Cold email laws
Spam Act 2003 (Australia): What It Means for Cold Email
Only with consent. The Spam Act 2003 is opt-in, but consent can be inferred when a work address is conspicuously published without a no-spam notice and your email fits the person's role. Companies face up to AUD 728,000 a day, or AUD 3.64 million with a prior record.
Not Legal Advice
Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer.
Can You Send B2B Cold Email Under the Spam Act?
In short Only with consent: express consent, or consent inferred when a work address is conspicuously published with no no-spam statement and your email relates to the person's role.
Section 16 bans sending a commercial electronic message with an Australian link unless the account holder consented. Consent is express, or inferred from conduct and business relationships (Schedule 2, clause 2). The mere fact that an address was published is not consent.
The B2B path is inferred consent from conspicuous publication (Schedule 2, clause 4), and all four conditions must hold: the address belongs to an employee, director, officer, partner, office holder, self-employed person or a role; it was conspicuously published with the person's or the organisation's agreement; the publication has no statement that they do not want unsolicited commercial messages; and your email is relevant to their work. ACMA says you cannot send an email to ask for consent, because that is itself a marketing message.
The law reaches senders outside Australia: a message has an Australian link when, among other things, it is accessed on a device in Australia or the recipient organisation carries on business there (section 7). Every message must also identify the sender (section 17) and carry a working unsubscribe (section 18).
What Do You Need to Do Under the Spam Act?
In short 7 rules apply to a cold email program under the Spam Act.
| Requirement | What it means | How to do it | Section |
|---|---|---|---|
| Consent | Have express consent, or consent you can infer. For B2B cold email the realistic path is a conspicuously published work address with no no-spam notice and a message relevant to the person's role. | Email only role-relevant contacts whose work address is conspicuously published, for example on the company site, and do not send emails asking for permission. | Spam Act s 16(1) and 16(2); Schedule 2 clauses 2 and 4 |
| Prove consent | The sender carries the burden of showing consent. ACMA says you are still responsible for consent when you buy a list. | Store the source page and the date you found each Australian contact. Do not rely on a vendor's claim of consent. | Spam Act s 16(5); ACMA guidance |
| Identify the sender | The message must clearly and accurately identify who authorised it and how to contact them, and that information must stay valid for at least 30 days. | Put your legal business name, or your name and ABN, and contact details in every email, even when an agency sends for you. | Spam Act s 17(1); ACMA guidance |
| Functional unsubscribe | Include a clear statement that the recipient can unsubscribe, using an address that keeps working for at least 30 days. ACMA says no fee, no login and no extra personal information. | Use reply-to-unsubscribe or a one-click link with no login, and keep it live for at least 30 days. | Spam Act s 18(1); ACMA guidance |
| Honor unsubscribes within 5 business days | A withdrawal of consent takes effect at the end of 5 business days. | Suppress the address across every inbox and domain within 5 business days at most. | Spam Act Schedule 2 clause 6(1) |
| No sending to addresses that do not exist | Do not send a commercial message to an address you had no reason to believe existed. | Verify addresses before you send, and do not send to guessed permutations without verifying them. | Spam Act s 16(6) |
| No harvested lists | Do not supply, acquire or use address-harvesting software or a list produced, to any extent, by software that searches the internet for addresses. | Ask your data vendor how its lists were built, and do not use scraped lists for Australian contacts. | Spam Act ss 20 to 22 |
What Are the Penalties Under the Spam Act?
In short Maximum penalty: AUD 728,000 per day (AUD 3.64 million with a prior record).
| Penalty | Maximum | In USD | Section |
|---|---|---|---|
| Sending without consent (s 16), company with no prior record | AUD 728,000 per day (2,000 penalty units at AUD 364); up to 100 units (AUD 36,400) per contravention | about USD 506,600 | Spam Act s 25; Crimes Act 1914 s 4AA |
| Sending without consent (s 16), company with a prior record | AUD 3,640,000 per day (10,000 penalty units at AUD 364) | about USD 2.5 million | Spam Act s 25 |
| Sender identity or unsubscribe breaches (s 17, s 18), company with no prior record | AUD 364,000 per day (1,000 penalty units at AUD 364) | about USD 253,300 | Spam Act s 25 |
| ACMA infringement notice, 50 or more s 16 contraventions by a company | AUD 364,000 per notice (1,000 penalty units) | about USD 253,300 | Spam Act Schedule 3 clause 5(1) |
USD amounts are approximate, converted at the European Central Bank reference rates of 2026-10-16.
