Spam Act Rules for Store Email and SMS: Consent, Identity and Unsubscribes

The three rules

The ACMA summarises the Spam Act's requirements for commercial electronic messages, which include email and SMS, in three rules^[1]:

Express and inferred consent

Express consent is when someone actively agrees to receive marketing, such as by ticking an unticked box. Inferred consent can sometimes be assumed when a person has voluntarily given their address and would reasonably expect marketing from the business. The ACMA says this usually applies to an ongoing, provable relationship, such as a subscriber or account holder, where the marketing relates directly to that relationship. It also notes that inferred consent does not cover messages sent just after a purchase, and that it is less reliable than express consent^[1].

For an online store, the practical answer is to rely on express consent. A one-off purchase should not be treated as permission to market.

Designing the opt-in

• An unticked tick box at checkout and account signup, worded plainly, such as "Email me about new products and offers"
• No pre-ticked boxes, and no consent hidden in terms and conditions
• A record of when and where each person opted in, passed to your email platform
• Separate choices for email and SMS if you use both
• A confirmation message that repeats what people signed up for

Transactional messages are different, until they are not

Order confirmations, shipping notifications, delivery updates and receipts are generally sent to complete a transaction rather than to promote, so they are not usually treated as marketing. Adding a promotional section, such as "10% off your next order" or a product carousel, can turn them into commercial messages that need consent, identification and an unsubscribe. Keep transactional emails transactional, or make sure the promotional parts are only sent to people who opted in.

Abandoned cart messages

Abandoned cart emails remind someone about items they left behind, often with a nudge to buy. They are promotional in nature, so treat them as marketing: send them only to people who have given consent, include your business identification and an unsubscribe. Some platforms send them by default; check the setting before launch.

Unsubscribes that actually work

The unsubscribe has to be honoured within five working days^[1]. Problems usually come from connections, not intent:

Personal information and your email platform

Sending customer data to an email or SMS platform moves personal information to another system. Australian Privacy Principle 11 requires reasonable steps to protect personal information, expressly including technical and organisational measures since December 2024^[2]. Many small businesses with turnover of $3 million or less are exempt from the Privacy Act, but some are covered regardless of size, including businesses that trade in personal information^[3]. Send only the fields your marketing actually uses.

Subscriptions and reminders

If you sell subscriptions, the reminder emails before a renewal are part of the service. The Competition and Consumer Amendment (Unfair Trading Practices) Act 2026 passed on 2 July 2026, with its rules starting on 1 July 2027^[4][5]. A law firm summary says regulations will require reminders at points such as before a free trial ends or before renewal, and an easy-to-find cancellation method^[6]. We suggest keeping those reminders free of promotions, so they read as service messages, and checking the regulations once they are made.

Setting it up on your store

• Add unticked opt-ins at checkout and signup, with plain wording.
• Map the consent field from the store to your email and SMS platforms during integration.
• Review default automations, such as abandoned cart and post-purchase flows, and limit them to consented contacts.
• Add identification and unsubscribe blocks to every marketing template.
• Sync opt-outs across every tool that sends marketing.
• Test it: sign up, buy, unsubscribe, then buy again and confirm you are not re-subscribed.

This guide is general information, not legal advice. The ACMA's guidance is the authoritative source for how the Spam Act applies to your business.