Cold email under Australia's Spam Act: consent, identification, and inferred consent for B2B

Australia’s Spam Act 2003 is a consent-first law, enforced by the Australian Communications and Media Authority (ACMA). Like CASL in Canada, it starts from “you need consent before you send,” not “you can send until someone objects.” Unlike CASL, its inferred-consent test leans more heavily on a single concept: the existing business relationship, plus a second, narrower path through publicly available contact details.

What counts as a commercial electronic message

The Act regulates commercial electronic messages — broadly, messages sent by email, SMS, MMS, or instant message where one of the purposes is to offer, advertise, or promote goods, services, land, business, or an investment opportunity. If your message’s purpose fits that description, the Act’s consent, identification, and unsubscribe rules apply to it, full stop, regardless of B2B or B2C framing.

Section 16 of the Act prohibits sending a commercial electronic message without consent. Consent comes in two forms:

Express consent — the recipient told you, in some verifiable way, that they’re willing to receive these messages.
Inferred consent — the law recognizes consent exists because of circumstances, without an explicit opt-in.

For B2B cold outreach, inferred consent is the mechanism worth understanding in detail, and ACMA’s own compliance guidance describes two recognized paths to it.

Path one: the existing business relationship

Consent can be inferred where there’s an existing business or other relationship between sender and recipient, and the recipient would reasonably expect to receive the type of message you’re sending because of that relationship. ACMA’s own guidance is specific that this needs to be a provable, ongoing relationship connected to the subject of the message — not a single transaction stretched to justify unrelated marketing, and not a vague or historical connection that a recipient wouldn’t reasonably expect to still generate outreach.

The second path — structurally similar to a mechanism CASL uses in Canada, worth reading side by side in cold email rules: Canada’s CASL — applies when someone has conspicuously published a work-related, publicly accessible email address, with two further conditions:

No accompanying statement declining commercial messages — if the published listing says “no unsolicited contact,” the inference doesn’t apply.
The message is directly related to the recipient’s role or function — a pitch to someone whose public role plausibly involves evaluating what you’re offering, not a mismatched blast to any address that happened to be listed.

ACMA’s guidance is explicit that it considers inferring consent inappropriate where the relationship with the recipient is unclear or where the message isn’t relevant to an established relationship — that’s a regulator signal, not just industry best practice, and it applies with equal force to the conspicuous-publication path.

What every message must include

Consent gets you permission to send. It doesn’t excuse you from the Act’s content requirements, which apply regardless of which consent basis you’re relying on:

Identify the sender. The message has to accurately identify the individual or organization that authorized sending it, per section 17.
Include a functional unsubscribe facility, per section 18 — one that actually works and that you actually honor promptly once used.

The “designated commercial electronic message” exemption

Here’s a definition that gets misused constantly: a designated commercial electronic message is not a special category of allowed marketing — it’s a narrow exemption. Schedule 1 of the Act defines it as a message that consists of no more than factual information, plus a limited set of permitted extras (sender name, logo, and contact details), and — separately — messages authorized by government bodies, registered political parties, religious organizations, or charities relating to goods or services they themselves supply.

Messages that qualify as designated commercial electronic messages are exempt from section 16’s consent requirement and section 18’s unsubscribe requirement. But the exemption is narrow by design: the moment a message goes beyond bare factual content into promotional framing, it’s no longer “no more than factual information,” and the exemption stops applying. This is not a loophole for cold outreach — a sales pitch dressed up as a service notification doesn’t qualify. Treat it as what it is: a carve-out for things like appointment confirmations and account notices, not a marketing-classification trick.

Penalties: set in penalty units, not a fixed dollar figure

The Act’s civil penalties are denominated in Commonwealth penalty units rather than fixed dollar amounts, per section 25 — for example, a cap of 100 penalty units per contravening day for a body corporate with no prior record under the core consent provision, rising sharply, up to a total cap of 10,000 penalty units, for repeated contraventions by a body corporate that already has a prior record. Because the dollar value of a penalty unit is indexed periodically by separate Commonwealth legislation, the actual dollar exposure moves over time — what matters for a sender is the structure: a single, first-time contravention is capped meaningfully lower than a pattern of repeated, knowing violations, and ACMA has publicly and repeatedly enforced at the higher end of that range against businesses with a documented history of breaches. Penalties can be substantial; check the current penalty unit value rather than citing an old dollar figure from a blog post — this one included.

What this looks like in practice

A Spam Act–aware B2B cold-email program in Australia generally means:

Documenting which inferred-consent path applies to each segment — existing relationship or conspicuous publication — the same discipline CASL requires in Canada, and for largely the same reason: the burden of showing the basis was valid sits with the sender.
Treating relevance to the recipient’s actual role as a legal requirement, not just a targeting best practice, since it’s a load- bearing condition of the conspicuous-publication path.
Not stretching the designated-message exemption to cover anything with real promotional content.
Sender identification and a working unsubscribe on every message, unconditionally — the same baseline requirement that shows up under CAN-SPAM in the U.S. and CASL in Canada.

Authentication hygiene sits underneath all of this the same way it does everywhere else — DMARC monitoring keeps the sending domain behind your identification claim honest, regardless of which jurisdiction’s consent rule you’re satisfying. And for how Australia’s consent-first model compares structurally to CAN-SPAM’s opt-out model and GDPR’s legitimate-interest model, see CAN-SPAM vs. GDPR vs. CASL compared.

Frequently asked questions

Do I need consent before sending cold B2B email to Australia?

Yes. The Spam Act 2003 requires consent, express or inferred, before sending a commercial electronic message. For B2B cold outreach, inferred consent through an existing, provable business relationship, or through conspicuous publication of a work-related email address relevant to the recipient's role, are the two recognized paths — not a general default permission to email any address you find.

What is a designated commercial electronic message under the Spam Act?

It is a narrow exemption category defined in Schedule 1 of the Act for messages consisting of no more than factual information plus limited sender details, or messages from government bodies, registered political parties, religious organizations, or charities about their own goods or services. Designated commercial electronic messages are exempt from the Act's consent and unsubscribe requirements. It is not a general marketing exemption, and promotional content takes a message out of the category.

What must every commercial electronic message include under Australian law?

Accurate identification of the sender, per section 17 of the Act, and a functional, honored unsubscribe facility, per section 18. These apply regardless of which consent basis, express or inferred, the sender is relying on.

How much can ACMA fine a business for Spam Act violations?

Penalties are set in Commonwealth penalty units rather than a fixed dollar figure, with the maximum scaling up for repeated contraventions by a business with a prior compliance record. Because the dollar value of a penalty unit is indexed periodically, the current dollar exposure should be checked against the current penalty unit value rather than an older cited figure — but ACMA has a track record of enforcing at the higher end of the available range against repeat offenders.