Spam Act 2003 and Cold Email to Australia: Consent and Penalties

Cold email to Australian recipients is legal only where the recipient has consented, expressly or by inference, to commercial messages. For B2B outreach the realistic basis is inferred consent from a conspicuously published work address: published with the person's agreement, with no "no unsolicited messages" statement next to it, and with your message relevant to their job. Every message must also identify you and carry a working unsubscribe.

This post quotes the Spam Act 2003 and the ACMA's Avoid sending spam guidance, then turns them into a checklist for a cold campaign. This is not legal advice. Read the sections yourself, and get advice if Australia matters to you.

Does the Spam Act apply to you?

Yes, if the message has an "Australian link", which covers most mail sent to people in Australia regardless of where you are based. Section 7 lists the triggers. A message has an Australian link if it originates in Australia, if the sender is in Australia, or if:

"the computer, server or device that is used to access the message is located in Australia; or ... the relevant electronic account-holder is: (i) an individual who is physically present in Australia when the message is accessed; or (ii) an organisation that carries on business or activities in Australia when the message is accessed"

A US or UK company emailing a Sydney prospect is caught, whatever the address's domain.

Section 6 defines a commercial electronic message by "the purpose, or one of the purposes" of the message, including to offer or promote goods or services, and it counts content reachable through the message's links. A "quick question" email that links to your pricing page is commercial.

The three rules for every message

Each commercial message needs consent, accurate sender identification and a functional unsubscribe. The ACMA: "If you plan to send marketing messages or emails, you must first have consent from the person who will receive them."

Rule	Section	What the text requires
Consent	s16(1)-(2)	No commercial message with an Australian link unless the account-holder "consented to the sending of the message"
Identify the sender	s17	The message "clearly and accurately identifies" who authorised it and how to "readily contact" them, valid "for at least 30 days after the message is sent"
Unsubscribe	s18	A clear and conspicuous unsubscribe statement and address, able to receive requests "at all times during a period of at least 30 days after the message is sent"

The ACMA adds: "Use the correct legal name of your business, or your name and Australian Business Number (ABN)." An unsubscribe must honour "a request to unsubscribe within 5 working days".

If you rotate cold email domains, an inbox used for an Australian send must keep receiving unsubscribe replies for 30 days after its last message.

Consent: express, inferred, and the one that fits cold email

Schedule 2 defines consent as express consent, or consent that "can reasonably be inferred" from conduct and relationships. The ACMA describes inferred consent mainly through an ongoing customer relationship, which a stranger does not have. The route that can fit cold B2B email is clause 4 of Schedule 2.

Clause 4(1) starts with a warning that catches a lot of senders:

"the consent of the relevant electronic account-holder may not be inferred from the mere fact that the relevant electronic address has been published."

Clause 4(2) then sets out the exception for conspicuous publication. Consent is taken to exist where all of these are true:

1. The address reaches a particular employee, director, officer, partner, office-holder or self-employed individual, or whoever holds a particular role or function in an organisation.
2. The address "has been conspicuously published".
3. It is "reasonable to assume that the publication occurred with the agreement of" that person, or of the organisation for a role address.
4. The publication is not accompanied by "a statement to the effect that the relevant electronic account-holder does not want to receive unsolicited commercial electronic messages at that electronic address".

Even then, consent only covers messages that are relevant to "the work-related business, functions or duties" of the person, or to the office, position, function or role behind a role address.

What that means in practice

Address source	Does clause 4(2) help?
Named address on the company's own team or contact page, no refusal statement	Can fit, if your offer is relevant to that person's role
sales@ or accounts@ published on the company site	Can fit for messages relevant to that function
Address guessed from a naming pattern, then verified	No. It was never published, so nothing can be inferred from publication
Address on a directory page that says "no unsolicited commercial email"	No. The refusal statement removes the basis

The ACMA's guidance adds that you remain responsible for bought lists: "You are still responsible for making sure you have consent for any addresses you use." And "Under the Spam Act, it's up to you to prove that you have a person's consent." Keep evidence for every contact.

You also cannot email first to ask permission. The ACMA says so directly: "You cannot send an electronic message to ask for consent, because this is a marketing message."

Harvested lists and scraping tools are banned for spam

Part 3 of the Act prohibits supplying, acquiring or using address-harvesting software, or a list produced with it, in connection with sending unlawful spam. The Act defines address-harvesting software as software "specifically designed or marketed for use for: (a) searching the internet for electronic addresses; and (b) collecting, compiling, capturing or otherwise harvesting those electronic addresses."

A harvested-address list is one whose production "is, to any extent, directly or indirectly attributable to the use of address-harvesting software." The acquire and use prohibitions do not apply where the use is not connected with sending messages that breach section 16, so a scraped list used to send without consent can breach the Act twice: under section 16 and under Part 3. The wider question of whether collecting business emails is legal in the US, UK and EU is covered separately.

Sending to dead addresses is its own contravention

Section 16(6) makes it a breach to send a commercial message to a non-existent address if you had no reason to believe it existed. The text:

"A person must not send, or cause to be sent, a commercial electronic message to a non-existent electronic address if: (a) the person did not have reason to believe that the electronic address existed"

So a blind send to pattern-guessed addresses is not just a deliverability problem in Australia; section 16(6) sits in the same higher penalty tier as sending without consent. Verifying a list before sending is one way to have a reason to believe an address exists, though it does nothing for the consent question. A hard bounce is the evidence that the address did not exist.

Penalties

Penalties are set in penalty units, per contravention, with a daily cap, and the Federal Court decides the amount on application by the ACMA. Section 25 sets the maximums. Sections 16(1), (6) and (9) carry double the units of the other provisions, such as sections 17 and 18.

Who	Prior record?	Per contravention (s16)	Daily total (s16)	Per contravention (other)	Daily total (other)
Body corporate	No	100 units	2,000 units	50 units	1,000 units
Body corporate	Yes	500 units	10,000 units	250 units	5,000 units
Other person	No	20 units	400 units	10 units	200 units
Other person	Yes	100 units	2,000 units	50 units	1,000 units

ASIC's fines and penalties page lists the Commonwealth penalty unit at $364 for contraventions on or after 1 July 2026. At that value, a company with no prior record faces up to $36,400 per unsolicited message and up to $728,000 for all such breaches on a single day. With a prior record the daily ceiling rises to 10,000 units, or $3,640,000. The ACMA can also issue infringement notices under Schedule 3 instead of going to court. Proceedings can start up to 6 years after the contravention (s26).

A checklist for an Australian cold campaign

1. Split out recipients with an Australian link by domain, company location and contact location.
2. Drop addresses you cannot tie to a conspicuous publication, including pattern guesses.
3. Record the URL, date and a screenshot for each published address, and check for a refusal statement.
4. Write a relevance note per contact, not per company.
5. Verify the list so you have a reason to believe each address exists. The single-address checker works for spot checks.
6. Include your legal name or ABN, contact details and an unsubscribe in every email, follow-ups included.
7. Keep inboxes able to receive unsubscribes for 30 days after the last send, and suppress requests within 5 business days.

If you also send to North America or the UK, the rules differ again: see CASL for Canada and CAN-SPAM, and for the UK GDPR and B2B cold email.

The Australian question to ask about each address is "where was this published, and is my email relevant to that person's job?" If you cannot answer both, do not send.