04 Jul Rules for Email Marketing in Australia
Email marketing remains one of the most powerful digital channels for Australian businesses, and it’s also one of the most heavily regulated. If you send electronic Direct Mail (eDM) campaigns, you must comply with the Spam Act 2003 (Cth), enforced by the Australian Communications and Media Authority (ACMA).
The Spam Act sets strict rules about how commercial emails can be sent, what they must contain, and how recipients can opt out. Non-compliance can result in penalties reaching millions of dollars, depending on the severity and repeat nature of the breach.
To legally send commercial eDMs in Australia, your campaigns must meet three core compliance pillars:
1. Consent – You must have permission first
2. Identity – You must state who you are
3. Unsubscribe – The ability to opt out must be effortless
These rules apply to every commercial electronic message with an Australian link, regardless of where the sender is located.
The Three Core Compliance Pillars for Email Marketing in Australia
1. Consent – You must have permission first
Under Australian law, you cannot send commercial eDMs without consent. Consent is the foundation of the Spam Act and the most common area where businesses breach compliance.
Buying or renting email lists is illegal, and the Act bans the use of address-harvesting software and any list generated from it.
There are two legal types of consent:
Express Consent, which is the best practice
Express consent is the gold standard and best option for every Australian business regardless of size. This is when a person gives express consent that they actively and knowingly agree to receive marketing messages.
This can occur by:
👍 Ticking a box on a website form. The box cannot be pre-ticked. It must be blank.
👍 Filling out a newsletter signup form
👍 Signing a physical printed form
👍 Giving verbal consent over the phone or face-to-face
Under ACMA’s Statement of Expectations, consent terms must be clear, accessible, and transparent about how the data will be used. You must also keep records of when, how, and by whom consent was given, as the responsibility of providing proof sits with the sender.
Inferred Consent, which is highly restrictive
Inferred consent is narrow, risky, and depends on the context of the relationship between the sender and the recipient.
It applies only when:
👌 There is an existing and active business relationship, and
👌 The customer has a reasonable expectation of receiving marketing messages related to that relationship.
Examples of this include a bank informing a savings account holder about a new savings product or a member of a subscription service receiving updates relevant to their membership.
Inferred consent does not apply when:
🫸 Someone simply buys a product once
🫸 The marketing message is unrelated to the existing relationship
🫸 The sender is promoting new categories (like selling insurance to a savings account holder)
Since inferred consent is so limited, relying on it carries high risk. It is strongly recommended to use express consent and only consider inferred consent when the campaign clearly marks all the requirements highlighted.
2. Identity – You must state who you are
Every commercial eDM must accurately identify the sender. This rule ensures transparency and accountability. It applies to every message, including those sent by charities, political parties, and government bodies.
The eDM must display:
🔎 Your legal business name
🔎 Your registered Australian Business Number (ABN) or the name of the business sending the message
🔎 Valid contact information including the physical business address, a phone number and a contact email address
This isn’t a one-off requirement. Every email sent must include these details, and the information must be valid for at least 30 days after the message is sent. It allows recipients to verify the sender and contact them if needed.
3. Unsubscribe – The ability to opt out must be effortless
Every commercial eDM must include a functional and prominent unsubscribe button or link. This is a heavily enforced section of the Spam Act.
The ability to unsubscribe must be free, simple, and immediate, with no multi-step processes. The recipient cannot be asked to log into an account, create a profile, or provide any information to unsubscribe. It must be a one-step process with no complications.
You must remove the recipient from your marketing list within 5 business days of their unsubscribe request. They subsequently cannot be added to any mailing lists regardless of their relationship with the business. They must opt in again.
The unsubscribe link must remain functional for at least 30 days after the eDM is sent.
Penalties for Non-Compliance
ACMA has issued over $20 million in fines since 2020, with penalties reaching up to $3.64 million per day for repeat offenders.
Examples of these enforcement actions include Commonwealth Bank ($7.5 million), Latitude Finance ($3.96 million), and Tabcorp ($2.7 million+ for combined breaches).
Q&A About Email Marketing Rules in Australia
Is email marketing legal in Australia?
Yes. But it is only legal if the email complies with the Spam Act 2023, which requires consent, sender identification, and a functional unsubscribe mechanism.
Can I buy email lists in Australia?
No. Buying, renting, or using harvested email lists is illegal
How quickly must I process an unsubscribe request?
Within 5 business days.
Does inferred consent apply to one-off purchases?
No. A single purchase does not create inferred consent, and you cannot send marketing emails to these clients. You can communicate with them about the purchase (e.g. providing a receipt or details about the delivery of a product).
Do charities and political parties need consent for email marketing?
They are exempt from consent and unsubscribe rules for messages about their own goods or services. They must still identify themselves.
Email Marketing in Australia is a Powerful Tool
This is a powerful tool but only when done legally. The Spam Act’s three pillars of Consent, Identity, and Unsubscribe form a strict opt in regime designed to protect consumers and ensure transparency. A compliant eDM strategy isn’t just about avoiding fines; it’s about building trust, improving deliverability, and strengthening long-term customer relationships.
If you’d like expert assistance with setting up an eDM campaign or a chat about the compliance of your email lists, I’m more than happy to help. Send me a message, and I’ll be in touch to see how I can help. I’m a digital marketing professional with extensive experience in many facets, including email marketing and developing workflows to automate your communications. Get in touch today to see how I can help.
No Comments