It usually starts innocently enough. Someone sends out a quick account update or a shipping notification, and because it seems helpful, a little product suggestion gets popped in at the bottom. Nobody thinks twice about it, because surely an order update isn’t marketing.
Unfortunately, the law sees it a little differently. In Australia, email marketing is covered by the Spam Act, and once a message starts promoting something, it generally has to follow the same rules as any other marketing email. The rules themselves are refreshingly simple, so here’s what they mean in practice and how to make sure every send stays on the right side of them.
What counts as a marketing email?
The Spam Act talks about “commercial electronic messages”, which is a formal way of describing any email or text that promotes or offers goods or services. Newsletters, sales, product launches and special offers are the obvious ones.
Messages that contain nothing more than factual information, like a receipt, a delivery update or an appointment confirmation, are treated differently and don’t need an unsubscribe. The catch is the phrase “nothing more”. Add a promotion to that factual message and it can become a commercial one.
That’s exactly what happened to Lululemon. Its order confirmations and shipping updates included promotional content, and the regulator ruled they were commercial messages, which meant they needed an unsubscribe option. If you’re ever unsure about a message, it’s safest to treat it as marketing.
Do you need permission to send?
Yes. Australia’s rules are opt-in, which means you need someone’s consent before you send them marketing emails. That consent can come in two forms:
- Express consent, where someone has clearly said yes, such as signing up to your newsletter or ticking an unticked box to hear from you.
- Inferred consent, which is much narrower and relies on an existing relationship where the person would reasonably expect to hear from you.
The important part is that the responsibility for proving consent sits with the sender, and that includes every address on a list you’ve bought. If you can’t show where someone’s permission came from, it’s worth asking whether they should be on the list at all. Lists like that tend to cause trouble beyond the legal side too, as Paul explains in his piece on email sender reputation.
What must every marketing email include?
Once you have permission, every marketing email needs two things to be compliant:
- Clear identification. The email has to accurately identify your business and include contact details that will stay valid for at least 30 days after you send it.
- A working unsubscribe. There must be a clear, functional way to opt out, and it can’t cost the recipient anything to use.
Neither of these needs to be complicated. A business name people recognise, a real contact address and an unsubscribe link that actually works will do the job. The ACMA has a helpful overview of how to avoid sending spam if you’d like to read the rules in full.
How quickly do unsubscribes need to happen?
When someone opts out, you have five working days to stop sending them marketing. The unsubscribe option also needs to keep working for at least 30 days after each email goes out, so a link that expires the following week won’t cut it.
In practice, the part that trips businesses up is rarely the unsubscribe link itself. It’s what happens afterwards. If someone opts out of your newsletter but is still sitting on a separate promotions list, or in an automated campaign that was set up months ago, they may keep hearing from you without anyone noticing. A single suppression list that applies across every list and every automation is the simplest way to make sure the people who leave stay well and truly left.
A good question to ask before every send is this: if someone wanted off your list right now, could they do it in one step, and would your next campaign actually skip them?
What happens if you get it wrong?
The ACMA is the regulator responsible for the Spam Act, and it has been taking the unsubscribe rules very seriously. A few recent examples show just how seriously:
- Lululemon paid a $702,900 penalty in March 2026 after sending more than 370,000 emails with commercial content and no way to unsubscribe. It also agreed to an independent review of its spam compliance and regular reporting to the ACMA.
- Latitude Finance paid a $3.96 million penalty in April 2026 over spam texts, after sending millions of marketing messages without accurate contact information, hundreds of thousands of which also lacked a working unsubscribe.
- In the 18 months leading up to the Lululemon announcement, businesses paid more than $6.7 million in spam penalties between them.
The same rules apply to texts as well as emails, which is why Latitude’s case belongs on this list. And these aren’t small operators caught out by obscure rules. They’re large, well-resourced businesses, which shows how easily a gap in a process can be repeated across a very large number of messages.
A quick pre-send checklist
Before your next campaign goes out, run through these:
- Everyone on the list has given consent, and you can show where it came from.
- Any “service” email that includes a promotion is being treated as marketing.
- Your business name and contact details are clear and accurate.
- Every marketing email has a working unsubscribe that’s easy to find.
- Unsubscribes are actioned within five working days.
- Opt-outs apply across every list and automated campaign, not just the one they clicked from.
If you also send marketing by text, our guide to SMS marketing rules in Australia covers the SMS side, including the Sender ID Register.
The takeaway
None of this is difficult once it’s built into the way you send. Get consent, say who you are, include a working unsubscribe and make sure it’s actioned quickly across everything you send. Do those things consistently and you can focus on writing emails people actually want to read.
The good news is that if you build your emails on Prodocom, an unsubscribe option is added for you automatically, which is one less thing to worry about. And if you’d like a second pair of eyes on your current setup, from your sign-up forms to your suppression list, get in touch and we’ll happily take a look.