Is Cold Email Legal in Australia? What the Spam Act Allows

In October 2024, Commonwealth Bank paid a $7.5 million spam penalty. It had sent 170 million marketing emails with no way to unsubscribe.

Under Australia's Spam Act 2003, cold email to a business can be legal if the person's work address was conspicuously published with no "no spam" notice, your email fits their job, and every email names you and includes a working unsubscribe.

This is general information, not legal advice. Spam Act cases turn on facts, so have an Australian lawyer look at your setup before you build a campaign on it.

Most guides stop at "published address plus relevance". To see how much room that leaves, I read the Act, rebuilt every spam penalty ACMA has listed since 2011, and scanned 588 Australian business websites. Three findings stood out.

1. Only about 1 in 7 Australian business websites showed a named person's email address, and only 1 in 14 showed one on the company's own domain. Cold email runs almost entirely on named addresses.
2. ACMA's main how-to page stopped mentioning published addresses in December 2020.
3. The biggest penalties all involved a broken unsubscribe. But small senders paid the most per message, up to about $5,660 each.

What does the Spam Act require for every commercial email?

The Spam Act 2003 sets five rules for any "commercial electronic message", meaning an email or text whose purpose includes selling something. ACMA, the Australian Communications and Media Authority, enforces them.

Section 6 of the Spam Act 2003 also looks at what your links lead to, so a soft email that points to a sales page still counts as commercial (latest compilation, checked October 2026). That's what caught Commonwealth Bank. It had classed millions of its emails as service messages, but ACMA found they promoted insurance, credit and loans.

ACMA's Avoid sending spam page adds that an unsubscribe can't charge a fee, make people log in, or ask for extra personal information (July 2026 archived version). For how Australia compares with CAN-SPAM, GDPR and CASL, see our guide to cold email unsubscribe requirements.

When can you infer consent from a published email address?

The published-address exception lives in Schedule 2, clause 4 of the Spam Act. It opens with a warning that consent "may not be inferred from the mere fact that the relevant electronic address has been published." Then it carves out an exception where all of these are true.

• The address reaches a particular person, such as an employee, director, partner, office holder or sole trader, or a particular role or function in an organisation.
• The address was conspicuously published.
• It's reasonable to assume the person agreed to the publication, or the organisation did for a role address.
• The publication doesn't say the owner doesn't want unsolicited commercial messages.
• Your email is relevant to the person's "work-related business, functions or duties", or to the role.

So pitching bookkeeping software to a finance director whose address is on her company's team page fits the shape. Pitching her a holiday package doesn't.

Two things trip people up. First, the Act never defines "conspicuously", and ACMA has said little about it, as the law firm DW Fox Tucker notes. Second, the exception also covers role addresses like accounts@. Whether a sales pitch is "relevant" to a catch-all info@ inbox is a question I haven't seen ACMA answer.

How often do Australian businesses actually publish a named person's email?

The exception only helps if someone published the address, so I checked. On October 9, 2026, we drew 1,000 random .com.au domains from the Tranco top-sites list and loaded each homepage plus up to five contact, team and about pages. We could read 588 of them. The rest blocked bots, were down, or disallowed crawling.

Source: Kenso scan of 588 .com.au websites, October 9, 2026, from 1,000 sampled domains. Lines show 95% Wilson confidence intervals.

Only 13.6% of the sites showed a named person's address anywhere, with a 95% confidence interval of 11.1% to 16.6%. Just 7.0% showed one on the company's own domain. The rest sat on some other domain, and we didn't store addresses, so we can't say whose.

Another 40.6% showed role inboxes only, and 38.8% showed no email address at all. None of the 588 had a notice asking people not to send unsolicited email, so that part of the test rarely bites.

Now compare that with what cold email runs on. Email finders are built to return one person's address, like jane@ or jane.doe@, because a person is who you want to reach. On a cold list, a role inbox like info@ is the rare exception.

