The Spam Act sets three separate conditions on a commercial email or SMS, and meeting the second and third does not repair a failure of the first. Consent comes first. A message sent without it breaches the Act however clearly it names the sender and however visible its unsubscribe link is. The common working assumption, that a message is acceptable once it identifies the sender and offers a way out, reverses the order the Act sets.

This article reads the Spam Act 2003 (Cth) as it was made on 12 December 2003, and it names sections and schedule clauses so that a reader can check each point against the current text on the Federal Register of Legislation. The Act has been amended since it was made, so the current wording may differ in places. It is general information only, not legal advice, and a business with a specific question should take it to a lawyer.

What counts as a commercial electronic message

Two definitions decide whether the Act applies at all.

The first is “electronic message”. Under section 5, this covers a message sent through an internet carriage service or another listed carriage service to an email, instant messaging, telephone or similar account. Email is in. So is SMS, because a text sent to a mobile number is a message to a telephone account. A voice call over a standard telephone service is out (section 5(5)). That boundary is easy to miss, because the Act is often described as the rule for all unsolicited contact, and it is not.

The second is “commercial”. Section 6 treats a message as commercial if a purpose, or one of its purposes, is to offer, advertise or promote goods, services, land, or a business or investment opportunity, including the supplier of any of them. The test looks at the content of the message, the way it is presented, and what sits behind its links or contact details.

The phrase “one of the purposes” does most of the work. A message does not escape the Act by being called a newsletter or an update. If part of its job is to promote, it can be commercial, and the answer comes from the message as a whole, including the pages its links lead to. The question is what the message is for, not what it is labelled.

Three conditions, three separate sections

Each condition sits in its own section, and each stands alone.

1. Consent (section 16). A person must not send a commercial electronic message that has an Australian link unless the account-holder consented to it being sent (section 16(2)). The Act has its own test for an Australian link, and this article does not set it out. A person who relies on consent bears an evidential burden (section 16(5)). In practice, the sender is the party that should be able to show what was agreed and when.
2. Sender identification (section 17). The message must clearly and accurately identify the person who authorised it and say how that person can be contacted. That information must be reasonably likely to stay valid for at least 30 days after the message is sent (section 17(1)).
3. Unsubscribe facility (section 18). The message must carry a clear and conspicuous statement that the recipient may use an electronic address to unsubscribe. The address must be reasonably likely to be capable of receiving unsubscribe messages at all times during a period of at least 30 days after the message is sent (section 18(1)).

Each is a civil penalty provision (sections 16(11), 17(7) and 18(8)), and the Federal Court may order a pecuniary penalty for a contravention (section 24(1)). This article prints no penalty amount. The amounts sit in a part of the Act it does not cover, and the current figure should be read from the Act itself.

Because the three sections are separate, a message can satisfy two and still break one. A message with accurate sender details and a working unsubscribe address, sent to a person who never consented, still contravenes section 16. The reverse also holds: consent, once obtained, does not excuse a missing sender identification or a missing unsubscribe statement. Exemptions exist, and they are covered below, but they are narrow.

The can-I-email-this-person table

The table sets out eight situations that small businesses commonly ask about. The right-hand column records what the Act, as made, leaves open. That column matters most, because it separates what the text decides from what it hands back to the sender to prove.

Read down the right-hand column and a pattern appears. In four rows the Act decides nothing by itself. It supplies a test, consent that is express or can reasonably be inferred (Schedule 2 clause 2), and leaves the sender to apply it to the facts. A recent purchase, a business card and a bought list all sit there. None is consent by label. The question is whether this account-holder consented to messages of this kind from this sender, and section 16(5) places the work of answering it on the sender.

The published-address row is the one most often misjudged, because the Act states the answer and the answer is still surprising. Clause 4(1) says consent may not be inferred from the mere fact that an electronic address has been published. Clause 4(2) carves out a narrow case: the address of a particular employee, director, officer, partner, office-holder, self-employed individual or role, published conspicuously with their agreement and carrying no statement against unsolicited messages. Even then, the consent reaches only messages relevant to the work-related business, functions or duties concerned. A staff-page address does not become a general marketing list.

The sign-up row shows the Act’s silence plainly. Express consent is one route to compliance (clause 2(a)), but the Act as made sets no form for it. What it does set is the burden. The sensible reading is that a sender who relies on a sign-up box should keep a record of what the box said and when the person used it, since the sender is the one who may have to show it.

The bought-list row has a second layer. Sections 20 to 22 deal separately with address-harvesting software and harvested-address lists, which must not be supplied, acquired or used. This article does not describe those sections beyond that, and a reader weighing a real list should read them directly.

The table has limits. It contains no penalty amounts, no guidance from any regulator, and nothing from the regulations made under the Act. It reads the Act as made in 2003, so a later amendment could change a row.

What “unsubscribe” must and must not do

Two time periods appear in the unsubscribe provisions, and summaries often merge them into one rule. They are separate, and they answer different questions.

The first is 30 days. It governs how long the sender’s contact details must stay valid (section 17(1)) and how long the unsubscribe address must remain capable of receiving messages (section 18(1)). Both run from the day the message is sent. It is a requirement about whether the address works, not about what the sender does with a request.

The second is 5 business days. Under Schedule 2 clause 6, a withdrawal of consent takes effect at the end of the period of 5 business days beginning on the day the message was sent. The Act defines a business day to exclude Saturday, Sunday and a public holiday in the place the message was sent to. A reader who needs to know exactly which message starts the count in a particular case should read clause 6 itself, because the clause is worded around the day the message was sent.

Put side by side, the 30 days concerns whether the address works, and the 5 business days concerns when a withdrawal takes effect. A sender can meet the first and miss the second. A sender with a working address for 30 days who keeps messaging someone whose withdrawal has taken effect has a consent problem under section 16, and not an unsubscribe-address problem under section 18.

The section 18 statement must also be “clear and conspicuous”. The Act as made does not enlarge on that phrase in the sections of the Act cited here, so the safe reading is the plain one: a recipient should be able to find it without hunting.

The exemptions, and where they stop

Schedule 1 designates certain messages, and a designated message is exempt from sections 16 and 18. Section 17 still applies to it, so the sender must still be identified.

Three groups are covered. Under clause 2, a message with no more than factual information, with or without directly-related comment, together with the sender’s details, is designated. Under clause 3, messages from government bodies, registered political parties, religious organisations and charities are designated where the message relates to goods or services the body itself supplies. Under clause 4, an educational institution writing to current or former students, or their households, about its own goods or services is covered.

The limits matter as much as the groups. A message that also promotes goods or services falls outside the factual-only exemption (clause 2(b)), which means a booking confirmation with a discount offer attached is no longer simply a confirmation. The fair point for the other side is that these exemptions are real: a plain receipt or appointment reminder carries no consent requirement, and a charity writing about its own services is in a different position from a retailer. The exemptions are drawn around purpose and sender, not around how friendly the message sounds.

Consent First, Then the Other Two Rules

Three sections, three separate conditions, and only one of them can be satisfied by the account-holder’s agreement. Sender details and an unsubscribe address are things the sender supplies, so they cannot stand in for something the recipient gave. A sender who starts with consent, keeps a record of it, and then meets sections 17 and 18 has covered all three. A sender who starts with the link has covered one at best.

Sources: Spam Act 2003 (Cth), No. 129, 2003, as made on 12 December 2003, Federal Register of Legislation (https://www.legislation.gov.au/C2004A01214/asmade/2003-12-12/text/original/pdf)