Marketing by email or text looks simple, but two laws apply. The Spam Act 2003 sets rules for sending commercial electronic messages, and the Privacy Act sets rules for how you handle the contact details behind your list.
The three Spam Act basics
- Consent. You need the recipient's consent before sending a commercial message. Consent can be express (they asked) or, in limited cases, inferred from an existing relationship.
- Identify yourself. Every message must clearly say who sent it and how to contact them.
- Unsubscribe. Every message needs a working way to opt out, and you must act on it promptly, within five business days.
Buying lists is a problem
A purchased or scraped list rarely comes with the consent the Spam Act requires. Sending to it can put you in breach, and the Australian Communications and Media Authority (ACMA) enforces the law.
Where the Privacy Act comes in
Australian Privacy Principle 7 deals with direct marketing by covered businesses: it generally restricts it unless certain conditions are met, and requires a simple way for people to opt out. Where the Spam Act applies to a channel, its rules take priority. Your privacy policy should also say that you use personal information for marketing.
Keep a record of consent
Record when and how each person subscribed, and what they agreed to. If a complaint arrives, that record is your defence.
What to do this week
- Check every sign-up form clearly says what people are signing up for
- Confirm each email and SMS has your details and a working unsubscribe
- Remove anyone who unsubscribed and any contacts you cannot show consent for
- Check your privacy policy mentions marketing
This is general information, not legal advice. If you are unsure how this applies to your business, speak with a qualified privacy lawyer and see the OAIC guidance.