A findable address isn't a published address. Cold email runs almost entirely on named addresses, and 86% of the Australian business websites we checked didn't show one.

Some caveats. Tranco ranks popular sites, so the sample leans toward bigger businesses, and bot-blocked sites dropped out. We only checked company websites, not directories or LinkedIn.

Does ACMA still mention published addresses in its guidance?

It used to. The version of ACMA's Avoid sending spam page last updated March 17, 2020 said you may infer permission if "the person made their email address or phone number public, such as online or in a directory" and your subject "relates directly" to their role.

The version updated December 22, 2020 dropped that. It said you may infer consent when the recipient "has knowingly and directly given their address", which is "usually when a person has a provable, ongoing relationship with your business." An address you found on a website was never given to you. The latest version, updated November 2024, adds that "inferred consent is not as reliable as getting someone's express consent."

The Act didn't change, and clause 4 is still in it. But the regulator's main how-to page stopped mentioning it, and I read that as a signal. Treat the published-address exception as a defence you might have to prove, not a green light.

ACMA has shown what proof looks like. In 2019 the trade-services marketplace Oneflare paid a $75,600 infringement notice for texts sent to phone numbers "it found on public directories". ACMA said its records "could not provide evidence that it had permission to send these messages." Under its enforceable undertaking, Oneflare stopped relying on published numbers until an ACMA-approved consultant reviewed its systems. After that, it had to keep written records, such as a time-stamped screenshot, showing it met every element of the exception "at the time the message is sent".

I'd plan for the same bar. A dated screenshot for every address.

What does ACMA actually penalise?

Mostly big consumer brands with broken unsubscribes, and the money has grown fast. I rebuilt every spam outcome from ACMA's tables for 2010-2016 and 2017-2026, leaving out telemarketing.

Source: ACMA spam investigation tables 2011-2026, archived June 2026, plus ACMA media release MR 24/2026. n = 80 spam actions, 38 with a penalty. 2026 is partial, through July.

From 2011 to 2019, spam penalties totalled $0.9 million across 11 penalties. From 2022 to 2025, they ran between $6.0 million and $11.8 million every year. Here's what the 13 biggest since 2020 had in common.

That's $34.5 million, and all 13 come back to the unsubscribe. Twelve cite a missing or broken unsubscribe facility. The thirteenth, Kmart, emailed people who had already opted out.

Widen the lens to all 26 spam penalties since 2020 (leaving out one 2026 penalty that mixed spam and telemarketing) and the pattern holds. Cases with an unsubscribe failure account for 98% of the $39.5 million. Only 4 penalties were about consent alone, and together they came to $945,000.

None of the 13 were B2B cold emailers. That tells you where the big money has gone, not that small senders are safe.

How much can one bad day of sending cost?

The Spam Act sets penalties in penalty units. A Commonwealth penalty unit is $364 for breaches from July 1, 2026, checked October 2026. ACMA usually issues infringement notices instead of going to court. Under Schedule 3, one notice covers one rule broken on one day.

Notice the shape. Below 50 emails a day, every email without consent adds 20 penalty units ($7,280) to the notice. At 50, the notice stops growing.

Under section 25, a company with a prior court order for the same rule faces up to $3.64 million a day for consent breaches. If you've seen "$2.1 million a day" elsewhere, that was right when ACMA wrote it in 2019. The penalty unit was $210 then.

Does sending fewer emails mean a smaller penalty?

Not in proportion. I pulled the message count from every ACMA spam media release since 2020 that gives one, which covers 25 of the 26 spam penalties, and plotted it against the penalty.

Source: ACMA spam media releases and outcome tables, 2020-2026, read October 2026. n = 25 penalties with a published message count. Both axes are logarithmic.

Draw a line through the dots and 10 times more messages means only about 1.5 times the penalty. The fit is loose, because ACMA weighs more than volume, but the direction is clear. In the 5 cases under 10,000 messages, the median penalty came to $624 per message. In the 12 cases over a million, it was 22 cents.

