Section 18 of the Spam Act says a commercial message with an Australian link, unless it is a designated message, must include a functional unsubscribe facility: a clear and conspicuous statement that the recipient can send an unsubscribe message to an electronic address in the message, with that address able to receive it for at least 30 days. The Spam Regulations 2021 add conditions on that address: using it must not need a premium service, cost more than the usual cost of that kind of address, require a fee, or ask for personal information beyond the address the message was sent to, or require the person to log in to an existing account, or create a new one, with the person who sent the message or caused it to be sent, or with whoever authorised it. The ACMA adds that a request must be honoured within 5 working days.
General informationAbout the unsubscribe rules in the Spam Act 2003, not legal advice about any message or system. The ACMA’s page on avoiding spam is the place to check, and section 18 is in the Act.
The Act and the ACMA, side by side
Section 18(1) is written as conditions on the message. The ACMA’s page states the same duty as a list of things the option must do. Set together, they read like this:
| Section 18(1) requires | The ACMA’s reading |
|---|---|
| A statement, in those or similar terms, that the recipient can send an unsubscribe message to an electronic address given in the message. | It presents unsubscribe instructions clearly. |
| The statement is presented in a clear and conspicuous manner. | Unsubscribe facilities must be straightforward and easy to use. |
| The address is reasonably likely to be able to receive the recipient’s unsubscribe message, and a reasonable number of similar ones from others, at all times for at least 30 days after sending. | It stays functional for at least 30 days after the message was sent. |
| The address is legitimately obtained, and meets the conditions in section 7 of the Spam Regulations 2021: no premium service, no more than the usual cost, no fee, no personal information beyond the address the message was sent to, and no logging in to an existing account, or creating a new one, with the person who sent the message or caused it to be sent, or with whoever authorised it. | It costs nothing to use beyond the usual cost of using the address, such as a standard text charge, and asks for no fee. |
| Not in section 18 or the regulations; Schedule 2 sets when a withdrawal of consent takes effect. | A request is honoured within 5 working days. |
The first row is about wording, and the ACMA gives its own examples of wording it calls clear: for email, inviting a reply with “unsubscribe” in the subject line, or a button marked “unsubscribe”; for SMS, “Reply STOP” or an unsubscribe phone number.
A reply to a name that cannot read it
Texts add a trap. The ACMA has seen businesses ask people to reply to an SMS sender ID, the shortened business name in the message header, to unsubscribe. People generally cannot reply to a text sent under a sender ID, so the ACMA says those processes do not work and will therefore break the law. Its own tip says the same of alphanumeric headers generally. A branded name registered under the SMS Sender ID Register, which identifies the sender, still needs an unsubscribe route that can actually receive the reply.
What an unsubscribe reaches
The Act defines an unsubscribe message as one to the effect that the account-holder does not want any further commercial messages from, or authorised by, the individual or organisation that authorised the message, or one to similar effect. As this guide reads it with section 8, under which an agency is taken to authorise what its salespeople send for it, a no given in reply to a newsletter one salesperson sends for the agency is a no to all the agency’s commercial messages at that address. Where a salesperson sends messages for no one but themselves, the no reaches only that salesperson’s messages.
- The withdrawal of consent takes effect at the end of 5 business days from the day an electronic request was sent; the consent guide counts the days.
- Messages that encourage people who have withdrawn consent to come back or resubscribe may breach the spam laws, the ACMA says.
- Where section 18 conflicts with a contract or other agreement between the sender and the account-holder, the agreement prevails to that extent.
- Designated messages, such as purely factual ones, are exempt from section 18.
A no in any words
The definition does not require a magic word. Besides a message to the effect that no further commercial messages are wanted, it counts “an electronic message to similar effect”. As this guide reads it, a reply such as “please take me off your list” is an unsubscribe message even if it never uses the word, and the five-business-day clock in Schedule 2 runs from the day it was sent.
Section 18 also reaches those around the sender. Aiding, abetting, counselling or procuring a breach, inducing one, being knowingly concerned in one or conspiring to bring one about are contraventions too, though supplying the carriage service that carries a message is not. Both the main rule and these ancillary rules are civil penalty provisions. On the Act’s penalty scale they sit with the other rules rather than the consent rules: for a body corporate with no prior record, up to 50 penalty units for each breach and 1,000 in total for two or more breaches of the same provision on one day, against 100 and 2,000 for the consent rules. The enforcement guide sets out the full scale.
What the record shows
The ACMA calls the unsubscribe function a common cause of non-compliance, and says there are several unsubscribe requirements that businesses often fail to meet. Of the 17 spam outcomes it has published since June 2023, 13 name a missing or non-functional unsubscribe facility.