Email Marketing Australia: Spam Act Rules and Best Practice
In March 2026, the Australian Communications and Media Authority announced a fine of A$702,900 against a well known retailer. Its offence was not sending something offensive or dishonest. The emails it sent did not have a working unsubscribe option. ACMA found it had done this hundreds of thousands of times over a matter of weeks. If a large company with a compliance team can get that wrong, a small business with a free email tool can too. Email marketing in Australia is still one of the best value channels you have, but it comes with clear rules. I am Jarryd Holmes from Bolder Digital, and full disclosure, we set up email and marketing automation for clients, so I have a stake. This guide covers the Spam Act in plain English, and then the practical steps that make your email land in the inbox and bring customers back.
Why Email Still Matters
Email is a channel you own. You are not at the mercy of a social media algorithm, and you reach people who have already said they are interested. For a small Tasmanian business, a simple monthly email to past customers can fill a quiet week, bring back lapsed customers, and ask for reviews. But because it is so easy to send, the law is strict about how you do it.
The Spam Act 2003 in Plain English
Australia’s Spam Act covers commercial electronic messages, which include email, SMS, MMS, and instant messages with an Australian link. It does not cover standard voice calls, which fall under separate telemarketing rules. It applies to every size of business, and to messages sent to business addresses as well as consumers. It rests on three rules.
1. Consent
You must have the recipient’s consent before you send a commercial message.
Express consent is a clear, active choice, such as ticking a box on a form, signing up in store, or agreeing over the phone. ACMA recommends it as the safest option.
Inferred consent comes from an existing relationship or the person’s conduct, but ACMA describes it as less reliable. A one off purchase generally does not create consent, even if the customer gave an email address for a receipt.
Business addresses can in some cases be emailed where the address is conspicuously published, the message is relevant to the person’s role, and there is no notice refusing unsolicited messages. Treat this as a narrow exception.
The burden of proof sits with you. If a complaint is made, you need to show how and when you got consent.
2. Identify yourself
Every message must clearly say who sent it, with accurate contact details, and those details should remain valid for at least 30 days after sending.
3. Unsubscribe
Every commercial message must contain a functional unsubscribe option.
It must be free and easy. Customers should not need to log in, create an account, or pay.
Requests must be honoured within five business days.
The facility should keep working for at least 30 days after the message is sent.
ACMA guidance suggests letting people opt out of all your marketing messages, not just one type.
What Counts as Commercial?
A message with a commercial purpose, such as promoting your goods, services, or business, is covered. Welcome emails and automated follow ups that promote your business count too. Genuinely transactional messages, such as receipts, booking confirmations, and password resets, are generally not treated as commercial. But adding a promotion to them can change that.
What Enforcement Looks Like
Recent cases show the regulator is active.
Lululemon, March 2026: fined A$702,900 for sending messages without a functional unsubscribe, found by ACMA across hundreds of thousands of messages in a few weeks.
Tabcorp, July 2026: paid more than A$2.7 million for telemarketing and spam breaches. ACMA noted that some customers had withdrawn consent for one channel without opting out of all marketing, and were still messaged.
Latitude Finance, April 2026: a penalty of A$3.96 million.
ACMA said in July that businesses had paid more than A$12 million in spam and telemarketing penalties over the previous 18 months.
Two lessons stand out. First, process failures count, and ACMA has been unsympathetic to businesses that blame technical errors. Second, unsubscribes must carry across all your tools, such as your email platform, CRM, and texting system, so a customer who opts out is not contacted by another system.
Building a List the Right Way
Use clear sign up forms that say what people will receive and how often.
Collect consent in person too, such as a tick box on a booking form or in store, and note when and how.
Consider double opt in, where people confirm by clicking a link. It checks the address is real and creates a record.
Keep records: the date, source, and wording used when each person agreed.
Do not buy or scrape lists. ACMA says the business sending to a list must hold evidence of consent, and the Act also restricts address harvesting.
Be careful importing old contacts. Not everyone in your phone or inbox has agreed to marketing.
Our guide to marketing automation for small business covers how this fits into your wider follow up.
Privacy
Privacy law can also apply to direct marketing, depending on your turnover and the type of business, so take advice on how it affects you.
The Technical Side: Getting Delivered
Following the Spam Act does not guarantee your email reaches the inbox. Gmail and Yahoo have tightened their rules, and Australian senders to those inboxes feel it.
