Australia's Spam Act: Cold Email Rules for B2B Senders

Australia's Spam Act 2003 is enforced by the Australian Communications and Media Authority (ACMA), and it's been enforced with real financial teeth in recent years — this isn't a law that only exists on paper. It applies to any commercial electronic message sent to, from, or via an account held in Australia.

The Three Core Requirements

Every commercial electronic message sent under Australian jurisdiction needs three things: consent from the recipient (express or inferred), clear identification of who sent it, and a functioning unsubscribe mechanism. Missing any one of the three is a separate basis for a Spam Act violation.

Express vs Inferred Consent

Express consent is the recipient explicitly agreeing to receive commercial messages from you. Inferred consent exists too — it covers situations where consent can reasonably be inferred from the recipient's conduct or an existing business relationship, which is what makes some B2B cold outreach viable in Australia without a prior opt-in.

The catch: if a complaint or investigation happens, the burden of proving consent existed sits with the sender, not the recipient. Express consent is straightforward to prove — you have the opt-in record. Inferred consent requires you to demonstrate the reasonable basis after the fact, which is a harder position to defend than most senders assume going in.

What Counts as a Commercial Electronic Message

The Spam Act's definition is broad: any electronic message that offers, advertises, or promotes goods or services counts, and that includes messages that read as informational on the surface — a "here's a new feature we shipped" email can still qualify if it's promoting your product. Don't assume a softer, less sales-forward message tone moves you outside the Act's scope.

Unsubscribe Timing

ACMA's enforcement pattern gives a clear practical benchmark: continuing to send messages more than five business days after someone unsubscribes has been treated as a violation in real cases. The unsubscribe mechanism itself also has to be genuinely simple — ACMA has penalized businesses for requiring excessive personal information to process an opt-out, or for requiring account login just to unsubscribe.

How ACMA Enforces This

ACMA has been actively enforcing the Spam Act, not just holding it in reserve. In a recent 12-month enforcement period, nine investigations resulted in penalties exceeding A$8 million combined, with the largest single fine reaching A$3.55 million. Companies penalized in recent years include household names — DoorDash was hit with an infringement notice over A$2 million for contraventions spanning 12 days, and other cases have touched Ticketek, Woolworths Group, and Uber.

Penalties

Penalties are calculated in penalty units and scale with message volume. As a concrete benchmark: a business sending more than 50 commercial electronic messages without consent in a single day is liable for 1,000 penalty units — A$313,000 at the post-July-2023 unit value. Because the calculation scales with volume and can apply per day of contravention, real exposure for a sustained non-compliant campaign can run well past that single-day figure.

Practical Spam Act Compliance for Cold Email

For B2B outreach into Australia: favor express consent where you can get it, keep a documented basis for any inferred-consent list, identify yourself clearly in every message, and build unsubscribe handling around a 5-business-day standard rather than the 10-day windows common elsewhere. See our unsubscribe requirements reference table for how this compares across every jurisdiction in this guide.

FAQ