Email Marketing Compliance in Australia: What You Need to Know

Email marketing in Australia is regulated by the Spam Act 2003, enforced by the ACMA. Non-compliance can result in significant penalties — but the rules are straightforward when you understand the three core requirements: consent, identification, and unsubscribe.

Obtain consent before sending

You need express or inferred consent to send commercial electronic messages. Express consent means the person actively opted in — ticking a box, filling a form, or verbally agreeing. Inferred consent applies in limited circumstances, such as an existing business relationship where the email relates directly to what they bought.

Clearly identify your business

Every commercial email must clearly identify the sender. Include your business name, ABN where appropriate, and accurate contact details. The “from” name and email address should not mislead recipients about who sent the message.

Include a functional unsubscribe mechanism

Recipients must be able to opt out easily, at no cost, and without logging in. Honour unsubscribe requests within five business days. Most email platforms handle this automatically — but verify your footer links work and that suppressed contacts are never re-added without fresh consent.

Understand the difference between B2B and B2C

The Spam Act applies to all commercial electronic messages, including B2B email. Sending to generic business addresses like info@ or sales@ without consent is risky. Targeted outreach to individuals at companies still requires a legitimate basis — typically express consent or a relevant inferred relationship.

Keep records of consent

Document when and how each subscriber joined your list: the form they used, the date, the IP address, and the exact wording they agreed to. If challenged, you need to prove consent was obtained. Your email platform’s signup logs are a good starting point.

Align with the Privacy Act where applicable

If your business turnover exceeds $3 million or you handle sensitive data, the Privacy Act 1988 also applies. Collect only the data you need, store it securely, and be transparent in your privacy policy about how subscriber information is used. Compliance protects your business and builds subscriber trust.