# Consent law for email: Australia and New Zealand

Read this when deciding who may be emailed, when an owner asks "can I email
these people?", or before any import. Checked against primary sources on
1 October 2026. You are not the owner's lawyer: state the practical rule,
and when a case is genuinely unclear, say so and suggest they check.

## Australia: the Spam Act 2003

Three things for every commercial email (anything that offers, promotes or
links to goods or services, including an email asking for consent):

1. **Consent.** Express (they agreed, for example by filling in a form) or
   inferred (see below). The sender must be able to prove it (s 16(5)).
2. **Identify the sender.** The business's legal name, or the owner's name
   and ABN, and how to contact them, valid for 30 days after sending (s 17).
3. **A working unsubscribe.** A link or a reply address; "reply with
   unsubscribe" is valid. No login, no extra details. It must keep working
   for 30 days, and the withdrawal takes effect within 5 business days
   (s 18; Sch 2 cl 6). Build to "at once": Gmail and Yahoo expect two days.

**Asking for consent by email is itself a commercial message.** ACMA: "You
cannot send an electronic message to ask for consent, because this is a
marketing message." A message that links to marketing content is commercial
too.

**Inferred consent is narrow.** The Act allows consent that "can reasonably
be inferred from the conduct and the business and other relationships" (Sch
2 cl 2). ACMA reads that as "a provable, ongoing relationship with your
business, and the marketing is directly related to that relationship". It
"does not cover sending messages after someone has just bought something",
and its 2024 statement of expectations says: "Do not infer consent from
one-off purchases ... including in cases where email addresses are obtained
to send receipts or tax invoices", and "Do not use consent that is old,
where a consumer would not expect it to still apply."

In practice:

| Who | Inferred consent? |
|---|---|
| A current member, student, retained client, service-plan or maintenance-contract customer | Usually yes, for messages directly related to that relationship |
| A property manager or business you do repeat work for | Usually yes, for related messages to the person you deal with |
| Someone who had one job, one purchase or one appointment | No |
| Someone who asked for a quote and didn't go ahead | Not established; treat as no |
| An address you hold only because you sent a receipt or invoice | No |
| A former customer from years ago | No ("old" consent) |

**Conspicuous publication** (Sch 2 cl 4) is a narrow exception for business
addresses: published for a person or role, publication reasonably assumed to
be agreed, no "no marketing" statement next to it, and the email relevant to
their work. The mere fact an address is published is not consent.

**Double opt-in is not required**, but ACMA recommends it. Filling in a form
is express consent. Keep records of how consent was obtained, the terms, and
the date and time. ACMA has said nothing specific about people who signed up
but never clicked the confirmation link; treat them as not emailable.

**Penalties.** For a company with no prior record, up to 100 penalty units
per contravention, capped at 2,000 units a day; ten times that with a prior
record (s 25). At $364 a unit from 1 July 2026 that is $36,400 per message
breach and $728,000 a day. Recent ACMA actions: Commonwealth Bank $7.5m (2024),
Pizza Hut $2.5m (2024), Ticketek $515,040 (2023), Outdoor Supacentre
$302,500 (2024, "companies can't outsource their compliance obligations"),
Lululemon $702,900 and Latitude $3.96m (2026).

## New Zealand: the Unsolicited Electronic Messages Act 2007

Much the same. Consent is express, inferred ("from the conduct and the
business and other relationships"), or deemed (conspicuous publication, same
conditions). A message that links to or directs someone to marketing is
commercial (s 6). The Department of Internal Affairs says consent cannot be
inferred from a single transaction, "silence should not be taken as consent",
and emailing an old database to ask people to unsubscribe "cannot establish
consent". Unsubscribe takes effect within 5 working days and must work by the
same method the message came by (ss 9, 11). On double opt-in the DIA is
firmer than Australia: "If this link is not clicked, then electronic
marketing should not take place." Penalties up to $200,000 for an individual
and $500,000 for an organisation.

## Privacy Act 1988 (Australia), where it touches email

- **Health information is sensitive information.** Collecting it needs the
  person's consent (APP 3.3), and using sensitive information for direct
  marketing needs consent too (APP 7.4). Health service providers are never
  exempt as small businesses.
- So: never build a marketing group from conditions or diagnoses. Use an
  opt-in interest instead.
- The statutory tort for serious invasions of privacy has applied since
  10 June 2025. Direct-marketing changes are still only proposed (exposure
  draft, August 2026).

## The mailbox providers' rules

Not law, but they decide whether email arrives. See `deliverability.md`.
Google's Workspace policy bans "unsolicited mass email" and can suspend the
account; Microsoft says businesses that need to send newsletters "should use
third-party providers". Neither the owner's Gmail nor their Microsoft 365
mailbox is a bulk sending tool.

## Sources

- Spam Act 2003: https://www.legislation.gov.au/C2004A01214/latest/text
- ACMA, Avoid sending spam: https://www.acma.gov.au/avoid-sending-spam
- ACMA, consent expectations (2024): https://www.acma.gov.au/publications/2024-07/guide/consumer-consent-expectations-businesses-conducting-telemarketing-and-e-marketing
- ACMA enforcement: https://www.acma.gov.au/investigations-spam-and-telemarketing
- Penalty unit from 1 July 2026: https://www.legislation.gov.au/F2026N00424/asmade/2026-06-16/text/original/pdf
- UEM Act 2007: https://www.legislation.govt.nz/act/public/2007/0007/latest/whole.html
- DIA FAQs: https://dia.govt.nz/Spam-Frequently-Asked-Questions and https://www.dia.govt.nz/Spam-Three-Steps
- Privacy Act 1988: https://www.legislation.gov.au/C2004A03712/latest/text
- Google Workspace sending limits: https://knowledge.workspace.google.com/admin/gmail/gmail-sending-limits-in-google-workspace
- Exchange Online limits: https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits