Is Cold Email Legal in Australia? Spam Act 2003 Rules

Is cold email legal in Australia?

Yes, but only with a consent basis. Under the Spam Act 2003, a B2B prospecting email is lawful only when you can point to a consent basis for that exact address. The email also has to name the sender and carry an unsubscribe that works. Send without a consent basis and you break the law, whether the inbox belongs to a shopper or a CFO.

The Spam Act 2003 puts the core rule in one line: "Unsolicited commercial electronic messages must not be sent." A sales email to someone's work address is a commercial electronic message. A business inbox gets no automatic pass. The only route shaped around work addresses sits inside the consent rules, and it is called conspicuous publication.

So consent can come from 3 places:

1. Express consent. The person told you yes.
2. Inferred consent from a relationship. They gave you the address themselves and would reasonably expect your marketing.
3. Inferred consent from conspicuous publication. Their work address is openly published and your email is relevant to their job.

Whichever route applies, every commercial message still needs accurate sender details and a working unsubscribe.

Everything below is Australian law only, based on the Act text and ACMA guidance. It is general information, not legal advice. For other countries, cold email laws by country lists the official sources, and the European comparison is how legitimate interest works for cold email.

How does consent work under the Spam Act 2003?

ACMA's spam guidance starts from the same point. ACMA's "Avoid sending spam" page says that if you plan to send marketing messages or emails, you must first have consent from the person who will receive them. It also puts the proof on you: under the Spam Act, it is up to the sender to prove it had consent. Everything else sits behind that gate.

Express consent means the person said yes to you. ACMA lists forms, ticked boxes, phone calls and face-to-face conversations as ways to give it. In B2B, that is a demo request with a marketing checkbox the visitor actually ticked. It is also an operations manager at a trade show who hands over a card and asks you to email the spec sheet.

Inferred consent is narrow. It holds only where the person gave you their address themselves and would reasonably expect marketing from your business. Both parts must hold:

• Knowingly and directly. The address came to you from the person. An address passed on by a data vendor, an event organizer or a directory that resold it fails this part.
• Reasonable expectation. A client who signed with you and shared their email during onboarding would expect to hear about a related service. A supplier who wrote to you once about an unpaid invoice would probably be surprised by a sales sequence.

ACMA makes one more point that matters for anyone using outside help. Outsourcing the sending leaves the need for consent from every recipient in place. You can hand the list to an agency or a freelancer, and the legal question still sits on your desk.

What is conspicuous publication in Australia?

This is the route B2B prospecting leans on, and it has 3 conditions. Schedule 2 of the Act says consent may not be inferred from the mere fact that an electronic address has been published (Spam Act 2003, Schedule 2). Consent can be inferred only in limited cases, such as an existing relationship or conspicuous publication. For publication to count, all 3 of these conditions must hold:

• The address is conspicuously published: openly and prominently, where anyone could find it.
• No statement next to it says the person does not want unsolicited commercial messages at that address.
• Your message is relevant to the person's work role, industry or profession.

Relevance is the condition that is easiest to get wrong. Picture an IT manager at an accounting firm whose email sits on the firm's own "meet the team" page. An email about managed backup for client files fits that job. A pitch for office coffee machines or a team holiday package has no link to it, and for that message the published address gives you nothing.

A published address covers only messages that match the role it was published for. A single "no sales enquiries" line beside the address removes the route for that contact completely.

What must every commercial email include?

Consent decides whether you may send at all. Two further rules in the Act decide whether the email itself is compliant.

Accurate sender information. The Act requires commercial messages to "include accurate sender information" (Spam Act 2003). The reader must be able to see which business sent the email and how to reach it. A first name on a throwaway domain does not pass.

A functional unsubscribe facility. The same Act requires "a functional unsubscribe facility", and an unsubscribe request has to take effect within 5 working days (Spam Act 2003). The word that matters is "functional". The Act expects the link or reply route to keep working for at least 30 days after the email is sent.

For a B2B team running several mailboxes, this turns into a short checklist:

• The display name is a real person, and the signature names the company plus a website or physical address
• The sending domain clearly connects to your company name
• Every email carries one plain opt-out line, such as "Reply 'no thanks' and I will not write again"
• Replies go to an inbox a person reads every working day
• Every opt-out lands in one exclusion list shared by all mailboxes, domains and senders on the account
• Follow-ups carry the same sender details and opt-out line as the first email

Each follow-up counts as its own commercial message, so both rules apply to it too, and the number of follow-ups in a cold email sequence sets how many messages that is. Follow-ups are where opt-outs get missed. An opt-out after email 1 must stop emails 2, 3 and 4 automatically, with no manual step in between.

The shared exclusion list is what makes that happen. The domain, authentication and mailbox side sits in the deliverability and infrastructure FAQ.

Can you email a business contact just because their address is public?