The extremes are wild. Commonwealth Bank paid about 4 cents per email in 2024. In 2025, Betfair paid $871,660 for 154 messages to VIP customers, about $5,660 each. That's close to the 20 penalty units per email the Act sets at that volume, over $6,000 at the time. TAB paid $4 million for more than 5,700 messages, roughly $700 each.

The table above explains part of it. A brand sending millions a day hits the 50-email ceiling every day. A cold emailer sending a few dozen a day sits where each email counts on its own. ACMA doesn't charge for every message it finds, and these are only the cases it chose to pursue. Still, small doesn't mean cheap.

The cases that look most like cold email were consent-only. Kalkine Media paid $100,800 in 2021 for 2,774 emails sent to people who hadn't consented. Phoenix Securities paid $26,640 in 2022 for more than 3,000 emails offering business loans without consent. Both also signed enforceable undertakings, which put an independent consultant in to review their systems.

For a B2B cold emailer, the realistic risk isn't a $7.5 million headline. It's a five- or six-figure notice and a consultant in your systems, over consent you can't prove.

Does the Spam Act apply to companies outside Australia?

Yes. The Spam Act reaches any commercial message with an "Australian link". Section 7 counts a message as linked if, among other things, the recipient is physically in Australia when they read it, or their organisation does business in Australia. There's a defence if you didn't know and couldn't "with reasonable diligence" have found out the message had an Australian link, but under section 16(5) you carry the burden of raising it.

That defence is weaker than it sounds, because Australians are hard to spot by email domain. On October 9, 2026, we pulled every Australian company on Wikidata, a public database, that lists an official website. That came to 1,956 companies. About 1 in 3 (31%) used a plain .com with no .au domain at all. Wikidata leans toward bigger, older firms, and it doesn't count Australians who work for companies based somewhere else.

If your plan for Australia is "filter out .au domains", you'd miss about 1 in 3 of the Australian companies we checked. I wouldn't hang a reasonable-diligence defence on that. Use the country field on the contact or company instead.

What would I do before emailing Australians?

Here's what I'd want in place for any Australian contact.

• Keep proof of publication. Save a dated screenshot of where each address was published.
• Make the pitch fit the job. Relevance is part of the test, so build the list around your ICP, not around who's findable.
• Name yourself. A real business name and contact details that work for 30 days.
• Unsubscribe in every email. Follow-ups included, honoured across every campaign within 5 business days.
• Verify before you send. Section 16(6) covers addresses that don't exist, so an unverified guess is a legal risk, not just a bounce risk. Here's how verification works.
• Skip harvested lists. A list being for sale tells you nothing about consent.

Frequently asked questions

Are LinkedIn messages covered by the Spam Act?

Probably. Section 5 covers messages sent to instant messaging and "similar" accounts, so a LinkedIn sales pitch plausibly counts, though I haven't found an ACMA case about LinkedIn. Here's how we run LinkedIn and cold email together.

Can I send one short email asking for permission?

ACMA says no. Its guidance says "You cannot send an electronic message to ask for consent, because this is a marketing message."

Is there a general B2B exemption?

No. The published-address exception is the closest thing to a B2B rule, and it has five conditions.

What if someone replies "not interested"?

Treat it as an unsubscribe. Schedule 2 counts a message "to similar effect" as an opt-out, effective after 5 business days. Whether "not interested" is close enough is debatable, so don't test it.

Is buying an Australian email list legal?

Buying a list isn't banned on its own, but ACMA says "You are still responsible for making sure you have consent for any addresses you use." Lists built by harvesting software are banned outright when used to spam.

The short version

Australia can allow B2B cold email, but the lane is narrower than most guides admit, and the proof is on you. Get the unsubscribe right first, because that's where ACMA's biggest penalties have landed. Then keep proof of consent for every address, because a cold email case would turn on it. Kenso runs cold email and LinkedIn outreach for B2B companies, done for you, on infrastructure we own. If you want to see what a campaign looks like, your first campaign is free.