ACMA enforces the Act: it issues infringement notices, accepts court-enforceable undertakings and brings Federal Court penalty proceedings (section 26). A victim can claim compensation only in those proceedings (section 28); there is no separate private right to sue. A penalty unit is AUD 364 from July 1, 2026; for conduct before that date the earlier AUD 330 unit may apply, which gives AUD 660,000 and AUD 3.3 million a day.
What Enforcement Has There Been Under the Spam Act?
In short 3 cases from regulator and court records, newest first.
| Date | Company | What happened | Outcome | Source |
|---|---|---|---|---|
| 2026-03-11 | Lululemon Athletica Australia Pty Ltd | Sent more than 370,000 shipping and order emails with sales content and no way to unsubscribe, and gave a court-enforceable undertaking. | AUD 702,900 | ACMA media release |
| 2024-10-17 | Commonwealth Bank of Australia | Sent over 170 million marketing messages with no way to unsubscribe, 34.8 million of them to people who had not consented or had withdrawn consent, after classifying them as non-commercial. | AUD 7.5 million, plus an expanded 3-year court-enforceable undertaking | ACMA media release |
| 2023-11-02 | Kmart Australia Limited | Sent 212,471 marketing emails to customers who had already unsubscribed. | AUD 1,303,500 in infringement notice penalties, plus a 2-year court-enforceable undertaking | ACMA media release |
Cold Email Checklist for the Spam Act
- Email Australian contacts only with express consent or a documented inferred-consent basis.
- For inferred consent, record where the work address was published, when, and that there was no no-spam notice.
- Make sure each email relates to the recipient's role.
- Do not send emails that ask for permission to email.
- Put your legal business name, or name and ABN, and contact details in every email.
- Include an unsubscribe that needs no login or fee and works for at least 30 days.
- Honor unsubscribes within 5 business days, across every inbox and domain.
- Verify addresses and do not use harvested lists.
How Ken Helps
In short Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility.
- Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3).
- Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it.
- Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits.
- You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2).
- Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6).
- Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under the Spam Act, that includes a record of the consent basis for every Australian contact.
FAQ
Can I send B2B cold email to Australian prospects?
Only with consent. Consent can be inferred when a work address is conspicuously published with the person's or organisation's agreement and no no-spam statement, and your message relates to their role (Schedule 2, clause 4). Mere publication is not enough.
Can I send one email asking for permission first?
No. ACMA says you cannot send an electronic message to ask for consent, because that message is itself a marketing message.
Does the Spam Act apply if my company is outside Australia?
It can. A message has an Australian link if, among other things, it is accessed on a device in Australia or the recipient organisation carries on business in Australia (section 7).
How quickly must I honor an unsubscribe?
Within 5 business days (Schedule 2, clause 6). The unsubscribe address must keep working for at least 30 days after you send (section 18), and ACMA says you cannot require a login or extra personal information.
What is the maximum penalty under the Spam Act?
For sending without consent, a court can impose up to 2,000 penalty units a day on a company with no prior record and 10,000 with one. At the AUD 364 unit in force from July 1, 2026, that is AUD 728,000 and AUD 3.64 million a day.
The new Ken opens to the waiting list in batches.
Related
- Cold email laws by country
All 12 laws compared
- CASL (Canada): What It Means for Cold Email
Consent first; implied consent for published work addresses
- CAN-SPAM Act: What It Means for Cold Email
Allowed, opt-out
- UK GDPR and PECR: What They Mean for Cold Email
Allowed to companies, opt-out; sole traders need consent
- Ken anti-spam policy
Sources
Changelog
- Page published.