What the Spam Act 2003 actually requires from your business

If your business sends marketing emails, SMS promotions, or any other electronic message designed to drive a sale, the Spam Act 2003 (Cth) applies to you. It does not matter whether you are a sole trader running a Shopify store or a company with a full marketing team — the rules are the same, and the Australian Communications and Media Authority (ACMA) enforces them actively.

The Act is built around three obligations: you must have the recipient's consent before sending, you must clearly identify your business in every message, and you must give recipients a genuine and easy way to stop receiving your messages. This article explains each of those obligations in plain language, covers the one category of message that is handled differently, and walks through the places where businesses most commonly get it wrong.

What is a commercial electronic message

Before the three rules make sense, it helps to know what the Act actually covers. Under s 6 of the Spam Act 2003 (Cth), a commercial electronic message is one whose purpose is to advertise, promote, or offer goods or services — or to advertise the supplier of those goods or services. The same applies to land, investment opportunities, and business opportunities.

The message does not have to be primarily commercial. If any meaningful part of the message is designed to drive a sale or promote your brand, it falls within the definition. Newsletters, promotional SMS, abandoned cart follow-ups, loyalty programme updates, and win-back campaigns all qualify. The medium matters too: the Act covers email, SMS, MMS, and some instant messaging, but not every channel (for example, push notifications and social media direct messages are not covered by the Act, though other laws apply to those).

The Act only applies where there is an Australian link — under s 7, that is broadly satisfied where the sender is physically in Australia, the sender's organisation has its central management and control in Australia, or where the message is accessed on a computer or server located in Australia. In practice, if you are running an Australian business and messaging Australian customers, the Australian link is present.

Section 16 prohibits sending a commercial electronic message unless the recipient has consented. Consent is defined in Schedule 2 of the Act and comes in two forms.

Express consent is the cleaner of the two. The recipient has affirmatively opted in — by ticking an unticked checkbox, completing a sign-up form, or explicitly agreeing to receive marketing communications. If a recipient gives express consent, you have a solid foundation to send.

Inferred consent is available where consent can reasonably be drawn from the conduct and existing relationship between you and the recipient. The classic example is a repeat customer who would objectively expect to hear from you about related products. Critically, the Act makes clear that the mere publication of an email address — for instance, on a website or business directory — is not enough to infer consent. That is an easy trap to fall into when purchasing or renting contact lists from third parties.

Inferred consent is legally riskier than express consent for one practical reason: if ACMA investigates, the burden of establishing that consent existed rests on you. Express consent is far easier to evidence. As a matter of operational practice, use unticked checkboxes at sign-up, keep sign-up forms short and clear, and separate consent for marketing messages from consent to your general terms and conditions. Double opt-in (where you send a confirmation email the subscriber must click) adds a further layer of evidence.

One more point on consent: the Act does not distinguish between consumer and business addresses. Sending a marketing email to a work address or a business mobile number requires consent just as much as sending to a personal inbox.

Identification: the second obligation

Section 17 requires every commercial electronic message to clearly and accurately identify the individual or organisation who authorised the sending of the message, and to include contact information through which the recipient can readily reach that person or organisation. That information must be reasonably likely to remain valid for at least 30 days after the message is sent.

In practice, this means:

Your trading name or company name must appear in the message — not just a vague "from" label.
At least one genuine contact method must be included — a reply-to email address, a link to your contact page, or a phone number.
The sender name visible to the recipient must be consistent with how your business is actually identified.

The 30-day validity requirement is worth noting. If you are running a short-term promotional campaign using a temporary email address or a number that will go out of service, you may inadvertently breach s 17. Make sure the contact point you publish will still work for a month after the last send.

Unsubscribe: the third obligation

Section 18 requires every commercial electronic message to contain a functional unsubscribe facility. Under the Spam Regulations 2021 (Cth), the specific conditions that apply to that facility include:

The unsubscribe mechanism must remain operational for at least 30 days after the message is sent.
Once a recipient requests to unsubscribe, you must stop sending them commercial electronic messages within five business days of receiving that request.
You cannot require the recipient to provide any personal information beyond the email address or mobile number to which the message was sent in order to unsubscribe.
You cannot require the recipient to log in to an existing account, or create a new account, to unsubscribe.

The five-business-day window is a ceiling, not a target. Processing unsubscribes immediately is better practice and removes any ambiguity about when the request was received.

For SMS, "STOP" replies are the standard mechanism. For email, a one-click unsubscribe link that works immediately is the expectation. If your email service provider requires subscribers to confirm on a landing page, that is acceptable — but making it any harder than that puts you at risk.

One operational problem that comes up regularly is siloed suppression lists. A recipient who unsubscribes from your monthly newsletter must be suppressed across all your marketing flows — including SMS, transactional-with-promotional-content, and any third-party platforms you use to send. If your email tool and your SMS platform do not share the same suppression list, an unsubscribe in one channel may not flow to the other.

