The three rules

  1. Consent. You need permission to send commercial messages. It can be express (they ticked a box or asked to subscribe) or, in limited cases, inferred from an existing relationship.
  2. Identify yourself. Every message must clearly say who sent it and how to contact you.
  3. Unsubscribe. Every message must include a working way to opt out, and you must honour requests within five working days.

The rules are enforced by the ACMA.

What counts as commercial

A message is commercial if one of its purposes is to promote your goods or services: newsletters, offers, product announcements, event invitations. A quote you were asked for, or a reply to a customer’s question, is not, although adding promotional content to it can change that.

  • Use an unticked box on your forms: “Send me news and offers.”
  • Record when and how each person gave consent.
  • Don’t add people to your list just because they gave you a business card or sent an enquiry, unless your relationship clearly supports it. When in doubt, ask.
  • Never buy email lists.

Writing a compliant marketing email

  1. Send only to people who have agreed to hear from you.
  2. Use a sender name and address people recognise.
  3. Include your business name and contact details.
  4. Include a clear, working unsubscribe link.
  5. Remove unsubscribed people within five working days.

Inferred consent can apply where there is an existing relationship and the message relates to it, such as telling a current customer about a related service. It is narrower than many businesses assume. Publishing an email address on a website doesn’t automatically mean the owner agrees to receive marketing. If you aren’t sure, ask for express consent: it is clearer and easier to prove.

Keeping records you can rely on

For each contact, record whether they gave consent, when and how. If a complaint is made, those records are your evidence. Keep unsubscribe requests even after a contact is archived, so they aren’t accidentally re-added later.

A worked example

A café catering business wants to send a monthly newsletter. It adds an unticked “Send me news and offers” box to its order form, records consent on each customer’s record and includes its business name, address and an unsubscribe link in every email. When a customer replies “please stop”, the team updates their preference the same day. Simple habits, consistently followed, keep the business on the right side of the rules.

Quick checklist

  • Get consent before sending marketing messages.
  • Use an unticked opt-in box on your forms.
  • Record when and how consent was given.
  • Identify your business in every message.
  • Include a working unsubscribe link.
  • Honour unsubscribes within five working days.
  • Never buy email lists.

Keep a record in your CRM

Store each contact’s consent status and any unsubscribe request on their record, so every person sending email can see it. NovaSoft One records communication preferences on each contact and takes them into account for supported outbound email.

Common questions

Do the Spam Act rules apply to text messages?

Yes. They apply to commercial emails, SMS, MMS and instant messages.

Can I email someone who gave me their business card?

Possibly, if the context makes consent reasonable to infer, but it is safer to ask. Inferred consent is narrower than many people assume.

Can we buy an email list?

No. Bought lists almost never come with valid consent for your messages.

How quickly must unsubscribes be honoured?

Within five working days.

Who enforces the Spam Act?

The Australian Communications and Media Authority (ACMA).

This guide is general information for Australian businesses, not legal, tax or financial advice. Check anything specific to your situation with a qualified adviser or the relevant government agency.