The Spam Act, explained for small business
Three rules cover every marketing email and text a small business sends. Here they are in the regulator's words, with what they mean for a café, a trade or a shop.
By the Desk editorLast checked 3 October 20263 min read
The short answer
You can email or text marketing to people who agreed to it. Every message must say who it is from and include an unsubscribe that works within 5 working days. A bought list does not come with consent. These rules apply to one-person businesses as much as big ones.
Rule 1: consent
Express consent is the safe kind: the person knowingly agreed, on a form, by ticking a box, over the phone or in person. Keep a record of who agreed, when and how; the ACMA says "it's up to you to prove that you have a person's consent." You cannot send an email asking for consent, because that email is itself a marketing message.
Inferred consent is narrower than most owners think. It can apply where someone has an ongoing relationship with you, such as a membership or an account, and the message relates to it. The ACMA is specific that it "does not cover sending messages after someone has just bought something from your business."
A bought or borrowed list does not carry consent. You are responsible for consent on every address you use, even if a mailing company sends for you.
Rule 2: say who you are
Every message must identify your business accurately and give contact details that stay correct for at least 30 days after you send. Use your business's legal name, or your name and ABN.
Rule 3: an unsubscribe that works
The ACMA requires an unsubscribe option that is clearly presented, honoured within 5 working days, free, working for at least 30 days after the message, and does not make the person log in or give more information. Every platform on our email platforms comparison adds the link for you; the risk is in what happens around it.
Yes, but. The rules are the same for a text message as for an email. And the most common slip is not the link itself but the list: moving to a new email tool without carrying across everyone who unsubscribed, or uploading an old customer spreadsheet. Both send marketing to people who already said no.
What breaking it costs
The ACMA announced in July 2026 that TAB will pay more than $2.7 million for telemarketing and spam breaches, including more than 217,000 marketing emails and texts sent over 16 days to customers who had unsubscribed. The regulator said businesses had paid more than $12 million in spam and telemarketing penalties over the previous 18 months.
A five-minute check
- Send yourself your last newsletter and click unsubscribe. Does it work without a login?
- Is everyone who ever unsubscribed, in every tool you have used, excluded from your list?
- Does every message name your business and give a way to contact you?
- Could you show how and when each person on your list agreed?
General information only, not legal advice. For your own situation, the ACMA publishes guidance and takes questions.
Common questions
Does the Spam Act apply to SMS?
Yes. Commercial text messages need the same consent, sender identification and working unsubscribe as emails.
Can I email customers who bought from me?
Not just because they bought something. The ACMA says inferred consent does not cover messages after a one-off purchase. Ask them to opt in at the sale.
How fast must I process an unsubscribe?
Within 5 working days, and the unsubscribe must keep working for at least 30 days after you send.