Spam Act 2003, Unsolicited Commercial Electronic Messages

Spam Act 2003 (Cth), ss. 16-18, 24-25, 28, Sch. 1, Sch. 2

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 10 April 2004.

A commercial messages rule binding public and private bodies.

As of 25 September 2026.

What it requires

Obtain the relevant electronic account-holder's express consent, or consent reasonably inferred from their conduct and business or other relationships, before sending, or causing to be sent, a commercial electronic message (an email, SMS, instant message or similar account message, but not a voice call) that has an Australian link, unless it is a designated commercial electronic message exempt under Schedule 1.
Treat a business or work electronic address as impliedly consenting only if it was conspicuously published, the publication appears to have the agreement of the person or organisation it belongs to, it carries no statement that unsolicited commercial messages are unwanted, and the message you send is relevant to the work, office, function or role the address was published for.
Every commercial electronic message with an Australian link, including a designated commercial electronic message, must clearly and accurately identify the individual or organisation who authorised it and include accurate contact information for them, reasonably likely to stay valid for at least 30 days.
Every commercial electronic message with an Australian link that is not a designated commercial electronic message must include a clear and conspicuous statement that the recipient may send an unsubscribe message to an electronic address that is legitimately obtained and reasonably likely to be capable of receiving unsubscribe messages for at least 30 days after the message is sent.
Once the account-holder, or a user of their account, sends you a message withdrawing consent (which includes an unsubscribe message under section 18), stop sending further commercial electronic messages to that address from the end of the fifth business day after it was sent, unless fresh consent is given.
Do not send, or cause to be sent, a commercial electronic message with an Australian link to an electronic address you have no reason to believe exists.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Penalty structure

Section 25 tiers the pecuniary penalty a court may order under section 24 for a contravention of a civil penalty provision (sections 16, 17, 18, 20, 21 and 22) by whether the defendant is a body corporate, whether it has a prior record for that same provision, and whether the provision is subsection 16(1), (6) or (9) or another one. With no prior record: 100 penalty units per contravention of section 16 for a body corporate (2,000 units aggregate for 2 or more contraventions on one day), 50 units for any other provision (1,000 aggregate); 20 units per contravention of section 16 for an individual (400 aggregate), 10 units for any other provision (200 aggregate). With a prior record: 500 units per contravention of section 16 for a body corporate (10,000 aggregate), 250 units for any other provision (5,000 aggregate); 100 units per contravention of section 16 for an individual (2,000 aggregate), 50 units for any other provision (1,000 aggregate). The figures recorded here are the highest tier (body corporate, prior record, section 16), converted at $364 per penalty unit, the amount the Crimes (Amount of a Penalty Unit) Instrument 2026 fixes under Crimes Act 1914 subsection 4AA(1A) for an offence or a civil penalty provision committed on or after 1 July 2026. Schedule 3 separately lets the ACMA give an infringement notice as a lower-value alternative to Federal Court proceedings: for a body corporate, 20 penalty units for a single alleged contravention of section 16 (multiplied per contravention up to 1,000 units for 50 or more), and half that for any other civil penalty provision; for an individual, 4 penalty units for a single alleged contravention of section 16 (up to 200 for 50 or more), and half that for any other provision.

Rule: Per violation only
As of: 25 September 2026
Currency: AUD
Fixed cap: 3,640,000
Per violation unit: Violation
Per violation amount: 182,000

What it reaches

Obligation class

Consent, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 16 bars sending, or causing to be sent, a commercial electronic message with an Australian link unless the relevant electronic account-holder consented (Schedule 2: express consent, or consent reasonably inferred from the account-holder's conduct and business or other relationships, including from a business address they conspicuously published without an opt-out statement, for a message relevant to the work, office or role the address was published for) or the message is a designated commercial electronic message exempt under Schedule 1.

Section 17 requires every commercial electronic message with an Australian link, designated or not, to clearly and accurately identify who authorised it and give accurate contact information valid for at least 30 days.

Section 18 requires every such message that is not designated to carry a functional unsubscribe facility: a clear, conspicuous statement that the recipient may send an unsubscribe message, to an address legitimately obtained and reasonably likely to be able to receive unsubscribe messages for at least 30 days.

Schedule 2 clause 6 provides that once the account-holder, or a user of their account, sends a message withdrawing consent (which an unsubscribe message under section 18 is), the withdrawal takes effect at the end of the fifth business day after it was sent.

Sections 16 to 18 are civil penalty provisions, and section 25 sets the maximum pecuniary penalty a court may order under section 24, tiered by whether the defendant is a body corporate, whether it has a prior record for the same civil penalty provision, and whether the provision is section 16 or another one (17, 18, 20, 21 or 22).

Section 28 lets the Federal Court, on the application of the ACMA or a person who has suffered loss or damage from one or more contraventions of one or more civil penalty provisions found in ACMA-initiated proceedings under section 26, order the perpetrator to compensate that person; for a section 16 contravention the court may weigh the victim's expenses in dealing with the messages, the effect on their business, reputational damage and lost business opportunities.

This is an application within an existing ACMA proceeding rather than a free-standing civil action a victim can start on their own.

When LexLint raises it

automated_outreach

Read the law

Federal Register of Legislation, official compilation of the Spam Act 2003

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app