Is Cold Email Legal in Australia? The Spam Act Explained for Agencies

Whether cold email counts as spam is one of the first things Australian agency owners ask us about outbound. So, is cold email legal in Australia? Generally yes, for business-to-business email that follows the Spam Act 2003. But most explainers stop at "you need consent", which doesn't help much before you email 2,000 businesses you've never spoken to.

This guide covers the one consent route true B2B cold email relies on, the three rules every commercial email must follow, what ACMA has actually penalised, how New Zealand differs, and a checklist to run before you send. It's the long version of the legal section in our guide to cold email for marketing agencies in Australia.

This is general information, not legal advice. Laws and penalty amounts change, so check the official sources linked below and get legal advice for your own situation.

Is cold email legal in Australia?

Generally yes. Cold B2B email is generally treated as permitted where all three of these are true:

1. The work address is published. The recipient's address has been conspicuously published, for example on their website or in a directory, with their agreement.
2. There's no "no spam" notice. Nothing next to the address says they don't want unsolicited commercial messages.
3. The message is relevant to their role. Pitching paid ads to a head of marketing fits. Pitching personal finance to a receptionist doesn't.

Every email must also identify who sent it and include a working unsubscribe that's honoured within five business days.

The point that catches most agencies out: there is no business-to-business exemption. Under the Spam Act 2003, a cold sales email to a company director is a commercial electronic message, just like one to a consumer.

Our published position: "We are not legal advisors, but we build campaigns to avoid spam risks and encourage you to review official ACMA guidance at acma.gov.au/avoid-sending-spam." Read ACMA's guidance on avoiding spam before you send anything.

What does the Spam Act 2003 cover?

The Spam Act 2003 (Cth) governs commercial email, SMS and instant messages in Australia, and the Australian Communications and Media Authority (ACMA) enforces it. Three definitions do most of the work:

• Electronic message (s5). A message sent to an email, instant messaging, telephone or similar account: email, SMS, MMS and instant messages. Voice calls aren't covered, and the Spam Regulations 2021 say a fax is not a commercial electronic message.
• Commercial electronic message (s6). Judged on the message's content, its presentation and the content its links and contact details lead to. If one of its purposes is to offer, advertise or promote goods, services or a supplier, it's commercial. ACMA: "if a message includes marketing content or direct links to marketing content, it is a commercial message."
• Australian link (s7). The Act applies if the message starts in Australia, the sender is in Australia, or the recipient's account-holder is in Australia or carries on business here when the message is accessed, among other triggers.

The Australian link is the one overseas senders miss: a New Zealand agency emailing businesses in Sydney or Melbourne is covered. We're based in Auckland, and the Act applies to every campaign we run into Australia.

Do you need consent to cold email a business in Australia?

Yes. Section 16 bans sending an unsolicited commercial electronic message without consent, and section 16(5) puts the burden of proving consent on the sender. ACMA's guidance: "Under the Spam Act, it's up to you to prove that you have a person's consent." You also can't email someone to ask for consent, because the request is itself a marketing message.

Schedule 2 of the Act allows express consent, such as a ticked box or a sign-up form, and consent that can reasonably be inferred from a person's conduct and relationships. Inferred consent from a relationship usually needs a provable, ongoing relationship with your business, such as a current customer. A true cold email has neither, which leaves one route.

Conspicuous publication: the route B2B cold email relies on

Clause 4 of Schedule 2 opens with a warning: consent "may not be inferred from the mere fact that the relevant electronic address has been published." Publication only counts when all of these are true:

• the address is one the public can use to contact a particular employee, director, officer, partner or self-employed person, or whoever fills "a particular function, or fulfilling a particular role" (so a role address such as marketing@ can count);
• it "has been conspicuously published";
• it's reasonable to assume it was published with the agreement of that person, or of the organisation for a role address;
• it isn't accompanied by a statement that the account-holder doesn't want unsolicited commercial messages at that address;
• and the message is relevant to the person's "work-related business, functions or duties", or to the role concerned.

ACMA's guidance for people receiving spam states the same test from the other side: "You may also be sent marketing messages relevant to your role or position if you make your email address or phone number public."

Role relevance is the core test. Target the person whose job your offer relates to, and keep the message about that job.

Bought lists, harvested lists and found addresses

A purchased list doesn't bring consent with it. ACMA: "Take care when you buy or use a marketing list. You are still responsible for making sure you have consent for any addresses you use." ACMA also says businesses "cannot outsource their obligations". Each address needs its own consent basis.

The Act also targets address-harvesting software: software "specifically designed or marketed" for searching the internet for electronic addresses and collecting them (section 4). Sections 20 to 22 ban supplying, acquiring or using that software, or any list produced with it, in connection with messages that breach the consent rule.

One question is unsettled. An address found by an email-finding tool, through pattern matching and verification rather than read from a public page, may not be "conspicuously published". It matters for any agency using these tools, and the answer depends on the facts, so get legal advice on your own lists.

The three rules every commercial email must follow: consent, identify, unsubscribe

Consent decides whether you can send at all. The other two rules apply to every commercial email, whatever the consent basis.

Identifying the sender

ACMA's guidance: "Use the correct legal name of your business, or your name and Australian Business Number (ABN). This information must remain correct for at least 30 days after you send the message." If a third party sends on your behalf, the message "must still identify you as the business that authorised the message".

