Email and SMS marketing in Australia: the Spam Act made simple
What the Spam Act 2003 requires for business email and SMS, what consent means, what you can send to existing customers, and how to build compliant campaigns that still sell.
Email and SMS are still the highest return channels a business owns, and in Australia they come with a law that is actively enforced. The good news is that the Spam Act 2003 is simple once you know the three rules. This guide explains what counts as a commercial message, what consent really means, how unsubscribes must work, and how to run campaigns that sell without putting your business at risk.
It is general information, not legal advice. The Australian Communications and Media Authority (ACMA) publishes detailed guidance if you need to check a specific situation.
What the Spam Act covers
The Spam Act applies to commercial electronic messages with an Australian link, meaning they are sent from Australia, sent to an Australian address or number, or sent by an Australian business. That includes email, SMS, MMS and instant messages. A message is commercial if one of its purposes is to offer, advertise or promote goods, services, a business or an investment.
Voice calls are not covered by the Spam Act. Telemarketing calls fall under the Do Not Call Register Act 2006, which has its own rules.
Purely factual messages, such as an appointment confirmation, an invoice or a delivery update, are not commercial if they contain no promotional content. Add "book your next facial and save 15%" to that reminder and it becomes a commercial message that must comply.
The three rules
1. Consent
You need permission to send commercial messages. There are two kinds:
- Express consent is someone actively agreeing, for example ticking an unticked box on a form, signing up to a newsletter or telling you yes in writing. A pre ticked box is not express consent.
- Inferred consent comes from an existing business or other relationship where the person would reasonably expect to hear from you, such as a current customer receiving messages relevant to what they bought. It also covers business addresses that are conspicuously published, where your message relates to the person's role and there is no statement saying they do not want marketing.
Buying or renting a list is not consent, and using address harvesting software or harvested lists is specifically prohibited. If you are ever challenged, the burden is on you to prove consent, so record when, where and how each person opted in.
2. Identify yourself
Every message must clearly identify the business that authorised it and include accurate contact details. Those details need to stay valid for at least 30 days after sending. For SMS that means your business name in the message or as the sender ID, not just a mobile number people do not recognise.
3. A working unsubscribe
Every commercial email and SMS needs a functional way to opt out. The rules in practice:
- Unsubscribe requests must be honoured within five working days.
- The unsubscribe option must keep working for at least 30 days after the message is sent.
- It must be clear and easy to use: a link for email, reply STOP for SMS.
- It must not cost more than the normal cost of replying, and you should not make people log in or jump through hoops to leave.
Once someone unsubscribes, that applies to every list and every tool you use. The most common breach we see is a business that honours the unsubscribe in its email platform, then sends an SMS campaign from a different tool to the same person.
What about cold email to businesses?
Business to business cold email can rely on inferred consent only in narrow circumstances: the address is conspicuously published (for example on the company website), the message is directly relevant to the person's role, and there is no statement saying they do not want unsolicited messages. You still must identify yourself and include a working opt out. Emailing a general info address about something unrelated to that business does not qualify.
Cold commercial messages to consumers are far more restricted and, in practice, not worth the risk. Keep cold outreach to businesses, keep it relevant and keep the volume sensible.
Exemptions worth knowing
Some senders, including government bodies, registered charities, registered political parties and educational institutions writing to current or former students, can send certain "designated commercial electronic messages" without consent or an unsubscribe. They still have to identify themselves. Most businesses will not fall into these categories.
How the ACMA enforces it
The ACMA investigates complaints and has a range of tools: formal warnings, infringement notices, enforceable undertakings and civil penalty proceedings in the Federal Court. Penalties have run from hundreds of thousands of dollars for mid sized businesses into the millions for large brands. The most common causes are sending after an unsubscribe, unsubscribe links that did not work, and messages sent without consent that could be proven.
If your business is covered by the Privacy Act 1988, the Australian Privacy Principles also apply to how you use personal information for direct marketing, including offering a simple way to opt out.
Campaigns that sell and comply
- Welcome sequence after someone enquires or buys: three to five messages that build trust and answer common questions.
- Reminders and confirmations for appointments. Keep them factual and they are not commercial messages, which is why they are one of the easiest ways to reduce clinic no shows.
- Reactivation of past customers who went quiet: a friendly check in and an offer, sent to people with inferred consent through a genuine existing relationship.
- Review requests after a job or appointment, sent once, with a direct link.
- Seasonal campaigns for launches, offers and busy periods, to your opted in list.
Building it properly
Compliance is a system, not a checklist you remember each time. The setup we recommend:
- Consent capture on every form, with an unticked checkbox and a timestamp saved to the contact.
- Your business name as the sender on every email and SMS.
- Unsubscribe and STOP replies handled automatically and instantly, not within five days.
- One suppression list respected by every channel and every tool.
- A source field on each contact so you know how they joined your list.
This is configured once in your CRM and then it just works. It is standard in every BizFlo platform build and every email campaign we run. If you are choosing a platform, our comparison of GoHighLevel and HubSpot covers how each handles SMS and email.
Penalties are real
The ACMA regularly penalises Australian businesses, sometimes by hundreds of thousands of dollars or more, for sending to people who unsubscribed or never consented. Automation is cheaper than a fine.
Frequently asked questions
How long do I have to process an unsubscribe in Australia?
Five working days under the Spam Act 2003. Good systems process it instantly, which removes the risk of a campaign going out in the gap.
Can I email my existing customers without asking?
Usually yes, under inferred consent, if the message relates to your existing relationship and what they bought or enquired about. You still need to identify yourself and include a working unsubscribe.
Does the Spam Act apply to SMS?
Yes. It covers email, SMS, MMS and instant messages. Marketing SMS needs consent, your business name and an opt out such as reply STOP.
Are appointment reminders covered by the Spam Act?
Not if they are purely factual. Once a reminder includes an offer or promotion, it becomes a commercial message and all three rules apply.
Who enforces the Spam Act?
The Australian Communications and Media Authority. It can issue warnings and infringement notices, accept enforceable undertakings and take businesses to court for civil penalties. Want your setup checked? Book a free audit.