit required when total prize value exceeds |
|---|---|
| NSW | $10,000 |
| ACT | $3,000 |
| SA | $5,000 |
| VIC, QLD, WA, TAS, NT | Skill-based promotions generally exempt; chance-based vary — check locally |
Running a national promotion without checking each relevant jurisdiction is a common and avoidable mistake. A permit application takes time, and advertising a promotion before you hold the permit can itself be a breach. Terms and conditions must also be lodged or published in specific forms depending on the state.
Promotions structured as games of skill (where the outcome genuinely depends on skill, not chance) generally do not require permits, but the line between skill and chance is not always obvious — particularly for "most creative entry" style contests where a random tiebreaker is used.
Whether you sell health or therapeutic goods
If your products are listed on the Australian Register of Therapeutic Goods (ARTG) or make therapeutic claims, the Therapeutic Goods Advertising Code (the Advertising Code) applies on top of the ACL. The Advertising Code, which commenced 1 January 2022, requires that:
- Advertising contains the product's accepted indication as recorded in the ARTG entry.
- Mandatory statements are included in the prescribed form.
- Testimonials in advertising are genuine, unpaid, and not from people involved in the supply chain.
Paid or incentivised testimonials — including from influencers engaged to promote the product — cannot appear in therapeutic goods advertising. This rule catches many campaigns that would be entirely compliant for non-therapeutic products.
When a legal review is worth it
The pattern across these factors points to two distinct profiles:
Profile A — legal review is worth doing now
- You are launching a campaign with verifiable factual claims, comparisons to competitors, or testimonials.
- You are sending marketing emails to a list built over several years that has not been audited for consent.
- You are running a national prize promotion with a total prize pool above $3,000.
- Your products make health, wellness, or performance claims.
- You are using customer data obtained via a sign-up form for a purpose not clearly disclosed at collection.
Profile B — existing setup is probably adequate if maintained
- Your advertising is limited to brand awareness with no specific verifiable claims.
- You send marketing emails only to contacts who opted in explicitly in the last 12 months, via a platform that handles unsubscribes automatically.
- Your promotions are games of skill with no random element.
- You have a current privacy policy, a reviewed email consent workflow, and standard agency agreements that assign IP clearly.
Most growing businesses sit somewhere between these two profiles — and the gap usually opens up not because they made a bad decision, but because their marketing activity scaled faster than their compliance framework.
Where Artificer Legal can help you make the call
Getting to the right answer here involves two steps that are harder to do alone: mapping what you are actually doing against what each regulatory regime requires, and identifying which gaps are material versus which are theoretical.
An Artificer Legal practitioner can walk through your current campaign plans, email program, data collection flows, and any planned promotions — and give you a clear picture of where your exposure sits. That typically means reviewing your consent and opt-out processes against the Spam Act and APP 7, stress-testing any factual claims in campaign copy against ACL s 18 and s 29, advising on permit requirements for any planned competitions, and checking that your influencer or agency contracts assign the IP your business actually needs.
The documents that emerge from that work — updated privacy policy, reviewed email templates, competition terms and conditions, influencer agreements — are not just compliance instruments. They are also the foundation of a marketing program that can scale without creating liability as it grows.
Verifiable claims and undisclosed data use
The threshold question is not campaign size or budget. It is whether your marketing makes specific, verifiable claims — about price, quality, origin, health outcomes, or comparative superiority — or collects and uses personal information in ways that were not clearly disclosed to the individuals involved. Either of those factors puts you in territory where a legal review is more likely to pay for itself than not.
Businesses that skip legal review on the first campaign with a big factual claim, or that assume their email list consent "carries over" from year to year, are the ones who end up managing an ACCC inquiry or ACMA investigation rather than a marketing compliance checklist. The cost differential is not subtle.
Key points: Australian marketing compliance requires attention to the ACL (misleading conduct under s 18, false representations under s 29 and s 33), the Spam Act 2003 (Cth) (consent, identification, and unsubscribe requirements), APP 7 of the Privacy Act 1988 (Cth) (direct marketing use of personal information), state-based trade promotion permit thresholds (NSW $10,000, ACT $3,000, SA $5,000), and the Therapeutic Goods Advertising Code for health-related products. The point where legal advice becomes genuinely cost-effective is earlier than most businesses expect — typically when campaigns shift from brand awareness to specific factual claims, when email lists age past the original consent context, or when a competition crosses a state permit threshold.