Cold email in Australia: the Spam Act 2003

When it applies

The Act covers commercial electronic messages, including email, that have an Australian link, for example because the message originates in Australia or the sender or recipient is connected to Australia in the ways the Act lists (Spam Act 2003).

1. Consent

You need consent before sending, including when someone sends on your behalf. Express consent (a form, a ticked box, a conversation) is best practice, and it’s up to you to prove you have it. You can’t send an electronic message to ask for consent (ACMA).

Consent can also be inferred. The ACMA describes inferred consent from an existing relationship, such as a subscriber, account holder or member, where the marketing relates directly to that relationship. Schedule 2 of the Act also allows consent to be inferred from a conspicuously published address, but only if:

• the address was published for work-related purposes and the account-holder agreed to the publication;
• the publication isn’t accompanied by a statement that they don’t want unsolicited commercial messages; and
• your message relates to their work-related business, functions or duties.

Consent can’t be inferred from the mere fact that an address was published.

2. Identify yourself

Each message must clearly and accurately identify the person or organisation who authorised it and give accurate contact details, which must stay valid for at least 30 days after sending.

3. Unsubscribe

Every commercial message needs a functional unsubscribe with clear instructions, honoured within 5 working days, free (beyond normal charges), working for at least 30 days after sending, and not requiring extra personal information, a login or an account.

Lists and harvesting

You stay responsible for consent on every address on a bought or rented list. Using or supplying lists made with address-harvesting software, or the software itself, is prohibited.

What every email needs

• Accurate identification of the business that authorised the message
• Accurate contact details, valid for at least 30 days
• A clear, free, functional unsubscribe that needs no login

What Inboxed does automatically

• Adds your company name and postal address to the footer of every campaign email, and blocks a campaign from launching until they’re set (Settings → Compliance, or per campaign).
• Adds a visible unsubscribe line and one-click unsubscribe headers (RFC 8058) to every campaign email. A click takes effect straight away, for everything your workspace sends, with no login or extra details asked.
• Treats replies such as “unsubscribe”, “remove me” or “stop emailing” as an unsubscribe.
• Keeps a suppression list that every campaign checks before each send. Unsubscribes and spam complaints can’t be removed by your team; you can also block whole companies by domain.
• Verifies every lead before sending and never charges for addresses that fail.

What you must do

Inboxed can’t decide who you may lawfully email. These parts are your responsibility:

• Have express or inferred consent for every Australian recipient, and keep evidence (for a published address: where it was published, when, and why your message fits their role).
• Not use bought lists you can’t verify consent for, or anything built by harvesting software.
• Make sure the business named in the footer is the one that authorised the message, and keep its contact details valid.
• Not send an email to ask for consent.

Penalties

Civil penalties are set in penalty units per contravention, with a daily cap, and are higher for anyone with a prior record (section 25). The ACMA can take enforcement action against businesses that break the rules.

Common questions