Cold email law in Australia: when an outbound agent may send

Allowed

Under the Spam Act 2003 (Cth), Schedule 2 clause 2, consent includes consent 'that can reasonably be inferred from the conduct and the business and other relationships of the individual or organisation concerned'. An existing customer relationship can supply inferred consent for marketing that relates to that relationship, but the ACMA says not to infer consent from one-off purchases or an unclear relationship.

Footer must include: Clearly and accurately identify the individual or organisation that authorised the message; include accurate contact details (such as a postal address plus phone or email) that remain valid for at least 30 days; include a clear and conspicuous unsubscribe statement with a working electronic address that can receive unsubscribe requests for at least 30 days, free of charge and without requiring a login or extra personal information; action unsubscribes within 5 business days.

Next step: Only send if the relationship is current and the offer relates to what the customer buys from you; record why you infer consent, and prefer express consent where you can get it.

For the purposes of this Act, consent means: (a) express consent; or (b) consent that can reasonably be inferred from: (i) the conduct; and (ii) the business and other relationships; of the individual or organisation concerned.

Spam Act 2003 (Cth), Schedule 2 clause 2 (Basic definition of consent), Compilation No. 10

Checked on 17 October 2026

Allowed

Under the Spam Act 2003 (Cth), Schedule 2 clause 4(2), where a work email address has been conspicuously published with the person's or organisation's agreement and without a statement that unsolicited commercial messages are unwanted, the account-holder 'is taken to have consented' to commercial messages 'so long as the messages are relevant to' the work-related business, functions or duties of the person, or the function or role of the mailbox. Publication alone is never consent (clause 4(1)).

Footer must include: Clearly and accurately identify the individual or organisation that authorised the message; include accurate contact details (such as a postal address plus phone or email) that remain valid for at least 30 days; include a clear and conspicuous unsubscribe statement with a working electronic address that can receive unsubscribe requests for at least 30 days, free of charge and without requiring a login or extra personal information; action unsubscribes within 5 business days.

Next step: Keep a dated screenshot or URL showing where the address was published and that no 'no marketing' statement accompanied it, and keep the pitch strictly on the recipient's work-related role; you bear the evidential burden under section 16(5).

the relevant electronic account-holder is taken, for the purposes of this Act, to have consented to the sending of commercial electronic messages to that address, so long as the messages are relevant to: (e) ... the work-related business, functions or duties of the employee, director, officer, partner, office-holder or self-employed individual concerned

Spam Act 2003 (Cth), Schedule 2 clause 4(2) (consent inferred from publication of an electronic address), Compilation No. 10

Checked on 17 October 2026

Consent needed first

The Spam Act 2003 (Cth) section 16 bans commercial electronic messages with an Australian link unless the account-holder consented, and section 16(5) puts the evidential burden on the sender. A purchased list gives you no evidence that this recipient consented to messages from you, and the ACMA warns that you remain responsible for consent when you buy or use a marketing list.

Next step: Do not send; obtain express consent, or get evidence from the list supplier of consent that specifically covers marketing from third parties like you, and keep it.

A person who wishes to rely on subsection (2), (3) or (4) bears an evidential burden in relation to that matter.

Spam Act 2003 (Cth), section 16(5), Compilation No. 10

Checked on 17 October 2026

Consent needed first

Under the Spam Act 2003 (Cth), Schedule 2 clause 4(1), consent 'may not be inferred from the mere fact that the relevant electronic address has been published'; the publication exception in clause 4(2) needs conspicuous publication with the owner's agreement, no 'no marketing' statement and a role-relevant pitch, none of which an automated scrape can evidence. Senders located in Australia are also banned from using address-harvesting software or harvested lists (section 22).

Next step: Do not send from a scraped list; if the address genuinely sits on the organisation's own website, re-check that page manually and record it, or obtain express consent.

For the purposes of this Act, the consent of the relevant electronic account-holder may not be inferred from the mere fact that the relevant electronic address has been published.

Spam Act 2003 (Cth), Schedule 2 clause 4(1), Compilation No. 10

Checked on 17 October 2026

Consent needed first

A published address only counts as consent under the Spam Act 2003 (Cth), Schedule 2 clause 4(2), if the messages are relevant to the recipient's work-related business, functions or duties (or to the function or role of the mailbox); relevance has not been shown here. The ACMA's 2024 Statement of Expectations says not to send 'based solely on the fact that the email address or phone number has been published'.

Next step: Establish and record that your pitch is relevant to this person's role or this mailbox's function, then re-check; otherwise obtain express consent.

Do not send messages based solely on the fact that the email address or phone number has been published (publication does not mean consent has been given - there are multiple other conditions that must be met as set out in the Rules)

ACMA, Statement of Expectations: Use of consent in telemarketing and e-marketing (June 2024)

Checked on 17 October 2026

Consent needed first

The Spam Act 2003 (Cth), section 16, says a person 'must not send, or cause to be sent, a commercial electronic message' with an Australian link unless the account-holder consented; this applies to business recipients too (ACMA: consent must be obtained 'including to businesses'). Nothing in the facts available shows express or inferred consent.

Next step: Obtain express consent (for example a sign-up or a written yes) and keep a record of how and when it was given, or find the address conspicuously published on the organisation's own site and make sure your pitch is relevant to the role.

A person must not send, or cause to be sent, a commercial electronic message that: (a) has an Australian link; and (b) is not a designated commercial electronic message. (2) Subsection (1) does not apply if the relevant electronic account-holder consented to the sending of the message.

Spam Act 2003 (Cth), section 16(1)-(2), Compilation No. 10

Checked on 17 October 2026