The Spam Act 2003 requires consent, accurate sender and contact details and a working unsubscribe for non-exempt commercial emails, SMS and instant messages with an Australian link, and the sender honours an unsubscribe request within 5 working days. The Australian Communications and Media Authority (ACMA) enforces the Act and the Spam Regulations. The ACMA states that the rules apply to any business that markets to Australian consumers by email or SMS, whatever its size or turnover. A single promotional link turns an order confirmation into a commercial message: in March 2026 Lululemon paid a A$702,900 penalty for more than 370,000 service emails with marketing content and no unsubscribe, and in April 2026 Latitude Finance paid A$3.96 million for more than 2.7 million breaches.
What the Spam Act Covers, and Who It Applies To
The Spam Act applies to commercial electronic messages: emails, text messages and instant messages that contain an offer, an advertisement or a promotion. The ACMA's spam rules for consumers set out the three things a sender of marketing messages does: it first has the recipient's consent, it includes its contact details in the message, and it gives the recipient a way to say "stop". Messages are generally not spam when they carry no advertising, are appointment or payment reminders, notify a service or product fault, or are about a service the recipient uses. Telemarketing calls are not spam; the Do Not Call Register Act 2006 and other rules cover those.
Which messages count as commercial?
Any electronic message that contains promotional or sales content is commercial, whatever its other purpose. ACMA Authority Member Samantha Yorke said so when the ACMA penalised Lululemon on 11 March 2026 for delivery and order confirmation emails that also had a clear marketing purpose. The ACMA described it as its fifth enforcement action in 18 months against businesses that treated messages as non-commercial when they contained, or linked to, clearly commercial material. Its list of common issues and mistakes adds that breaches occur even when a message is mostly factual, such as a bill or account message with promotional content, and that automated "welcome journeys" and retention messages that contain promotional or sales content are commercial and follow the spam rules.
Does the Spam Act reach messages sent from outside Australia?
Yes, when the message has an Australian link, and section 7 of the Act gives several ways a message gets one. A message has an Australian link when, among other tests, it originates in Australia; the individual or organisation who sent or authorised it is physically present in Australia, or has its central management and control in Australia, when it is sent; or the computer, server or device used to access it is located in Australia. A campaign run from overseas to subscribers who read their email in Australia meets the last of those tests.
Which organisations have an exemption?
The ACMA names registered charities, government bodies, registered political parties and education institutions contacting current or former students among the organisations that send marketing messages without consent, and they still include their contact details. The ACMA gives these as examples on its consumer page. It adds that an email or SMS seeking to influence a vote or opinion is rarely covered by the spam rules, because the rules apply only to messages that offer, advertise or promote goods or services. Non-exempt commercial messages with an Australian link follow the consent, identification and unsubscribe rules; exemption status depends on the message and the conditions the Act sets, not only on the type of sender.
What penalties has the ACMA applied?
The ACMA's spam penalties in 2026 include A$702,900 for Lululemon and A$3.96 million for Latitude Finance, each alongside a court-enforceable undertaking. On 15 April 2026 the ACMA reported that Latitude Finance paid A$3.96 million after sending more than 2.3 million marketing messages without accurate contact information between March 2024 and April 2025, 344,416 of them also without a working unsubscribe, and that businesses had paid over A$10.6 million in spam penalties over the previous 18 months. Latitude's messages told recipients to reply "STOP", but many of them were not capable of being used that way. On 22 July 2026 the ACMA reported that Tabcorp Holdings (TAB) had paid more than A$2.7 million for breaches of the spam and telemarketing laws.
General guidance, not legal advice.
What the Spam Act Means for Your Email, SMS and Landing Page Copy
Consent wording on a sign-up form, the sender line in a footer and the unsubscribe instruction in every message are pieces of copy, and each one carries a Spam Act rule. The ACMA's guidance for businesses states that consent comes first, that the message identifies the sender and its contact details, and that unsubscribing is easy. Under the Spam Act, the sender carries the burden of proving consent. The table maps common copy and list decisions to the rule behind each one.
| Claim type | What the rule says | What to check | Source |
|---|---|---|---|
| Sign-up forms and checkboxes | Express consent means the person knows and accepts that marketing will arrive; it is given by filling in a form, ticking a box, over the phone or face to face | Consent wording beside each checkbox, and a record of who consented, when and how | ACMA, Avoid sending spam |
| Consent terms | The ACMA recommends express consent based on clear terms that explain what the marketing is for, who uses it, how long it is used and how consent is withdrawn | Terms that sit where consent is given | ACMA, Consent expectations, 1 July 2024 |
| "Opt in?" emails | An electronic message asking for consent is itself a marketing message | No consent requests sent to addresses without consent | ACMA, Avoid sending spam |
| Existing customers | The ACMA describes inferred consent arising where the person knowingly and directly gave the address and the marketing directly relates to a provable ongoing relationship; a one-off purchase or an enquiry alone does not establish consent | Lists that add buyers or enquirers automatically | ACMA, Avoid sending spam; Common issues and mistakes |
| Sender details | The message accurately identifies the business by its correct legal name, or its name and ABN, with correct contact details that stay correct for at least 30 days | Footer, sender name and reply address in every template | ACMA, Avoid sending spam |
| Unsubscribe | Clear instructions, honoured within 5 working days, no fee, no more than the usual cost of using the address, working for at least 30 days, and no extra personal information, log-in or account | The unsubscribe link or reply instruction in every email and SMS | ACMA, Avoid sending spam |
| SMS sender IDs | Alphanumeric sender IDs generally do not receive replies, so a "reply STOP" instruction to a sender ID does not work and breaks the law | The reply path on every SMS | ACMA, Common issues and mistakes |
| Order, shipping and welcome emails | Any promotional or sales content makes the message commercial | Product links and offers inside service messages | ACMA, Lululemon penalty, 11 March 2026 |
| Bought lists and agencies | The business stays responsible for consent for every address it uses, including when someone else sends for it; lists built with address-harvesting software are banned | Each list's source and the terms with any sending partner | ACMA, Avoid sending spam |
Sources: ACMA, Avoid sending spam, updated 29 November 2024; ACMA, Consent expectations for businesses using direct marketing, 1 July 2024; ACMA, Telemarketing and e-marketing: common issues and mistakes, updated 15 December 2025; ACMA, Lululemon penalised $702K for spam breaches, 11 March 2026. All checked 24 October 2026.