A public address is not a yes.

The relationship route needs the person to have handed the address to you themselves, knowingly and directly. An address on a public page was offered to everyone who visits that page. The relationship route is therefore closed on that basis alone. Unless the person gave express consent, conspicuous publication, with every one of its conditions, is the only route left.

Ask 3 questions about each address before it goes into a sequence:

1. Who published it? The person or their employer, on a page they control, counts as publication. A data tool, a scraped directory or a browser extension that guesses emails is a weaker source: you cannot show the address was openly published by or for the person, and a guessed address was never published at all.
2. Why was it published? An address on a team page beside a job title was published for work contact in that role. An address inside a conference attendee PDF was published for the event.
3. Would this person reasonably expect this message? Read your email as that person, in that role. If the link between their duties and your offer takes more than one sentence to explain, assume it fails.

Generic inboxes need extra care. An info@ or hello@ address on a website exists so customers can reach the business. It is weak ground for a sales pitch, so test the relevance condition harder there than you would for a named buyer.

What does a lawful B2B cold email look like?

The table applies the rules above to the situations founders ask about most.

A worked example (hypothetical). A Melbourne payroll software company finds a finance director listed by name and email on a manufacturer's own leadership page. The page carries no marketing restriction.

The email runs 4 short lines: who the sender is, what the software does for manufacturers with shift workers, one question about how payroll runs today, and an offer of a 15-minute call. The signature names the company and its website, and the last line explains how to opt out.

Every condition holds. The employer published the address openly for the director's role, payroll sits inside her job, the sender is identifiable and the opt-out works.

The risky twin. Now send the identical email to 4,000 addresses from a bought spreadsheet titled "manufacturing contacts VIC", with no note of where any row came from. The copy has not changed, and the verdict flips, because nobody can show a consent basis for a single row. Copy cannot fix a bad list, legally or commercially.

What should founders check before sending cold email in Australia?

Run this list once per campaign, before the first email goes out:

1. Add a consent column to your list. For every row, record the basis (express, relationship or published), the source page URL and the date you saw it. A row with an empty consent cell does not get emailed. More on building lists that hold up in our lists and targeting FAQ.
2. Re-read each publication page. Look for "no sales", "no marketing" or "no solicitations" wording near the address before the row goes live.
3. Write the relevance sentence. One line per segment explaining why your offer fits that job title. If you cannot write it, drop the segment.
4. Verify every address. Run the list through a verification tool before the first send, and keep the bounce rate under 0.5%. Cheap freelancer lists bring low open rates and high bounces, and they are also the lists where you cannot show a consent basis.
5. Prepare the sending side. SPF, DKIM and DMARC on every domain, and new mailboxes warmed up for at least 10 to 14 days before any prospect sees them.
6. Wire up the suppression list. One exclusion list across every mailbox, processed well inside the 5-working-day limit, ideally the same day.
7. Decide the first channel. When the email basis for a contact is unclear, open on LinkedIn with a message that pitches nothing. If the person later shares their email with you, that basis beats anything a published page can give.

LinkedIn can carry a campaign by itself. For an advertising agency in Australia, our LinkedIn outreach booked 2,582 sales calls in 12 months, and 37.9% of connected prospects replied.

It also keeps the first touch away from the email-consent question, though the Act's wording may still reach LinkedIn messages (see the FAQ below). My rule is that email should not be the first touchpoint anyway: warm emails follow a LinkedIn touch.

Which mistakes make Australian cold email risky?

Check for these first in any Australian campaign:

• Harvested or scraped lists. The Act has a separate part on address-harvesting software and the lists it produces, which "must not be supplied", "must not be acquired" and "must not be used" (Spam Act 2003). A scraped list gives you neither express consent nor conspicuous publication, however public the source looked, and scraping LinkedIn and cold emailing raises the same question outside Australia.
• Asking for consent by email. ACMA is explicit that you cannot send an electronic message to ask for consent, because that request is itself a marketing message. That includes a friendly "may I send you some information?" email.
• Pitching anything to a published address. Publication covers role-relevant messages only. A broad offer sent to every published address in an industry fails the relevance test for most of them.
• Sender details that drift. A rebrand, a retired domain or a signature template that drops the company name can leave old sequences running without accurate sender information.
• Unsubscribes that break. Links to a deleted page, a reply inbox nobody checks, or opt-outs logged in one mailbox while the other mailboxes keep sending.

Before you upload a list, sort it by the consent column. Every blank row stays out of the sequence. No exceptions.

No consent basis recorded, no email

My rule of thumb is short: no consent basis recorded, no email. If a contact has no recorded basis, they stay off the send list until you have one. Volume only helps once the list is clean. Fix that first.

If you are building an Australian list and want a second opinion on the consent column before the first send, bring ten rows. Book a call.