The Spam Act and your email signup form in Australia

No phrasing of this question tested returns measurable Australian search volume, and that absence is the shape of the problem. Nobody researches email law before adding a newsletter box to a website. The Spam Act is nonetheless among the most commonly breached obligations attached to an ordinary business website: almost every site has a signup form, it is built in an afternoon by whoever built the site, and the rule it sits under gets read afterwards, if ever.

What follows is general information so that you know what to ask about. It is not legal advice, and whether a particular message complies turns on facts this page cannot see. The regulator is the Australian Communications and Media Authority, and anything here that bears on your situation belongs with ACMA or a lawyer.

What the Spam Act covers: commercial electronic messages

The Spam Act 2003 (Cth) regulates commercial electronic messages with an Australian link — email, SMS, MMS and instant messaging — where a purpose of the message is to advertise or promote goods, services or a business. There is no volume threshold: a single email can be a commercial electronic message. And it is the content and purpose that decide the question, not the label on the campaign in your CRM.

Three requirements, all at once

Consent, sender identification and unsubscribe: three separate obligations on every email

A commercial electronic message must be sent with consent, must accurately identify the sender and include contact details, and must contain a functional unsubscribe facility. These are separate obligations on the same message: consent obtained properly does not excuse a broken unsubscribe link, and a working link does not cure a list nobody agreed to join.

Why sender identification is the easiest of the three to get wrong

Sender identification is the easiest of the three to fail. The details must make clear who authorised the sending and stay accurate for a period afterwards, which ACMA states.

Express consent and inferred consent

What counts as express consent

Express consent is given directly and knowingly: a form filled in, a box the person ticked themselves, a request made.

What counts as inferred consent, and where its limits sit

Inferred consent is narrower than most businesses assume. It can arise from the conduct and the business relationship between the parties, and it can arise where a work-related address has been conspicuously published without a statement that unsolicited commercial messages are unwelcome, and the message is relevant to that person’s role. Neither limb licences emailing anyone whose address can be found.

Why a pre-ticked box or a bundled checkbox does not count as consent

A pre-ticked subscribe box records nothing about what the person wanted. Neither does a checkbox bundling “I agree to the terms” with “sign me up” — those are two decisions, and only one was in front of the person.

An existing customer relationship does not cover unrelated marketing

An existing customer relationship does not automatically create consent for unrelated marketing. Someone who bought one product may reasonably expect messages about that product; that is not agreement to a weekly promotion for a different part of the business. Relationships also go cold, and consent inferred from one that ended long ago weakens as it sits.

The unsubscribe has to work like an unsubscribe

What makes an unsubscribe facility genuinely functional

The facility must be functional and low-cost to use. Requiring the recipient to log in, create an account or pay a fee to leave a list is not an unsubscribe facility in any useful sense. It must stay live for a period after sending, and a request must be honoured within the period the rules allow. This page does not state that period, because a stale figure is worse than none. ACMA publishes it.

The real failure is usually suppression, not the link itself

The practical failure is rarely the link. It is suppression that applies in one system and not the others. Someone who unsubscribes from the newsletter platform and then receives the same campaign from the CRM or a sales mail merge has not been unsubscribed.

Transactional messages sit differently, and the boundary matters

Messages doing no more than conveying factual information are handled differently under the Act from messages that promote, and some organisations — government bodies, registered charities and educational institutions — have their own treatment. The boundary is decided by what is in the message. A receipt is a receipt. A receipt with a banner, a discount code and three product recommendations under it is not, and the safer assumption for a mixed message is that the marketing rules apply.

Harvested and purchased email lists

The Act deals separately with address-harvesting software and harvested-address lists, and supplying, acquiring or using them for sending is its own contravention alongside the consent rules. A purchased list is a list of people who did not agree to hear from you. The vendor’s assurance that they opted in is not consent you can demonstrate, because the wording used was not yours. The same goes for addresses scraped from websites or typed up from a conference attendee sheet.

Who is liable under Australian law when someone else presses send

The business is liable, not just the platform that sent the message

The Act reaches the business on whose behalf a message is sent, not only the party operating the sending platform. Engaging an agency does not move the obligation onto them, and an indemnity in that agreement allocates cost between the two of you rather than deciding how the regulator sees the sending.

What to ask a supplier managing your email list

Ask any supplier offering to handle the mailing list where consent records are stored. Ask whether the list sits in an account held in your business name, and what happens to it if the relationship ends. The ownership version of that question is in who owns your website.

The checklist for a compliant signup form

• Marketing consent as its own unticked, clearly worded choice, never bundled
• Point-of-capture wording naming the business, what is sent and how often
• Privacy policy linked from the form itself
• Date, time, page and exact wording shown stored against each subscriber, exportable
• Every message identifying the sender, with contact details that stay accurate
• One-click unsubscribe, honoured across every system capable of sending
• No purchased, scraped or inherited addresses anywhere in the stack

What to do next

Take your existing list and pick ten subscribers at random. For each, try to say when they subscribed, on what page, and what wording they saw. If that cannot be answered for a whole segment, that segment is the exposure, and what to do about it is a question for a lawyer with the records in front of them.

Confirm the current unsubscribe timeframe and sender-detail requirements with ACMA rather than any summary, including this one. The privacy obligations attaching to the same email address are separate, and are covered in website terms and privacy policy.

Consent, identification and unsubscribe are build requirements as much as legal ones, and they are decided when the form is specified rather than after it is live. Where that specification sits in a build is covered on web development services.