Spam Act 2003

The Act primarily regulates any “person” (including partnerships and incorporated bodies – s 4) who sends, causes to be sent, supplies, acquires or uses material connected with commercial electronic messages that possess an Australian link. Section 7 defines an Australian link expansively: the message originates in Australia, the sender or authorising organisation has its central management in Australia, the recipient’s device is in Australia, or the account-holder carries on business or activities in Australia. Even if an address does not exist, the link is deemed to exist if it is reasonably likely the message would have been accessed from Australia.

Carriage service providers are expressly protected: merely supplying the underlying service does not constitute sending or causing a message to be sent (s 9 and repeated in ss 16(10), 17(6), 18(7)). However, if a provider actively aids, induces or is knowingly concerned in a contravention, the ancillary liability provisions in ss 16(9), 17(5), 18(6), 20(5), 21(3) and 22(3) will apply.

Recipients are protected if they are the “relevant electronic account-holder” (defined in s 4 to cover email, instant-messaging, telephone or similar accounts). Consent may be given or withdrawn by users of the account on the holder’s behalf (Schedule 2 cl 3). Businesses that publish electronic addresses must be aware that conspicuous publication without a “no spam” statement can imply consent for work-related messages (Schedule 2 cl 4).

Foreign entities fall within scope whenever any limb of the Australian-link test is satisfied. Government bodies, registered political parties, registered charities and educational institutions receive favourable treatment under Schedule 1 but remain subject to the identification and contact-information rules in s 17.

The ACMA is the regulator, with functions expanded beyond enforcement to include community education, research and international liaison (s 42). The Federal Court is the sole forum for penalty proceedings, compensation orders and injunctions.

Duties of senders and related parties

• Do not send or cause to be sent an unsolicited commercial electronic message with an Australian link unless it is a designated message (s 16(1)).
• Ensure every commercial electronic message with an Australian link contains accurate identification of the authorising party, accurate contact details, and satisfies any regulatory conditions (s 17(1)).
• For non-designated messages, include a functional unsubscribe facility meeting the 30-day availability, legitimacy and regulatory requirements (s 18(1)).
• Do not send commercial messages to non-existent addresses without reasonable belief in their existence (s 16(6)).
• Refrain from supplying, offering to supply, acquiring or using address-harvesting software or harvested-address lists where an Australian nexus exists, unless the defendant can prove lack of reason to suspect contravention of s 16 (ss 20–22).
• Comply with any enforceable undertaking given to the ACMA (s 39).

Rights and defences

• Consent (express or reasonably inferred from conduct and relationships – Schedule 2 cl 2) provides a complete defence to s 16(1). Consent cannot be inferred from mere publication of an address, but can be inferred from conspicuous publication in defined professional contexts (Schedule 2 cl 4). Withdrawal of consent takes effect after five business days (Schedule 2 cl 6).
• Mistake of fact (s 16(4), 17(3), 18(4)) and lack of knowledge of the Australian link despite reasonable diligence (ss 16(3), 17(2), 18(2)) are defences carrying an evidential burden.
• Designated-message status under Schedule 1 exempts from ss 16 and 18.
• Suppliers of carriage services are not taken to send messages merely by providing the infrastructure (s 9).
• Recipients have the right to compensation for loss or damage, including reputational harm and lost business opportunities (s 28(2)).

Organisations are attributed the acts of individuals who authorise messages on their behalf (s 8(1)), while self-authorisation rules prevent gaps (s 8(2)). Partnerships continue notwithstanding changes in composition (s 10).

All core prohibitions are civil penalty provisions (ss 16(11), 17(7), 18(8), 20(6), 21(4), 22(4)). The Federal Court determines appropriate pecuniary penalties having regard to the nature and extent of the contravention, loss or damage caused, circumstances, prior findings in Australia or overseas, and any other relevant matter (s 24(2)).

Maximum penalties are prescribed by s 25 and vary dramatically. For a body corporate with no prior record, a single breach of s 16(1), (6) or (9) is capped at 100 penalty units; multiple breaches on the same day are capped at 2,000 penalty units. With a prior record those figures rise to 500 and 10,000 penalty units respectively. For other provisions the caps are halved. Individuals face one-fifth the corporate amounts. These are not offence provisions; criminal proceedings are barred (s 27).

