Privacy laws
The Privacy Act 1988 (Cth) governs how Australian businesses collect, use and share personal information, and it reaches further into digital marketing than most practitioners expect. The 13 Australian Privacy Principles touch everything from what you can collect at sign-up to whether you can retarget a website visitor to what happens when you upload a customer list to a social platform for audience matching.
The traps that catch marketers most often are secondary use and overseas disclosure. Data collected for one purpose (a purchase, a competition entry, a newsletter sign-up) cannot simply migrate into retargeting audiences or third-party lookalike matching without a proper basis. Passing records to offshore ad platforms counts as an overseas disclosure under the Act whether or not you think of it that way. Since December 2024, serious breaches attract civil penalties up to AUD 50 million per contravention; that changes the risk calculus for consent gaps that once seemed administrative.
We map your marketing data pipeline against the Australian Privacy Principles, identify where current practices create exposure, and draft the consent language and data handling terms that close those gaps. That typically covers sign-up flows, email platform terms, tracking pixel arrangements and any audience matching you run through ad platforms.
Intellectual property
The Copyright Act 1968 (Cth) vests copyright in the creator by default, not the brand that commissioned or paid for the work. The only mechanism that changes this is a written assignment signed by the creator. Moral rights (the creator's right of attribution and right of integrity) cannot be assigned at all; a separate written consent is required before the brand can edit, crop or repurpose a work. Where an agency subcontracts production to freelancers, the chain of title breaks at every link where a signed assignment is absent.
What well-run marketing programmes do is build assignment and consent into the briefing process, not the dispute. Creator agreements and production contracts are signed before shoot days. Moral rights consents are included in the same document. Agencies are required to confirm in writing that they hold the rights they are passing downstream, and to produce their freelancer agreements if asked. That costs almost nothing extra at the start of a campaign and avoids the harder question of content ownership arising after the work has been published.
Consumer protection laws
The Australian Consumer Law, contained in Schedule 2 to the Competition and Consumer Act 2010 (Cth), prohibits misleading or deceptive conduct in trade or commerce without any requirement of intent. The test is the effect on a reasonable member of the target audience, not the brand's state of mind.
In influencer marketing, where a brand has input or control over content, the brand bears primary liability for non-disclosure, not the influencer. A December 2023 enforcement sweep by the ACCC confirmed its position that commercial relationships must be disclosed clearly and upfront: at the start of a caption or in the opening seconds of video, using language (#ad, #sponsored, Paid Partnership) that leaves no ambiguity. Tags such as #sp, #collab or "gifted" are not sufficient.
The practical consequence is that your content guidelines and briefing documents carry legal weight. If they do not specify placement and language for disclosure, you cannot demonstrate that you took reasonable steps to ensure compliance. The maximum corporate penalty rose to AUD 100 million per contravention from 28 March 2026.
Anti-spam laws
The Spam Act 2003 (Cth) prohibits sending commercial electronic messages to Australian addresses without consent. It covers email, SMS, MMS and instant messaging. Consent must be express (documented) or inferred from a current commercial relationship; a published email address is not consent. Every message must carry a functional unsubscribe mechanism, and opt-out requests must be processed within five business days.
The enforcement record over the past two years makes the stakes concrete. CommBank: AUD 7.5 million in August 2024 for more than 170 million messages sent without valid consent. Tabcorp: AUD 4 million in June 2025. Pizza Hut: AUD 2.5 million in April 2024. In each case the underlying failure was the same: consent records that could not survive scrutiny, or unsubscribe mechanisms that did not function as required.
What breaks compliance is scale. The larger the list and the longer it has been running, the more likely some segment was onboarded under terms that do not hold up. A consent audit before the next campaign is substantially cheaper than enforcement after.
