Who must comply with the Spam Act 2003 (consent, identify, unsubscribe)?

All commercial electronic messages must have consent, identify the sender, and offer a working unsubscribe.

The Spam Act 2003 prohibits sending commercial electronic messages (email, SMS, instant messaging) without consent, requires accurate sender identification, and a functional unsubscribe facility (effective within 5 working days, no cost beyond the cost of sending the unsubscribe request, valid 30 days minimum). ACMA enforces; recent infringement notices exceed $1M.

Applies when the business has consumer customers and customer contacts or industry: E-commerce & online retail / Media & publishing / Telecommunications carriers / CSPs.

How the regulator frames it: Anyone sending commercial electronic messages in Australia or with an Australian link.

What triggers it: Sending commercial electronic messages.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: yes).

The answer is the same in every industry: yes. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "yes".

Size does not change the answer across all industries: at every size band the answer is "yes".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: applies. Sells to consumers · Holds customer contact details.

When due

Ongoing.

Frequency

Ongoing

Evidence to keep

Consent records, sender ID configuration, unsubscribe handling logs.

Status

Current

Priority

High

Maximum penalty: Civil penalties (Federal Court, per day): up to $728,000/day (first) or $3.64M/day (repeat) for a body corporate; plus ACMA infringement notices.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• ACMA infringement — Doordash (Spam Act) (2024): Tech / gig-economy marketing automation under sustained Spam Act enforcement.
• ACMA infringement notice — Uber Australia Pty Ltd (Spam Act) (2024): Express vs inferred consent records must be auditable per address. Unsubscribe must work within 5 business days and free of charge.
• ACMA enforcement — Commonwealth Bank (Spam Act) (2023): Marketing automation platforms must verify functional unsubscribe at scale. ACMA penalties on a per-message basis compound quickly.

• Comply with the Therapeutic Goods Advertising Code: Advertising of therapeutic goods to consumers must comply with the TGA Advertising Code and prohibited representations.
• Influencer + ad disclosure under ACL + AANA Code: Paid content must be clearly disclosed as advertising — #ad #spon are not enough on their own.
• Wash outbound marketing lists against the Do Not Call Register: Lists must be washed within 30 days of the call/SMS unless valid consent.
• Comply with AANA Code of Ethics + community guidelines: Self-regulatory advertising standards enforced by Ad Standards (formerly ASB).
• Loyalty programs must comply with ACL transparency + UCT: Loyalty program T&Cs governed by ACL — UCT regime + misleading conduct.

Rules Mate tracks 7 published obligations tagged "marketing", 0 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 1 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Regulated by Australian Communications and Media Authority.

ACMA: Telecommunications, broadcasting, radio, and online content regulator. Administers Spam Act, Do Not Call Register, telecom consumer codes.

• Australian Communications and Media Authority

Spam Act 2003: Prohibits unsolicited commercial electronic messages.

• Spam Act 2003

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)