Designated commercial electronic messages: the factual message exception

Schedule 1 of the Act creates a category called designated commercial electronic messages. These are messages that consist entirely of factual information — with or without directly related commentary — and carry the name, logo, and contact details of the sender. They are exempt from the consent requirement in s 16 and from the unsubscribe obligation in s 18, though they still need to comply with the identification requirement in s 17.

Order confirmations, shipping updates, account security notices, and receipts generally fit this category when they contain no promotional content. The moment you add a banner, a cross-sell, a discount code, or language designed to encourage a further purchase, the message leaves the designated category and the full three-part regime applies.

This is a common misclassification problem. Many businesses add a "you might also like" block to their shipping confirmation emails without realising they have turned a transactional message into a commercial one. If you do that, you need consent for the whole message, your sender identification must comply with s 17, and you must include a working unsubscribe link.

Where businesses most commonly get it wrong

Buying or renting contact lists. The Act requires you to hold consent for your messages specifically — not consent that a list vendor obtained for their own purposes. If you cannot independently verify that each address on a purchased list has consented to receive commercial electronic messages from your business, you should not use it.

Pre-ticked checkboxes at checkout. This is not express consent. A box that is already ticked when the customer arrives at the checkout places the burden on them to opt out. Regulators view this as manipulative, and it will not satisfy the consent requirement.

Bundled consent. Burying marketing consent inside your general terms and conditions, or combining SMS and email consent into a single unclearly worded checkbox, makes it difficult to prove the recipient knew what they were agreeing to. Separate consent for separate channels is cleaner and more defensible.

Letting unsubscribes fall through the cracks. The five-business-day window can easily be missed if opt-out requests land in a general inbox, a customer service queue, or a platform that does not integrate with your main marketing tool. You need a defined process for capturing and acting on unsubscribes wherever they come from.

Adding promotional content to transactional messages. As noted above, a shipping update that includes a discount code is no longer a designated commercial electronic message. Keeping your transactional and marketing flows separate prevents this from happening accidentally.

Enforcement and what ACMA can do

ACMA can issue infringement notices, accept enforceable undertakings, and bring civil penalty proceedings in court. For companies without a prior record, the maximum civil penalty a court can impose is $626,000 per day of contravention. For companies with a prior record, that rises to $3,130,000 per day.

ACMA has pursued some significant matters in recent years. In October 2024, the Commonwealth Bank paid $7.5 million after ACMA found it had sent more than 170 million marketing messages — many of which either promoted products without an unsubscribe facility, or were sent to recipients who had not consented. The same bank had paid $3.55 million for similar breaches in 2023. The TAB paid just over $4 million in penalties in 2025 for sending SMS and WhatsApp messages to VIP customers that did not comply with the Act.

These are large organisations, but the Act applies equally to small businesses. ACMA's enforcement reports show that infringement notices are issued to businesses of all sizes, and the cost of defending an investigation far exceeds the cost of getting the basics right from the start.

How Artificer Legal can help

If you are setting up a marketing programme for the first time, reviewing your existing email and SMS flows, or dealing with an ACMA inquiry, a solicitor can help you work through the specifics of your situation. In practice, this often involves:

Auditing your existing consent records and sign-up processes to identify gaps.
Reviewing your message templates to confirm they satisfy ss 16, 17, and 18.
Mapping your suppression list processes across platforms to ensure unsubscribes are being honoured system-wide.
Advising on the interaction between the Spam Act and your obligations under the Privacy Act 1988 (Cth), including whether your collection of email addresses and phone numbers requires updating your privacy policy or collection notice.
Preparing or reviewing your response to an ACMA investigation notice.

Getting this right early avoids the much larger cost of remediation — or penalties — after a complaint is filed.

The bottom line

The Spam Act 2003 (Cth) sets three non-negotiable rules for every commercial electronic message your business sends: get consent before you send, clearly identify your business in the message, and give recipients a genuine and easy way to stop receiving your messages. The designated message exception for purely factual communications is narrow — the moment you add any promotional content, the full regime applies.

Key points to carry away:

Express consent is safer than inferred consent: use unticked checkboxes and keep records of how and when consent was obtained.
Your sender identification and contact details must remain valid for at least 30 days after the message is sent.
Unsubscribe requests must be actioned within five business days; the unsubscribe facility must remain live for at least 30 days after sending.
Suppression lists must flow across every channel and platform you use for marketing.
Purchasing contact lists is high-risk unless you can independently verify that each recipient has consented to receive messages from your business specifically.
ACMA actively investigates and penalises non-compliance — the civil penalty ceiling for companies with a prior record is $3,130,000 per day of contravention.