That matters for agencies. If you bring in an outside team to run outbound, your agency is still the authorising business and must be identified in every email. Both the business and anyone who helps it send can be liable, because section 16(9) covers ancillary liability.

A working unsubscribe

According to ACMA, a compliant unsubscribe facility:

• "presents unsubscribe instructions clearly";
• "honours a request to unsubscribe within 5 working days";
• "does not require the payment of a fee";
• "does not cost more than the usual amount";
• "is functional for at least 30 days after you sent the message";
• "does not require the person to give extra personal information or log in to, or create, an account".

Since 1 April 2021, the Spam Regulations have also said the facility can't ask for any personal information other than the address the message was sent to. Because the Act asks for a clear statement in the message, every email needs the unsubscribe instruction written into it.

What are the penalties for spam in Australia?

Penalties are set in penalty units under section 25. At $364 per penalty unit, the value from 1 July 2026, the maximum civil penalties for a company breaching the consent rule are:

That's up to about $3.6 million a day for repeat offenders, under current penalty units. Sender identification and unsubscribe breaches carry half those amounts. These are maximums, and the dollar figure depends on which penalty unit value applies when the contravention happened. ACMA can also issue infringement notices, one per provision per day, which is how large totals build up.

What ACMA has actually penalised

All of these were consumer marketing, and no B2B cold email case appears in ACMA's recent outcomes. The pattern is plain: the large penalties turned on missing or broken unsubscribes, ignored opt-outs and poor sender identification, as much as on consent. Those are the cheapest things to get right. ACMA lists every case on its spam investigations and outcomes page.

What about the Privacy Act, the Do Not Call Register and New Zealand?

The Privacy Act 1988

A named work email is personal information: the OAIC lists "employment details, such as work address and contact details" among its examples. So APP 3 (lawful and fair collection) and APP 5 (notification) apply to lead data, while APP 7 on direct marketing gives way to the Spam Act for email. Businesses with annual turnover of $3 million or less are generally exempt, but the small business exemption is lost if the business pays to collect personal information or discloses it for a benefit, which matters for agencies that buy or sell lead data.

The Do Not Call Register

The Do Not Call Register covers telemarketing calls and marketing faxes, not email. "Business telephone numbers are not eligible for registration," according to the register's FAQs. Cold email sits under the Spam Act.

New Zealand: the Unsolicited Electronic Messages Act 2007

New Zealand's Unsolicited Electronic Messages Act is close to the Spam Act. Its "deemed consent" covers an address "conspicuously published by a person in a business or official capacity", with no no-spam statement, where the message "is relevant to the business, role, functions, or duties of the person". The unsubscribe must use "the same method of communication", and the Act covers any address that "ends with '.nz'", including from Australian senders. The regulator is the Department of Internal Affairs.

The US, UK and EU in brief

The US CAN-SPAM Act needs no prior consent, but every email needs accurate headers, a valid physical postal address and an opt-out honoured within 10 business days, with no exception for B2B email. In the UK, PECR's email consent rule does not apply to corporate subscribers, though sole traders and some partnerships need consent and UK GDPR still applies to named contacts. In the EU, GDPR treats direct marketing as a possible legitimate interest, with an absolute right to object. Australia sits between these regimes: stricter than the US because it needs consent up front, with a narrower B2B route than the UK's.

How we build cold email campaigns for agencies

These are the parts of how we run campaigns that relate to the rules above. As an Australian cold email agency, we run outreach in our clients' names.

• Sent in the agency's name. Every email goes out in the client agency's name, from branded alias domains that forward to the agency's real website, and is signed by the sender with the agency's website.
• Targeted by role. We search for decision makers by role, such as CEO, founder or head of marketing, at businesses in the agency's ideal customer profile. Where we can't find one, we fall back to the company's published general address, such as info@ or hello@. The copy is written about the recipient's business and role.
• Verified before sending. Every address is verified first. In one agency client's account, 214 of 15,627 emails bounced, a 1.4% bounce rate.
• Exclusions matched in code. Agencies send us their current clients, CRM contacts and other exclusions, and we add them to the sending tool's blocklist before launch. Do-not-contact checks match exact emails or domains in code, never by AI judgement.
• Nothing launches without sign-off. The agency sees every lead list and every email before anything goes out. In our site's words: "nothing launches without your green light."

If you're weighing up running outbound yourself against bringing in an agency, our guide to what a cold email agency costs in Australia sets out what's included. To talk through your own setup, book a call.

A compliance checklist for agency cold email

Run through this before every campaign. It reduces risk; it doesn't replace legal advice.

1. A consent basis for every address: conspicuously published, with no "no spam" statement next to it.
2. A message about the recipient's job, relevant to their role.
3. The sender identified: the business's legal name, or a name and ABN, with contact details that stay valid for at least 30 days.
4. A clear unsubscribe statement in every email, working for at least 30 days, free, with no login or extra information required.
5. Unsubscribe requests actioned within five business days, across every campaign and inbox you send from.
6. No harvested lists: nothing built with address-harvesting software (sections 20 to 22).
7. Every address verified before it's sent to.
8. Exclusion lists kept as emails or domains, not just company names, because a blocklist only catches what's on it.
9. A record of where and when each address was published, as good practice given the sender carries the burden of proof.
10. Other countries checked: the UEMA for .nz addresses, and CAN-SPAM, PECR or GDPR for the US, UK or EU.
11. Legal advice for your own situation, especially on how your addresses were found.