Yes, you may send commercial email and SMS in Australia, but only if you can prove consent, identify your business clearly, and provide a working unsubscribe link. These are the three non-negotiable duties under the Spam Act 2003, and you stay responsible for meeting them even when an agency or email platform sends the message on your behalf.
TL;DR:
- You must have provable explicit consent before sending commercial messages, especially when using purchased or scraped contact lists.
- An accurate sender identification and a functional, free unsubscribe link are mandatory, must be maintained, and honored within five days.
- From July 2026, businesses using branded SMS must register their sender ID, or it will be marked as “Unverified” on recipients’ phones.
- Non-compliance has led to large fines, such as Lululemon’s $702,900 penalty for a missing unsubscribe feature.
- Always retain timestamped consent records and enforce clear internal procedures to support regulatory investigations and ensure ongoing compliance.
Table of Contents
- What counts as a commercial electronic message?
- Consent, identification and unsubscribe: the three duties explained
- Designated commercial messages and when the rules shift
- Keeping proof of consent when you outsource your sending
- SMS Sender ID Register: what changes from July 2026
- Enforcement: what recent ACMA actions reveal about risk
- How to report spam and what to do if ACMA contacts you
- Your compliance checklist for this week
- Why compliance belongs at the centre of every email programme
- How we help you build a compliant email programme
- FAQ
- Sources
What counts as a commercial electronic message?
The Spam Act regulates “commercial electronic messages” (CEMs), which covers marketing emails, SMS and MMS that offer, advertise or promote goods, services or a business opportunity. A newsletter plug for a sale counts; a pure receipt or shipping update usually does not.
The law applies when a message has an “Australian link”: it is sent from Australia, sent to an address accessed in Australia, or sent by a business operating here. This catches overseas senders targeting Australian customers, not just local marketers.
- Promotional emails, SMS blasts and push-style marketing texts are all CEMs.
- Transactional messages like order confirmations are generally excluded.
- Certain government, charity and educational institution messages are treated differently as “designated” messages, covered further below.
Consent, identification and unsubscribe: the three duties explained
ACMA’s guidance sets out what you need before you hit send, and it boils down to three provable steps.
- Get consent first. Express consent comes from a clear opt-in, such as a signup form or checkbox. Inferred consent can apply when someone has an existing business relationship with you and would reasonably expect to hear from you, but it is narrower and easier to challenge.
- Identify yourself accurately. Every message needs accurate sender information, your business name and a working contact method such as an ABN, phone number or physical address, so recipients know exactly who is messaging them.
- Provide a genuine unsubscribe. The opt-out must be low-cost or free, simple to use, and honoured within five working days. The unsubscribe facility has to keep working for at least 30 days after the message is sent.
Each duty needs to be demonstrable, not just technically true, because Schedule 2 of the Spam Act places the burden of proving consent on the sender.
Designated commercial messages and when the rules shift
Schedule 1 of the Spam Act carves out “designated commercial messages” sent by registered political parties, government bodies, religious organisations, charities and educational institutions. These messages still need to identify the sender, but they are exempt from the consent and unsubscribe rules that apply to ordinary marketing.
Designation hinges on who sends the message and its purpose, not its format. A council sending a rates reminder qualifies; a council selling tickets to a paid community event through the same channel probably does not.
- Check the sender’s legal status against Schedule 1’s categories before relying on an exemption.
- Document the reasoning in writing, because ACMA can ask you to justify the designation later.
- Treat any commercial upsell inside a designated message as a separate CEM that needs its own consent trail.
Keeping proof of consent when you outsource your sending
Outsourcing to an agency or marketing platform does not transfer legal responsibility. You remain liable for consent, identification and unsubscribe failures even when a third party built the campaign or manages the send, a point privacy and e-marketing commentary reinforces repeatedly when discussing ACMA’s expectations.
Store a timestamped record of every opt-in: the source channel, the exact form copy or checkbox wording, the IP address where lawful, and the stated purpose of the consent. This record is what ACMA expects you to produce if a complaint lands.
Build audit rights into vendor contracts. Require your agency or platform to confirm unsubscribe handling, give you suppression list access and submit to periodic checks of their sending practices, a safeguard also recommended in agency-focused email guidance for businesses managing third-party senders. Our cookie consent and CMP wiring guidance covers the same consent logic for on-site data capture.
Pro Tip: Run a quarterly unsubscribe test by submitting a dummy opt-out and timing how long it takes to clear, rather than trusting the platform’s settings page.