What does a compliant unsubscribe instruction look like?
A compliant instruction tells the reader in plain words how to stop the messages, and it works from the message itself. The ACMA gives these clearly worded examples: for email, "To stop receiving messages from us, simply reply to this email with 'unsubscribe' in the subject line." or a line pointing to an "unsubscribe" button below; for SMS, "Reply STOP" or "Unsub: (1800-number)". Unsubscribing asks for nothing beyond the email address or number being removed, unless the person agreed otherwise in advance, and the business generally stops the marketing within 5 business days of the request.
Do welcome emails and re-subscribe messages need consent?
Welcome emails and re-subscribe messages that carry commercial content need consent and an unsubscribe, and the ACMA reports that welcome journeys often contain commercial content. The ACMA reports businesses sending welcome journeys to new and prospective customers without adequate consent and unsubscribe processes. It also flags paperless receipts that add buyers to marketing lists without apparent consent, and it names emails or SMS encouraging people who have withdrawn consent to resubscribe or become customers again as a possible breach.
General guidance, not legal advice.
What the Spam Act Means for AI Answers and AI-Generated Content
The Spam Act attaches to the message and to the business that sends or authorises it, so an email or SMS drafted with an AI tool, or sent by an automated sequence, meets the same consent, identification and unsubscribe rules as any other. The ACMA states that when someone else sends messages on your behalf, the message still identifies you as the business that authorised it. Its common-mistakes page adds that businesses do not outsource their spam obligations by using third parties or bought lists: the business stays responsible.
Is an email drafted by an AI tool held to a different standard?
No: the rules apply to every commercial electronic message, whoever or whatever wrote it. An AI drafting tool that adds a product recommendation or a discount code to a service email makes that email commercial, and an unsubscribe instruction rewritten by a tool still has to work from the message. The practical checks stay the same for every draft: consent for each address, a correct sender line and a working unsubscribe.
Where does the Privacy Act fit alongside the Spam Act?
APP 7 of the Privacy Act does not apply to the extent the Spam Act applies, so the Spam Act sets the consent and unsubscribe rules for marketing email and SMS, while the Privacy Act keeps covering how a covered business collects and protects the personal information on its lists. The OAIC's APP 7 guidelines state the carve-out (APP 7.8). The OAIC's guidance on commercially available AI products recommends, as best practice, that organisations do not enter personal information into publicly available generative AI tools, which applies to subscriber lists as much as to any other data. The Australian Privacy Principles marketing guide covers those obligations.
General guidance, not legal advice.
How Aemorph Checks Claims Before Publication
Aemorph does not run or coordinate email or SMS marketing for clients, and your nominated point of contact signs off every regulated claim in the search, ads and content Aemorph writes before Aemorph publishes it. Aemorph runs SEO, SEM, content and AI visibility. It is not a law firm, it does not review your email or SMS programme against the Spam Act, and it does not confirm that any message complies: as the sender, or the business that authorises the sending, yours holds those obligations. The ACMA educates businesses about the spam rules and states that it gives no legal advice.
| Check | Applies to | Standard | Checked against | When |
|---|---|---|---|---|
| Regulated claims in content Aemorph writes | Every client | Approved by the person your business nominates | Your point of contact's sign-off | Before Aemorph publishes |
| Business facts in your verified record | Every client | The facts your business supplies and approves, used as supplied | Your point of contact's sign-off | Before publication |
| Access to your accounts | Every client | Client-owned assets, named accounts with only the access the work needs, ISO 27001-aligned practice | You hold ownership of each account | From kick-off |
Source: Aemorph compliance practice, October 2026.
Who signs off the claims on your pages?
Your business picks the approver: the business owner, the chief marketing officer or the risk team. A regulated claim goes live only after that person approves it. Aemorph takes the business facts you supply as true and correct and does not check them independently, so the facts in your verified record are the facts your business supplies and approves.
General guidance, not legal advice.
Australian Businesses: Build Search and AI Visibility on Approved Claims With a Free Strategic Conversation
Australian businesses that want their search, ads, content and AI visibility coordinated from claims their own reviewers approve start with a free strategic conversation with Aemorph. Aemorph is headquartered in Singapore, has no office in Australia, serves Australian clients remotely in Australian business hours and replies to every message within 24 hours. The digital marketing page explains how Aemorph coordinates SEO, SEM, content and AI visibility for Australian businesses, with BizCover, Remarkable Furniture and Smile Team as Australian references.
Disclaimer: This article reflects Aemorph's reading and understanding of the laws, regulations and official guidance cited, based on the sources and review dates stated. It provides general information, not legal advice, and does not assess compliance for your specific circumstances.