Under the Spam Act, a commercial email or text may be sent only with the recipient’s consent, which the Act defines as express consent or consent that can reasonably be inferred from the person’s conduct and their business and other relationships. The ACMA says the sender has to prove it, and that it cannot be asked for in an electronic message, because that message would itself be marketing.
General informationAbout consent under the Spam Act 2003, not legal advice about any list or campaign. The ACMA’s page on avoiding spam is the place to check; Schedule 2 of the Act holds the definitions.
From first contact to the last message, in order
Before anything is sent. The ACMA says a business planning to send marketing emails or messages must first have consent from each person who will receive them, and that this holds even when someone else sends the messages on its behalf. It adds that businesses of every kind and size carry that responsibility.
How the question is asked. Not by email or text: the ACMA says a message asking for consent is itself a marketing message. Express consent, which it calls best practice, can be given on a form, by a tick in a website box, in a phone call or in person.
An enquiry is not a subscription. Someone who emails about a listing has given an address, not necessarily a yes to marketing. The ACMA asks whether a business automatically adds addresses to its marketing lists after a one-off purchase, or after a person simply submits an email enquiry, and warns this may breach the consent requirements.
Consent can sometimes be inferred, where the person knowingly and directly gave their address and would reasonably expect marketing from the business, usually because they have a provable, ongoing relationship with it and the marketing relates directly to that relationship. The ACMA calls inferred consent less reliable than express consent.
An address found online. Schedule 2 says consent may not be inferred merely because an address has been published. A narrow exception covers work addresses that are conspicuously published, where it would be reasonable to assume they were published with the agreement of the person or organisation concerned, and the publication carries no statement that unsolicited commercial messages are not wanted there. It applies only to messages relevant to that person’s work or role.
A list from somewhere else. The ACMA asks for care in buying or using a marketing list, because the business remains responsible for consent to every address it uses. The Act also forbids supplying, acquiring or using address-harvesting software or a list it produced.
Keeping the proof. When a person gives express consent, the ACMA asks for a record of who gave it, when and how. The Act places an evidential burden on a sender who relies on consent, and the ACMA puts it plainly: under the Spam Act, proving consent is up to the sender.
When the answer becomes no. If the person tells the sender they want no further commercial messages at that address, the withdrawal of consent takes effect at the end of 5 business days, counted from the day an electronic message saying so was sent. Business days here leave out weekends and any public holiday where the message was sent to. The ACMA warns that messages encouraging people who have withdrawn consent to come back or resubscribe may breach the law.
Counting the five business days
Illustration, not a real caseA homeowner replies to an agency’s market-update email on Thursday 3 December 2026, saying they want no more. Assume no public holiday that week where the reply was sent to.
- Thu 3 DecDay 1
- Fri 4 DecDay 2
- Sat 5 DecNot counted
- Sun 6 DecNot counted
- Mon 7 DecDay 3
- Tue 8 DecDay 4
- Wed 9 DecDay 5
Counting from the day the reply was sent, the period ends with Wednesday 9 December, and the withdrawal takes effect at the end of that day. A public holiday in that place during the week would push the end back by a day for each holiday.
The ACMA states the same limit from the sender’s side: an unsubscribe facility must honour a request within 5 working days.
Whose yes counts
The consent the Act asks for is the consent of the “relevant electronic account-holder”. For an email address, that is the individual or organisation responsible for the email account; for a phone number, whoever is responsible for the telephone account. Schedule 2 leaves room for another person to consent on the account-holder’s behalf without spelling out when, but the yes the Act asks about is the account-holder’s.
The Act does allow for shared accounts in one direction. If someone other than the account-holder uses the account to send a message giving, withdrawing or refusing consent, that person is taken to have been authorised to do so on the account-holder’s behalf. So a no typed by anyone using the account counts as the account-holder’s no. The regulations may also add circumstances in which consent may, or may not, be inferred.
Where consent slips
The ACMA’s list of common mistakes is a record of how this goes wrong in practice. It describes proof-of-purchase messages sent electronically that also add people to marketing lists without their apparent consent, and says consent problems around the automated gathering of addresses are a common cause of non-compliance. Handing the work to someone else changes nothing: a business cannot outsource its obligations under the spam and telemarketing laws, and is ultimately responsible.
- A message sent by mistake falls outside the consent rule, though the sender bears an evidential burden in saying so.
- Helping, encouraging or knowingly being concerned in someone else’s breach is itself against the spam rules, the ACMA says.