SMS Sender ID Register: what changes from July 2026
From 1 July 2026, businesses sending branded text messages must register their sender ID on the SMS Sender ID Register. This is a new operational layer on top of the Spam Act’s existing consent and unsubscribe duties.
Telcos will label any unregistered sender ID as “Unverified” on the recipient’s handset, a change confirmed by business.gov.au that will visibly flag unregistered senders to every recipient.
- Any business using an alphanumeric sender ID for marketing SMS must apply before the deadline.
- Participating telcos will enforce the display rule automatically, so there is no opt-out once it is live.
- Keep a dated copy of your registration approval alongside your other compliance records.
Enforcement: what recent ACMA actions reveal about risk
ACMA has penalised large and small businesses for the same handful of failures: no functional unsubscribe, no provable consent, or ignoring opt-out requests already received.
| Business | Issue identified | Outcome |
|---|---|---|
| Lululemon | Missing functional unsubscribe facility | Penalised $702,900 |
| Telstra | Unsubscribe handling and record-keeping gaps | Enforceable undertaking requiring independent audits and staff training |
| Tabcorp | Spam Act compliance failures | Enforceable undertaking with remedial obligations |
The lululemon case also set an operational rule worth noting: you cannot require someone to log in or supply extra personal details just to unsubscribe. The address being removed is the only information you should need.
How to report spam and what to do if ACMA contacts you
If you receive unwanted marketing, you can forward it straight to the regulator.
- Forward spam emails to report@submit.spam.acma.gov.au.
- Forward spam text messages to 0429 999 888, as listed on ACMA’s reporting page.
- If ACMA contacts your business about a complaint, pull your consent records immediately and pause the relevant campaign.
- Appoint a single internal contact to liaise with the regulator and notify your marketing and legal stakeholders straight away.
Your compliance checklist for this week
Most enforcement action traces back to a handful of avoidable gaps. Work through these before your next send.
- Audit every list source and strip out purchased, scraped or unverified addresses.
- Require a timestamped opt-in record for every subscriber, including source and exact consent wording.
- Standardise your email footer with your business name, ABN and a real contact method across every template.
- Automate the unsubscribe link and test it manually each month to confirm it processes within five working days.
- Write unsubscribe and audit obligations into every agency or platform contract, including suppression list access.
- Keep consent and unsubscribe records on file and schedule a monthly internal compliance check.
Pro Tip: Assign one person to own the suppression list end to end, because split ownership between marketing and IT is where unsubscribe requests quietly fall through the cracks.
Why compliance belongs at the centre of every email programme
Compliance is not a legal checkbox sitting separate from deliverability, it is the same discipline. A missing unsubscribe link or an unverifiable consent record damages sender reputation just as much as it invites an ACMA complaint, and the two risks compound each other quickly.
We focus on consent capture, sender identification and unsubscribe testing in email and SMS programmes, because a clean compliance record protects the revenue the campaign is meant to generate.
— Liza
How we help you build a compliant email programme
We treat compliance as part of performance, not a separate task bolted onto a campaign. Our email marketing services include consent capture wiring, unsubscribe automation and testing, and an audit report that shows exactly where your current lists and templates stand against the Spam Act’s three duties.
If your business sends marketing email or SMS in Australia and you want a second set of eyes on your setup, book a discovery call through our growth strategy services and we will walk you through what a compliance-ready programme looks like for your list.
FAQ
Which emails are illegal under Australian spam law?
Emails sent without valid consent, without accurate sender identification, or without a working unsubscribe facility all breach the Spam Act 2003. Purchased lists and scraped addresses are especially high risk because consent cannot be proven for them.
How can I report spam emails in Australia?
You can forward spam emails directly to report@submit.spam.acma.gov.au, and spam text messages to 0429 999 888, both listed on ACMA’s reporting page. ACMA uses these reports to identify repeat offenders and trigger investigations.
What penalties can businesses face for Spam Act breaches?
Penalties vary by case and are set through infringement notices or enforceable undertakings rather than a fixed per-message fine. Lululemon was penalised $702,900 for a missing unsubscribe facility, while other businesses have faced enforceable undertakings requiring audits and staff training.
How do I stop getting unwanted marketing messages permanently?
Use the unsubscribe link in the message itself, since legitimate Australian senders must honour it within five working days under ACMA’s rules. If the sender ignores your request or the message looks like a scam, forward it to ACMA for investigation.
Sources
- Avoid sending spam | ACMA
- Spam Act 2003 — Federal Register of Legislation
- Business
- Lululemon penalised $702,900 for Spam Act breaches | ACMA
