Spam Act Australia: Email, SMS and Text Marketing Rules Explained

The Spam Act 2003 (Cth) regulates commercial email, SMS, MMS and instant messages sent with an Australian link, requiring consent, accurate sender identification and a working unsubscribe facility; it does not cover voice telemarketing calls, which are regulated separately under the Do Not Call Register Act 2006.

This page covers the Spam Act's own rules for email, SMS, MMS and instant messaging. Voice calls and telemarketing, including how to register on the Do Not Call Register, are covered on The Do Not Call Register in Australia, and the calling-hours and conduct rules that apply to every telemarketing call are covered on Telemarketing Rules in Australia.

What the Spam Act Covers

Section 5 of the Spam Act defines an "electronic message" as a message sent using an internet carriage service, or another listed carriage service, to an electronic address connected with an email account, an instant messaging account, a telephone account or a similar account. It does not matter whether the address actually exists or whether the message ever arrives. Section 6 then defines a "commercial electronic message" as one that, judged by its content, presentation and any linked contact details, has the purpose of offering, advertising or promoting goods, services, land, a business or investment opportunity, or that is designed to help someone dishonestly obtain property or a financial advantage by deception.

Section 7 sets the jurisdictional trigger, an "Australian link," which exists if the message originates in Australia, the sender or an organisation's central management is in Australia when it is sent, the device used to access it is in Australia, or the account-holder is an individual physically in Australia, or an organisation carrying on activities in Australia, when the message is accessed.

Section 5(5) is the boundary that matters most for readers: "If a message is sent by way of a voice call made using a standard telephone service, the message is not an electronic message for the purposes of this Act." Live telemarketing calls and robocalls are entirely outside the Spam Act regardless of their content. ACMA's own consumer guidance states this plainly: "Telemarketing calls are also not spam. Different rules apply to these." That different regime is the Do Not Call Register Act 2006 and the Telemarketing and Research Calls Industry Standard 2017, covered on the two linked pages above.

Designated Messages: The Schedule 1 Exemptions

Not every commercial message needs consent or an unsubscribe link. Schedule 1 exempts four categories of "designated commercial electronic message" from section 16 (consent) and section 18 (unsubscribe), though a note attached to the Schedule makes clear that section 17's sender-identification rule still applies to all of them:

1. Factual information messages that contain no more than factual content, plus limited housekeeping details (name, logo, contact information), and would not have qualified as commercial at all if that housekeeping information were removed.
2. Government bodies, registered political parties and registered charities, where the message relates to goods or services and the sender is the supplier or prospective supplier of those goods or services.
3. Educational institutions, where the account-holder or a household member is or was enrolled as a student and the message relates to goods or services the institution supplies.
4. Regulations, which may designate further categories; none beyond the three above was confirmed in the Act's own text for this article.

ACMA's consumer guidance adds a related, broader practical point about elections specifically: a message seeking to influence a vote or opinion in an election, referendum or plebiscite is, in ACMA's words, "rarely covered by these rules," and does not need consent or an unsubscribe facility. This tracks both the Schedule 1 cl 3 exemption for registered political parties and section 44, which states the Act does not apply to the extent it would infringe the implied constitutional freedom of political communication.

The Three Core Rules

Consent (Section 16)

Section 16 prohibits sending, or causing to be sent, a commercial electronic message with an Australian link unless the account-holder consented or the message is a Schedule 1 designated message. Schedule 2 defines consent as either express consent, or consent that can reasonably be inferred from the recipient's conduct and their business or other relationships with the sender.

A narrower rule covers publicly listed addresses. Consent cannot be inferred just because an address has been published, but Schedule 2 clause 4 creates a specific exception: if an address conspicuously invites the public, or a section of the public, to contact a named employee, director, officer or role-holder about work-related matters, and there is no accompanying "no unsolicited messages" statement, the account-holder is treated as having consented, but only to messages that are actually relevant to that person's work.

Section 16(9) extends liability beyond the literal sender to anyone who aids, procures, induces or is knowingly concerned in a contravention, which is the basis for holding a business liable when it engages a marketing contractor to send messages on its behalf.

Accurate Sender Identification (Section 17)

Section 17 requires a message with an Australian link to clearly and accurately identify who authorised sending it, include accurate contact information, and remain reasonably likely to stay valid for at least 30 days after the message is sent. Unlike consent and the unsubscribe rule, section 17 is not relaxed for Schedule 1 designated messages: government bodies, charities, political parties and educational institutions must still get their sender identification right.

The Unsubscribe Facility (Section 18) and the "5 Business Days" Figure

Section 18 requires a covered commercial message to include a clear, conspicuous statement that the recipient can send an unsubscribe message, using an address that must be able to receive unsubscribe requests, and a reasonable number of other people's, for at least 30 days after the message was sent. The address must be legitimately obtained under section 18(1)(f); ACMA's own guidance additionally expects the facility to be low or no cost, though that expectation is not in the statutory text.

