Australia’s Spam Act 2003 is a strict opt-in regime enforced by the Australian Communications and Media Authority (ACMA). It requires prior consent for every commercial electronic message (CEM), clear sender identification in the body, and a functional unsubscribe processed within 5 business days. Penalties are structured per day, not per message, and the ceiling reaches AUD 3.13 million per day for corporations. ACMA has issued more than AUD 20 million in fines since 2020, with Commonwealth Bank’s AUD 7.5 million penalty the largest to date.
Spam Act 2003 (Cth) · Act No. 129 of 2003 · In force since 10 April 2004 · Enforced by the Australian Communications and Media Authority (ACMA) · Applies to every commercial electronic message with an Australian link, sent from Australia or accessed on an Australian device · Max penalty: 10,000 penalty units per day for corporations (approximately AUD 3.13M) and 2,000 penalty units for individuals (approximately AUD 444,000), based on the current penalty unit value of AUD 313 (from 1 July 2023).
The three requirements
The Spam Act imposes three cumulative obligations on every CEM. Miss any one and the message is non-compliant even if the other two are correctly implemented.
- Consent. Express consent (documented opt-in) or inferred consent (existing business or personal relationship, or conspicuously published business address for a role-relevant message).
- Identify. The message must clearly identify the sender’s individual or business name and provide accurate contact information (mailing address, phone, or website URL) valid for at least 30 days after the send.
- Unsubscribe. A functional, low-friction unsubscribe facility valid for at least 30 days after the send, honoured within 5 business days per ACMA’s Standard.
Consent types
Who must comply
The Spam Act uses an “Australian link” test rather than a strict location test. A CEM is in scope if it originates in Australia, is sent from an account, service, or device located in Australia, or is accessed on a computer, mobile, or other device located in Australia. Foreign senders emailing Australian recipients are within scope regardless of where the sender is based; Federal Court proceedings against foreign entities are viable under Australia’s extraterritorial jurisdiction.
The Act covers email, SMS, MMS, and instant messages. B2B messages are in scope in exactly the same way as B2C; there is no business-to-business exemption. Directors and officers can be held personally liable under section 16(9), and vicarious liability extends to employers for employee conduct.
Penalties and enforcement
Per-day, not per-message. The Spam Act calculates civil penalties by the number of penalty units per day of contravening conduct. A corporation that sends more than 50 non-compliant CEMs on a single day faces up to 1,000 penalty units per day (approximately AUD 313,000); more than 500 messages a day pushes the ceiling to 10,000 penalty units (approximately AUD 3.13M per day). Enforcement has intensified since 2020: Commonwealth Bank AUD 7.5M (2023) plus AUD 3.55M (2022), Sportsbet AUD 2.5M (2024, largest infringement notice), Latitude Finance AUD 1.55M (2022), Ticketek, Woolworths, Uber, Kogan (AUD 310,800, 2021), and Telstra AUD 626,000 for self-reported breaches. ACMA received 5,700+ consumer complaints in Q1 2025 alone.
Compliance checklist
- Document consent source, timestamp, and exact language for every Australian subscriber
- Refresh inferred consent against the relationship context regularly, if the business relationship has ended, revert to express consent
- Include sender name, current business address, and one working contact channel in every CEM
- Provide a prominent unsubscribe link processed within 5 business days, valid for at least 30 days after each send
- Maintain a suppression list shared across all campaigns, subsidiaries, and third-party senders acting on your behalf
- Audit list origin before importing purchased, rented, or third-party contacts, if you cannot document consent, purge before sending
- Review outbound flow after any product launch or acquisition: legacy consents may not extend to the new context
Common misconceptions
“B2B email is exempt.” No. The Spam Act does not carve out B2B communications. Cold prospecting to Australian companies requires express or inferred consent, and inferred consent requires more than just a published address, the message must be relevant to the recipient’s role and no do-not-contact notice must be posted.
“Ten business days matches CAN-SPAM.” No. ACMA’s compliance guidance requires processing unsubscribe requests within 5 business days, not 10. This is a common trap for US-based senders operating a shared marketing stack.
“Adding factual content makes it exempt.” No. The designated commercial electronic message exemption is narrow: the message must contain factual information only, from a specific class of exempt sender (government, charity, political party, religion, or educational institution). Adding a link to a product page pulls the whole message back into standard scope.
“Penalties only hit banks and telcos.” No. Retail (Kogan, Woolworths), gambling (Sportsbet), finance (Latitude), and ticketing (Ticketek) have all been fined. The current ACMA priorities target volume offenders and unsubscribe failures, regardless of sector.
Frequently asked questions
Does the Spam Act apply to foreign senders?
Yes, under the “Australian link” test in section 7. A CEM sent from anywhere in the world is in scope if it is accessed on a device located in Australia. Federal Court proceedings against foreign entities are viable, and ACMA has cooperated with overseas regulators on cross-border cases.
How long does consent last?
Express consent is valid until the recipient withdraws it. Inferred consent based on an existing business or personal relationship stays valid while the relationship continues; ACMA has taken the view that a “reasonable time” after a transaction is generally considered to be around two years, but this is fact-dependent. Conspicuously-published-business-address consent lasts until the address is withdrawn or a do-not-contact notice is posted.
What are penalty units and how do they convert to dollars?
A Commonwealth penalty unit is the base measure for federal fines, updated periodically. The current value is AUD 313 (from 1 July 2023). Section 24 of the Spam Act sets the maximum at 100 penalty units per day for the first day and 2,000 per subsequent day for individuals, scaled up 5x for corporations to 500 and 10,000 respectively.
Do transactional emails need to comply?
Purely transactional messages (order confirmations, receipts, account updates, service disruption notices) are generally not commercial electronic messages under the Spam Act because they lack a commercial purpose. Adding promotional content, cross-sell offers, or upsell links converts the whole message into a CEM subject to full consent, identification, and unsubscribe requirements.
How does the Spam Act interact with the Privacy Act 1988?
The Spam Act governs the sending of CEMs; the Privacy Act governs collection, use, and disclosure of personal information (including email addresses) by organisations meeting the Australian Privacy Principles threshold. Both apply simultaneously. The Office of the Australian Information Commissioner (OAIC) handles Privacy Act complaints; ACMA handles Spam Act complaints. A single incident (for example, unauthorised marketing to an existing customer list) can trigger parallel proceedings under both regimes.
Where to go next
- CASL Canada, comparable opt-in regime with per-violation penalty structure
- CAN-SPAM Act (US), opt-out contrast for US-Australia cross-border senders
- GDPR compliance guide, EU baseline for Australian senders with European subscribers
- Email unsubscribe laws worldwide, global overview including Australia’s 5-business-day standard
Sending to an Australian list? Pre-validating recipient addresses with SMTPing before you press send catches disposables, catch-alls, and dead mailboxes that generate ACMA complaints from recipients who never gave valid consent. Thirteen validation types, twenty-five free checks daily, no card required. Try SMTPing free.
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
