Under the Spam Act 2003, you must not send unsolicited commercial electronic messages without consent, and every message you do send needs accurate sender identification and a working unsubscribe option. This applies to email, SMS, MMS, and instant messages with an Australian link. ACMA enforces it, and the Spam Act 2003 sets the rules. Get consent, identification, and unsubscribe right, and you’re largely covered.
TL;DR:
- Businesses must record and retain clear proof of both express and inferred consent for each contact, as unenforced or vague records increase legal risk.
- All commercial messages require sender identification with accurate business or individual details and a valid contact method, regardless of the platform used.
- Unsubscribe options must be functional, simple, and honored within five working days, and they should remain active for at least 30 days post-campaign.
- Exempt categories like government, charities, political parties, and educational institutions do not need consent but still must meet identification obligations.
- Operational failures like disconnected suppression lists or unintegrated systems often cause violations, making proper IT and staff training crucial for compliance.
Table of Contents
- What the Spam Act covers and which messages are regulated
- Consent: express vs inferred, and how to prove it
- What sender identification must be shown in every message
- Unsubscribe rules: how they must work and by when
- Who is exempt from the Spam Act?
- Practical compliance checklist for Australian businesses
- Enforcement, remedies, and how to report spam to ACMA
- Why compliance is an IT problem as much as a legal one
- Get your messaging systems compliance ready with Techbug
- Sources
- FAQ
What the Spam Act covers and which messages are regulated
The Spam Act 2003 regulates any “commercial electronic message,” which means anything that markets, advertises, or offers goods, services, or business opportunities. This isn’t limited to email. The legislation covers whatever channel you use to send it.
Channels caught under the Act include:
- Email newsletters and promotional campaigns
- SMS and MMS marketing texts
- Instant messages sent through apps with a commercial purpose
Switching platforms doesn’t get you out of your obligations. A business that gets caught out on email compliance and shifts its campaigns to SMS is still bound by the same rules, because the Act is channel neutral. It also has an “Australian link”, meaning a message sent from overseas can still fall under Australian law if it’s sent to, or originates from, an Australian address. Businesses assuming offshore sending tools put them outside local jurisdiction are often wrong.
Consent: express vs inferred, and how to prove it
Consent is the foundation of the entire Act, and ACMA’s guidance treats it as an exercise in managing expectations rather than ticking a legal box. There are two recognised types.
- Express consent — the recipient actively opts in, usually by ticking an unticked box, submitting a form, or agreeing to clear terms at sign-up.
- Inferred consent — reasonably assumed from an existing business relationship, from the recipient directly supplying their contact details, or from a clear expectation that messages of that kind would follow.
Businesses should record the date, time, exact wording shown to the recipient, channel used, and stated purpose for every consent captured. Sprintlaw’s compliance guidance recommends treating this record like any other legal evidence, because in a dispute, you carry the burden of proving consent existed.
Avoid pre-ticked checkboxes, vague “our partners” language, or asking for consent inside a marketing message itself. That last one is a common trap: you can’t send an unsolicited message asking someone if it’s okay to send them messages.
Pro Tip: Keep a simple spreadsheet or CRM field logging exactly how and when each contact opted in. If ACMA or a customer ever challenges your record, “we’re pretty sure they signed up somewhere” won’t cut it.
What sender identification must be shown in every message
Every commercial electronic message needs to clearly identify who sent it and how the recipient can get in touch. This isn’t optional, and it doesn’t shift just because a message looks casual or short.
A compliant message needs:
- The name of the business or individual sending it
- Accurate contact details, such as a phone number, email, or postal address
- An ABN or equivalent registration number where relevant to the industry
If you outsource your email marketing or SMS campaigns to an agency or automation platform, you’re still responsible for what goes out under your brand. The outsourced sender must be clearly authorised to act for you, and your business details, not just the vendor’s, need to appear in the message. A compliant sender block might read: “Sent by Example Pty Ltd, ABN 12 345 678 901. Contact us at [email protected].” Skip this, and you’re exposed even if a third party pressed send.
Unsubscribe rules: how they must work and by when
An unsubscribe facility has to actually function, not just exist for show. Acceptable mechanisms include a reply-based option (such as replying “STOP”) or a one-click unsubscribe link, and Business notes that a reply-based system carries more operational risk unless it’s monitored daily and wired into your suppression process.
The Spam Regulations 2021 set firm timing requirements:
- Honour unsubscribe requests within 5 working days
- Keep the unsubscribe facility functional for at least 30 days after the message was sent
- Never charge a fee, require account login, or demand extra personal information to process the request
Common pitfalls include forcing recipients to log in to “manage preferences” or asking for a reason before processing the opt-out. Both create friction the law doesn’t allow.
Pro Tip: Maintain one central suppression list that every sending tool checks before a campaign goes out. Disconnected lists across your CRM, email platform, and SMS vendor are the single biggest cause of accidental re-sends to people who already opted out.
Who is exempt from the Spam Act?
Not every business message needs consent. The Australian Law Reform Commission’s review of the Spam Act confirms the Act specifically targets commercial messages, and carves out designated categories that fall outside the consent requirement.