Authenticate your domain. Set up SPF and DKIM, and publish a DMARC record, even a basic one. Gmail and Yahoo require all three from bulk senders, those sending about 5,000 or more messages a day. Below that, SPF or DKIM is the baseline, but doing all three is good practice.
Support one click unsubscribe. Bulk marketing email needs a one click unsubscribe header as well as a visible link, with requests honoured within about two days.
Keep complaints low. Providers expect a spam complaint rate below 0.3 percent, and ideally under 0.1 percent. Google’s Postmaster Tools shows your rate.
Send from your own domain, not a free webmail address, through a proper email platform.
Keep your list clean. Remove addresses that bounce, and consider pausing people who have not engaged for a long time.
If you are unsure, your email tool or an adviser can check the setup in minutes.
Best Practice for the Emails Themselves
Be honest. Use a recognisable sender name and a subject line that matches the content. Misleading subject lines also risk breaching consumer law.
Give value. Useful tips, seasonal reminders, and relevant offers beat constant sales pitches.
One goal per email. Make it clear what you want the reader to do, such as book, call, or reply.
Keep it short and mobile friendly. Most people read on their phones.
Write like a person. A real name, a simple layout, and plain language feel more trustworthy than heavy design.
Do not overdo frequency. Monthly is enough for many small businesses. More is fine if each one is useful.
Segment sensibly. Different messages for new customers, regulars, and lapsed customers work better than one blast.
Welcome new subscribers with a short email that says who you are and what to expect.
Emails Worth Setting Up First
a welcome email for new subscribers
a quote follow up
a review request after a completed job
a seasonal reminder to past customers
a gentle reactivation message for those who have gone quiet
a short monthly newsletter
What to Measure
Delivery and bounce rates, to check your list is healthy.
Clicks, replies, and bookings, which show real interest. Opens are less reliable now, since some email apps load images automatically and inflate them.
Unsubscribes and complaints, as a health check.
Revenue or enquiries, from each campaign.
Common Mistakes
no unsubscribe, or one that is broken or hard to find
unsubscribes that do not carry across all your tools
emailing everyone in your contacts, whether or not they agreed
buying or scraping lists
hiding or disguising who the sender is
skipping domain authentication
sending too often, or with misleading subject lines
adding promotions to transactional emails
ignoring replies to your emails
A 30 Minute Compliance Check
Open your last email. Is the sender clear, with accurate contact details?
Click the unsubscribe link. Does it work in one step, without a login?
Check how long an unsubscribe takes to apply, and whether it stops messages from every tool.
Look at how your last 50 subscribers joined. Can you show consent?
Test your domain authentication with your email tool or a free checker.
Check your spam complaint rate, if you send to Gmail users.
How Bolder Digital Helps
At Bolder Digital, we set up email marketing and automation that follows the Spam Act, handles consent and unsubscribes across your tools, and gets delivered. We build the welcome, follow up, review, and reactivation emails, and we check the technical setup with you. We often use GoHighLevel, and you can read about our GoHighLevel services. For texts, see our guide to SMS marketing in Australia.
The Bottom Line
Email marketing in Australia works well when you play by the rules. Get consent, say who you are, make unsubscribing easy and make it work everywhere, and keep records. Add proper domain authentication, honest subject lines, and emails worth reading. Do that, and email stays one of the cheapest, most reliable ways to keep customers coming back.
Frequently Asked Questions
Does the Spam Act apply to small businesses?
Yes. It applies to any commercial email or text with an Australian link, whatever your size or how many you send.
Do I need consent to email business customers?
Yes. The Act covers messages to business addresses as well. Consent can sometimes be inferred from a conspicuously published business address where the message is relevant to the person’s role, but it is a narrow exception.
Can I use a bought email list?
It is risky. ACMA says the business sending to a list must hold evidence of consent, and the Act also restricts address harvesting. Building your own list is safer.
How quickly must I honour an unsubscribe?
Within five business days under the Spam Act. Gmail and Yahoo expect faster, around two days, for bulk marketing email.
Do I need SPF, DKIM, and DMARC?
Gmail and Yahoo require all three from bulk senders, and SPF or DKIM from everyone. Even small senders should set them up, since it improves delivery.
Jarryd Holmes, Founder & Owner, Bolder Digital | Prospect Vale, Tasmania | bolderdigital.com.au