Section 18 itself does not contain a duty to stop sending within any specific number of days. The "5 business days" figure that circulates in business guidance comes from a different provision, Schedule 2 clause 6, which governs when a withdrawal of consent takes legal effect. Once an account-holder sends a message withdrawing consent, that withdrawal takes effect at the end of 5 business days beginning on the day it was sent (or delivered, for non-electronic notices). Only after that window closes does continuing to send become a section 16 contravention. ACMA's own consumer page states the practical effect in plain language, using a hedge word rather than citing section 18 directly: "Businesses must generally stop sending you marketing within 5 business days of your request." Cite Schedule 2 clause 6 for this figure, not section 18.

Address Harvesting Is Banned Outright

Part 3 of the Act prohibits address-harvesting software and harvested-address lists independently of whether any message is ever sent with them. Section 19's simplified outline states that such software, and any list produced using it, must not be supplied, acquired or used. Section 20 prohibits supplying or offering to supply the software, a right to use it, a harvested list, or a right to use one, based on where the supplier and customer are located.

Penalties: The Federal Court Ceiling vs What ACMA Actually Uses

Section 25 sets the maximum civil penalty a court can order, and it scales on three factors: whether the person has a prior record for that provision, whether they are a body corporate or an individual, and whether the provision broken is the higher-tier consent rule (section 16(1), (6) or (9)) or a lower-tier rule such as sender identification or unsubscribe (sections 17 and 18). These dollar values are calculated at the current Commonwealth penalty unit of $364, which has applied since 1 July 2026 under the Crimes (Amount of a Penalty Unit) Instrument 2026.

These are ceilings the Federal Court is authorised to order in a civil-penalty proceeding brought by ACMA, not a description of what courts typically impose. ACMA also has lower-tier tools it can use without going to court: Schedule 3 infringement notices (for example, a body corporate that commits 50 or more same-day contraventions of the consent rule covered by a single notice is capped at $364,000), enforceable undertakings, injunctions, and formal warnings.

In practice, ACMA's real 2026 enforcement stayed at the infringement-notice-and-undertaking tier rather than pursuing a Federal Court order for the section 25 maximum:

Every one of these outcomes was resolved through an infringement notice paired with a court-enforceable undertaking, not a Federal Court civil-penalty order. ACMA's July 2026 release, covering both spam and telemarketing together, states businesses paid more than $12 million in penalties for spam and telemarketing breaches over the preceding 18 months; that combined figure should not be treated as a spam-only total, and older snapshots from the March and April 2026 releases reported different 18-month spam-only totals, so treat any aggregate figure as tied to the release date it came from rather than a fixed statistic.

What Businesses Need to Get Right

ACMA's published guidance for businesses running direct marketing, part of a joint Statement of Expectations covering both e-marketing and telemarketing, applies to any business messaging Australian consumers "regardless of size or turnover." Distilled against the Act's own requirements, the checklist is: obtain express consent, or consent that can genuinely be inferred, before sending; keep records of how and when consent was obtained, since the burden of proving a consent defence sits with the sender; include accurate, currently valid sender identification in every message; include a working, low-cost unsubscribe mechanism that keeps working for at least 30 days; never buy, use or supply address-harvesting software or harvested address lists; and remember that even a Schedule 1 designated message still needs accurate sender identification under section 17.

Reporting Spam, Making a Complaint, and Reporting a Scam

ACMA separates three different channels, and using the wrong one is a common mistake.

Forwarding spam is not a complaint. Forward a spam text message to 0429 999 888, standard message charges apply, or a spam email to report@submit.spam.acma.gov.au, without editing the message or its subject line. ACMA states directly that this is not a complaint; it feeds education, compliance and enforcement work generally rather than triggering a case-by-case response.

Lodging an actual complaint about a specific business uses ACMA's separate spam complaint form. ACMA's own guidance is clear about what it can and cannot do with a complaint: it cannot give legal advice, it cannot provide an outcome for an individual complaint, and it cannot block messages from reaching a phone or inbox. It can take enforcement action, and states that the more serious or systemic an issue appears, the more likely it is to investigate or act.

Scam messages are not spam and do not go to ACMA. ACMA's own guidance draws the line and hands scam reports to different Commonwealth channels: Scamwatch, run by the National Anti-Scam Centre, or ReportCyber for cybercrime reporting. If a message is designed to deceive you into handing over money or personal information rather than simply market to you, that is the pair of channels to use instead of ACMA's spam address.

Related Reading

For the calling side of Australia's regime, see The Do Not Call Register in Australia for eligibility, registration and the register's indefinite duration, and Telemarketing Rules in Australia for calling hours, caller ID and the industry standards that bind every telemarketing and research call. For the broader Commonwealth privacy framework these rules sit alongside, see the Australian Privacy Principles, how to make a privacy complaint in Australia, identity theft laws in Australia, and what to do if your information is affected by a data breach, or return to the Australia data privacy laws hub.