Exempt categories generally include:
- Messages from government bodies and their agencies
- Registered charities communicating with supporters
- Registered political parties during election-related activity
- Educational institutions messaging current students
- Purely factual messages with no commercial promotion attached
Exemption from consent doesn’t mean exemption from everything else. Identification obligations can still apply, and other legislation picks up where the Spam Act leaves off. The Privacy Act and Australian Consumer Law still govern how personal information is collected and how claims are made in marketing, regardless of whether the Spam Act’s consent rule applies to that particular message.
Practical compliance checklist for Australian businesses
Turning the legal requirements into daily practice comes down to five habits.
- Audit your consent records. Separate express consents from inferred ones so you know which contacts need stronger justification before you message them.
- Centralise your suppression list. Sync it across your CRM, marketing automation platform, and any outsourced sender so an opt-out in one system applies everywhere. DLA Piper’s review of e-marketing failures points to poor list synchronisation as one of the most common operational breakdowns.
- Test your unsubscribe flow on every channel. Confirm it works end to end and log how long processing actually takes.
- Check SMS sender ID registration. From 1 July 2026, branded SMS sender ID registration becomes a requirement, so confirm your business is registered before that date.
- Put contractual controls on your vendors. Any agency or platform sending on your behalf should be contractually bound to the same consent and identification standards, with routine checks to confirm they’re following through.
Pro Tip: A data retention policy that covers consent records and suppression lists does double duty. It protects you under the Spam Act and helps with broader privacy obligations at the same time.
Enforcement, remedies, and how to report spam to ACMA
If you’re receiving unwanted commercial messages, you can forward spam emails or report SMS spam directly through ACMA’s official complaint channels. Before you report, keep the original message intact, including full headers, timestamps, and any record of unsubscribe attempts you already made.
ACMA can investigate complaints and take enforcement action against businesses breaching the Act, including formal warnings and financial penalties for serious or repeated violations. What it can’t do is give you personal legal advice or personally block messages from reaching your inbox.
- Forward suspicious emails to ACMA’s designated reporting address
- Report SMS spam by forwarding the text to ACMA’s short code
- Retain evidence: original message, sender details, and your unsubscribe history
If you’ve suffered real loss from repeated spam law violations, such as ongoing messages after a clear opt-out, AJ Buckingham’s analysis of spam enforcement notes that this is where speaking to a lawyer about a private remedy becomes worth considering, separate from lodging an ACMA complaint.
Why compliance is an IT problem as much as a legal one
Most Spam Act breaches Techbug sees among Australian small businesses aren’t deliberate. They’re the result of a marketing platform, a CRM, and an outsourced agency that don’t talk to each other, so an unsubscribe request lands in one system and gets ignored by the other two.
That’s an operational failure dressed up as a legal one, and it’s exactly the kind of gap that proper email security, monitoring, and staff training close. IT support providers work with Australian small and medium businesses on the infrastructure side of this problem daily, from securing email systems to training staff on the processes that keep consent records clean. Legal obligations only stick when the systems behind them are built properly. If your unsubscribe process runs on hope rather than a synced suppression list, that’s worth a conversation.
— Ru
Get your messaging systems compliance ready with Techbug
Techbug is the practical alternative to guessing your way through spam compliance. Where a legal opinion tells you what the rules say, Techbug’s IT security work fixes the systems that actually enforce them, from suppression list syncing to secure email configuration and staff training on handling consent records properly.
Vendor-agnostic advice means you get technology recommendations that suit your business, not whatever a single provider is selling. Techbug’s managed IT services cover proactive monitoring, ransomware-safe backups, and staff training that directly reduces the operational risk behind spam law breaches, alongside multi-factor authentication and ongoing account management. Given that 42% of cyberattacks target small businesses, tightening your email and messaging systems does double duty: it protects you from threats and keeps your marketing compliant.
If you’re not sure whether your current setup would hold up under an ACMA complaint, get in touch with Techbug for a compliance review of your email and messaging infrastructure.
Sources
For the full legal detail behind everything covered here, go directly to the primary sources rather than relying on summaries.
FAQ
Is It Illegal to Send Someone Spam?
Yes. Sending unsolicited commercial electronic messages without consent breaches the Spam Act 2003, and ACMA can take enforcement action against businesses that do it. Penalties scale with the severity and repetition of the breach.
Who Is Exempt From the Spam Act?
Government bodies, registered charities, registered political parties, and educational institutions messaging their own students are generally exempt from the consent requirement, according to the ALRC’s review of the Act. Purely factual messages with no commercial promotion also fall outside the Act’s scope.
Can I Sue if I Keep Getting Emails After Unsubscribing?
You can pursue a private remedy if a business ignores your unsubscribe request beyond the 5 working day requirement, though most people report the issue to ACMA first. For serious or ongoing breaches causing real loss, legal advice is worth seeking before taking court action.
Is It Illegal to Not Have an Unsubscribe Button on Emails in Australia?
Yes. Every commercial electronic message must include a functional unsubscribe facility that stays active for at least 30 days, a requirement set out in the Spam Regulations 2021. Missing or broken unsubscribe links are one of the most common Spam Act violations ACMA acts on.