The Spam Act 2003: Australia's Email Marketing Law Explained

By Sean McCoy2 November 20264 min read
Laptop showing an email inbox on a desk beside a potted succulent

The Spam Act 2003 is the Australian law that controls marketing emails, SMS and other commercial electronic messages. It has three core rules: you need the person's consent before you send, every message must clearly identify who sent it, and every message must include a working way to unsubscribe. The Australian Communications and Media Authority (ACMA) enforces the Spam Act, and breaches can lead to significant financial penalties.

What is the Spam Act 2003?

The Spam Act 2003 is a federal law that regulates "commercial electronic messages": emails, SMS, MMS and instant messages that promote goods, services, business opportunities or a business itself. It applies to messages sent from Australia, and to messages sent from overseas to Australian addresses or phone numbers.

It doesn't cover phone calls or faxes, which fall under the Do Not Call Register Act, and it doesn't stop you sending purely factual messages, such as an invoice or a booking confirmation, as long as they don't contain marketing.

What are the three rules of the Spam Act?

RuleWhat it means in practice
1. ConsentOnly send to people who agreed to receive messages (express consent), or where consent can reasonably be inferred from an existing relationship
2. IdentifyEvery message must clearly show who sent it, with accurate contact details
3. UnsubscribeEvery message needs a simple, working unsubscribe option, and requests must be honoured within five working days

Express consent is when someone actively agrees: ticking a box on a sign-up form, subscribing to a newsletter or asking to be added to a list. Keep a record of how and when each person agreed.

Inferred consent can apply where you have an existing relationship and the person would reasonably expect to hear from you, such as a current customer receiving news about related services. It's narrower than many businesses think, so express consent is the safer approach.

Pre-ticked boxes, bought lists and email addresses collected with harvesting software don't give you consent. Using address-harvesting software or harvested lists is itself prohibited under the Act.

What is the CAN-SPAM Act?

The CAN-SPAM Act is the United States email marketing law. It works mostly on an opt-out basis: businesses can email people without prior consent as long as they include an unsubscribe option and follow other rules. Australia's Spam Act is stricter because it's opt-in: you need consent first.

If you email Australians, follow the Australian Spam Act, even if your email platform is based in the United States.

Who enforces the Spam Act in Australia?

The ACMA enforces the Spam Act. It investigates complaints, issues formal warnings and infringement notices, accepts enforceable undertakings and can take businesses to court. The ACMA has penalised well-known Australian businesses for breaches, often for unsubscribe requests that weren't honoured or for marketing content inside messages that were meant to be purely factual.

Can someone be jailed for breaching the Spam Act 2003?

No. The Spam Act sets civil penalties, not criminal ones, so breaches don't lead to jail. The financial penalties can be large, though, especially for repeated breaches, and enforcement action is published, which can hurt a business's reputation.

What other email marketing laws apply in Australia?

Alongside the Spam Act, email marketing laws in Australia include:

  • The Privacy Act 1988: how you collect, store and use personal information, for businesses it covers
  • The Australian Consumer Law: claims in your emails must not be false or misleading
  • The Do Not Call Register Act 2006: telemarketing calls and faxes

What we see when regional businesses send marketing emails

The Spam Act problems we see most often aren't deliberate spam. They're everyday shortcuts: adding every customer from the accounting system to the newsletter without asking, importing business cards from a trade show, or sending from a personal inbox with no unsubscribe link. Each one can breach the Act.

When we set up email marketing for clients, sign-up forms record consent, every template includes the business's details and an unsubscribe link, and the platform handles unsubscribes automatically. Our Mailchimp and EDM design services build those basics in. Our guides to EDM marketing and email marketing for small business cover the rest.

This article is general information, not legal advice. For your specific situation, check the ACMA's guidance or speak to a lawyer.

Frequently asked questions

What is the Spam Act?

The Spam Act 2003 is the Australian law that regulates commercial emails, SMS and instant messages. It requires consent, sender identification and a working unsubscribe option.

Does the Spam Act apply to SMS?

Yes. Marketing text messages follow the same rules as emails: consent, identify and unsubscribe.

Are charities exempt from the Spam Act?

Some messages from registered charities, government bodies, political parties, religious organisations and educational institutions are exempt from the consent and unsubscribe rules, but they must still identify the sender.

How quickly must I process an unsubscribe request?

Within five working days. The unsubscribe option must keep working for at least 30 days after the message was sent.

How do you stop unsolicited emails?

Use the unsubscribe link in legitimate emails, mark obvious spam as spam in your email app, and report Australian spam to the ACMA.

Want email marketing that's set up properly from the start? Contact Rock Solid Marketing to talk to our team.

About Rock Solid Marketing

A marketing team that has helped businesses across Sunraysia and the Mallee since 2017, from our office on Deakin Avenue in Mildura.

Keep reading

All articles

Let’s Talk Marketing – Book Here

Let’s start by scheduling a free discovery call so we can get to know each other and see if we’re a good fit for your marketing needs.