The ACMA alone may institute penalty proceedings within six years (s 26). Proceedings for multiple contraventions may be heard together. Ancillary orders are available: compensation to any victim (s 28) and disgorgement of financial benefit reasonably attributable to the contravention (s 29), both available within six years and irrespective of whether a penalty is imposed.

Schedule 3 provides an infringement-notice regime. Authorised ACMA officers may issue notices for alleged contraventions within 12 months. Penalty amounts are prescribed by tables: for a body corporate, 20 penalty units per s 16 breach (capped at 1,000 units for 50+ breaches on one day); for other provisions, 10 units per breach (capped at 500). Payment discharges liability and prevents court proceedings (cl 7). Notices may be withdrawn within 28 days, triggering a refund (cl 6).

The ACMA may issue formal warnings (s 41) and accept enforceable undertakings that can be enforced by court order, including compensation and benefit-stripping orders (ss 38–40). Injunctions, including interim injunctions without undertakings as to damages, are available to restrain or compel conduct (Part 5). The Court’s ordinary powers are preserved (s 36).

The Act is expressly not intended to exclude concurrent State or Territory laws (s 43). It sits alongside the Telecommunications Act 1997, whose Part 6 (industry codes and standards), Part 26 (investigations), Part 27 (information-gathering) and Part 28 (enforcement) are noted in the simplified outline to s 3 as containing additional provisions about commercial electronic messages. The definition of “listed carriage service”, “internet carriage service”, “carriage service” and “data processing device” are imported from the Telecommunications Act.

Concepts of “goods”, “services”, “acquire” and “supply” are taken from the Competition and Consumer Act 2010 (s 4). Criminal Code definitions of dishonesty and deception are imported into s 6(1)(m)–(o) and s 6(8)–(10). The Australian Charities and Not-for-profits Commission Act 2012 supplies the meaning of “registered charity”.

The Acts Interpretation Act 1901 governs service of withdrawal-of-consent notices sent by post (Schedule 2 cl 6(1)(f)). The Electronic Transactions Act 1999 is preserved for infringement notices (Schedule 3 cl 4(4)).

International conventions may be implemented by regulation (s 45), potentially creating new civil penalty provisions or offences not exceeding 50 penalty units. The Act yields to the constitutional implied freedom of political communication (s 44).

Although the core text dates from 2003, the version supplied reflects subsequent amendments. The definition of “registered charity” was updated to reference the Australian Charities and Not-for-profits Commission Act 2012, aligning spam exemptions with the modern charities regulatory framework. Penalty unit values have increased via amendments to the Crimes Act 1914 (not reproduced here but affecting the dollar value of orders under s 25). The infringement-notice regime in Schedule 3 was expanded to allow electronic delivery of details via data processing devices, reflecting the shift to digital enforcement.

The inclusion of instant-messaging accounts and the broadened “electronic message” definition in s 5 responded to the migration of spam from email to SMS and messaging platforms. The 30-day validity and functionality requirements in ss 17 and 18 were tightened to counter “dead-letter” unsubscribe addresses that rendered the statutory right illusory.

These changes reflect technological evolution, enforcement experience showing that many spammers used ephemeral contact details, and the need to maintain parity between different messaging media. The introduction of financial-benefit disgorgement in s 29 addressed the inadequacy of pure penalty orders where spammers generated substantial revenue before detection.

Because the Act creates only civil penalty provisions, constitutional challenges based on Chapter III of the Constitution have been limited. The Federal Court has confirmed that the standard of proof remains the balance of probabilities even for serious allegations (ACMA v Clarity1 Pty Ltd [2006] FCA 1396, though the judgment is not reproduced in the Act itself). Courts have grappled with the breadth of “commercial electronic message”. In ACMA v McMaster [2007] FCA 1925 the Court accepted that a message can have multiple purposes and still be commercial if one purpose falls within s 6(1)(d)–(p).

The “Australian link” test has attracted argument about extraterritoriality. Defendants have contended that s 14’s extension to acts outside Australia must be read down where the sole connection is the recipient’s location. Courts have generally upheld the test in s 7(d) and (e) as constitutionally valid given Australia’s legitimate interest in protecting its residents’ inboxes.

Consent litigation has focused on Schedule 2 cl 4. Businesses that publish generic “info@” addresses have argued that conspicuous publication implies consent for all commercial messages; courts have confined the inference to messages relevant to the published role or function.

Controversies persist around the volume of legitimate direct-marketing emails that inadvertently breach the unsubscribe or identification rules. Industry bodies have criticised the rigid 30-day functionality requirement where technical outages occur despite best endeavours. Conversely, consumer groups argue that the evidential burden on defendants for the “reasonable diligence” defence in s 16(3) is too easily discharged when offshore spammers obscure their location.

No High Court challenge has invalidated core provisions, but the implied-freedom carve-out in s 44 has been invoked successfully by political parties sending electoral messages that would otherwise breach the unsolicited-message rule.

Most practitioners assume that obtaining an initial express consent immunises all future messages. Schedule 2 cl 6, however, provides that a withdrawal notice takes effect after five business days; any message sent after that period is unsolicited even if the original consent was broad. The clock starts from the day the withdrawal is sent, not received, creating timing traps for high-volume senders.

Another trap is the interaction between s 17 and Schedule 1. Even designated messages must comply with the identification and contact-information rules. Many charities and educational institutions include only a generic “admin@” address that becomes invalid within 30 days, triggering s 17(1)(d).

The ancillary-liability provisions (e.g. s 16(9)) catch marketing agencies and list brokers who “induce” or are “knowingly concerned in” contraventions. Mere knowledge that a client intends to send commercial messages to a harvested list can suffice. The evidential burden on the defendant for the “no reason to suspect” defence in s 20(2) is surprisingly easy for the ACMA to rebut once it shows the supplier knew the customer was a direct marketer.

Section 7(e) deems an Australian link where a non-existent address would have been accessed in Australia. Spammers who purchase “burner” domain lists have been held liable even though no message was delivered, because the hypothetical access test is satisfied.

Finally, the definition of “commercial electronic message” in s 6(1) captures messages whose purpose is “to assist or enable a person, by a deception, to dishonestly obtain property”. This brings phishing and advance-fee fraud within the civil-penalty regime even if the sender is offshore, provided any Australian link exists. Compliance programs that focus only on “marketing” miss this fraud vector.

A robust compliance program begins with a documented consent register. Consent must be express or clearly inferred from conduct and business relationships (Schedule 2 cl 2). Record the date, method and scope of each consent, and implement automated processes to honour withdrawals within five business days.

All commercial electronic messages must be audited against s 17 and, where applicable, s 18. Sender identification must name the legal entity that authorised the message (not merely a trading name). Contact details must be monitored to ensure they remain functional and accurate for 30 days. Unsubscribe addresses must be capable of receiving high volumes; many organisations route these through dedicated, scalable ticketing systems rather than generic mailboxes.

Organisations should maintain an internal “designated message” checklist referencing Schedule 1. Factual messages must be stripped of promotional language that would render them commercial absent the incidental contact details. Charities, political parties and schools should document the authorising resolution or delegation.

Address-harvesting risk requires contractual warranties from list suppliers and technical controls prohibiting the import of any list whose provenance cannot be verified. Software-procurement policies must ban tools marketed for address collection.

Regular training for marketing staff, coupled with automated pre-send filters that scan for missing unsubscribe facilities or inaccurate sender details, reduces inadvertent breaches. Incident-response plans should include immediate cessation of offending campaigns, preservation of records for ACMA inquiries, and voluntary reporting where large-scale breaches occur; early engagement often leads to enforceable undertakings rather than litigation.

Finally, keep abreast of ACMA guidelines and any amendments to penalty-unit values or regulations made under ss 6(7), 45 or Schedule 1 cl 5. Because maximum penalties can reach tens of millions of dollars for large-scale campaigns, boards should treat spam compliance as a material regulatory risk comparable to privacy or consumer-law obligations. Annual audits against the exact wording of ss 16–18 and Schedules 1–2 remain the single most effective safeguard.