Is Cold Email Legal in Australia? Spam Act Rules for B2B Outreach (2026)

Is cold email legal in Australia, in short: only with consent. The Spam Act 2003 requires express or inferred consent before a commercial email with an Australian link. For B2B, consent can be inferred from a conspicuously published work address used for a role-relevant message. Every email must identify you and include an unsubscribe honoured within 5 working days.

More on this topic: Cold email and deliverability, every guide in one place.

That puts Australia with Canada, not the United States. Under CAN-SPAM you can send the first commercial email without permission; under the Spam Act you cannot. A sequence that is fine for US prospects can breach Australian law for the same list's Australian contacts. This guide covers when the Act applies, the consent routes that work for B2B, what every message must contain, and the penalties in dollars.

Key takeaways

Is cold emailing legal in Australia?

Cold emailing is legal in Australia only when the recipient has consented, expressly or in a way that can be inferred. Section 16 of the Spam Act prohibits sending, or causing to be sent, an unsolicited commercial electronic message with an Australian link, and an email that offers or promotes goods, services or a business opportunity is commercial.

The ACMA's guidance puts the rule simply: before you send marketing emails or messages you must have consent from each person who will receive them, even when someone else sends them for you. It is also up to you to prove that consent. Buying a list does not move that burden: you are still responsible for consent for every address you use, and lists built with address-harvesting software are banned outright.

Does the Spam Act apply to B2B email and to overseas senders?

Yes on both counts. The Act has no general exemption for business-to-business email, and it applies to any commercial message with an Australian link — which includes a message accessed by an organisation that carries on business in Australia, or on a computer or device located in Australia, wherever the sender is.

So a US or UK company emailing an Australian prospect is covered. The Act also covers SMS and other electronic messages, not just email.

What counts as consent under the Spam Act?

Consent under the Spam Act is either express consent, or consent that can reasonably be inferred from the person's conduct and their business or other relationships. Inferred consent is narrower than most senders assume, and the ACMA describes it as less reliable than express consent.

How conspicuous publication works for B2B

The Act says consent cannot be inferred merely because an address was published, then sets out the exception B2B outreach relies on. Consent is taken to exist when all of these hold:

• The address reaches a person or role in an organisation: an employee, director, officer, partner, office-holder, self-employed individual, or a role address such as a purchasing inbox.
• It has been conspicuously published — for example on the company's own website or in a public directory listing.
• It is reasonable to assume the publication was agreed by that person, or by the organisation for a role address.
• There is no “no unsolicited messages” statement next to it, or anything to similar effect.
• Your message is relevant to the person's work, office, position or role.

In practice: the head of operations listed on a logistics firm's team page can be emailed about warehouse software, but not about your personal finance course. An address scraped from a social profile, a guessed address built from a naming pattern, or one from a bought list does not show any of these conditions. Record where each Australian address was published and when.

What must every commercial email to Australia include?

Every commercial email with an Australian link must accurately identify the individual or organisation that authorised it, include accurate contact details, and contain a functional unsubscribe facility. These apply even when you have express consent.

The ACMA's own examples of clear wording are short: reply with “unsubscribe” in the subject line, or click the unsubscribe button below. A reply-based opt-out works as long as the mailbox actually receives and processes replies.

What are the penalties for breaking the Spam Act?

Spam Act penalties are set in penalty units and reach 10,000 units — $3.64 million at the current $364 value — for a company with a prior record that sends unsolicited messages on a single day. The Federal Court sets civil penalties; the ACMA can also issue infringement notices, formal warnings and accept court-enforceable undertakings.

Penalty units are from section 25 of the Spam Act. Dollar figures use $364 per unit, the Commonwealth value for contraventions on or after 1 July 2026; earlier contraventions use the value in force at the time ($330 between 7 November 2024 and 30 June 2026).

The ACMA can bring proceedings up to six years after a contravention, and the Act also lets the court order compensation and recovery of financial benefit. Helping, encouraging or being knowingly concerned in someone else's breach is itself a breach, which matters for agencies sending on a client's behalf.

Spam Act vs CAN-SPAM, CASL and PECR: what is different?

The Spam Act sits with Canada's CASL as an opt-in law: consent before the first message. The US is opt-out, and the UK treats corporate subscribers more leniently than individuals.

For the detail on each, see CAN-SPAM rules for B2B, cold email in Canada, cold email in the UK and GDPR and cold email.

How do you run compliant cold email to Australia?

You run compliant cold email to Australia by keeping Australian contacts in their own segment, recording a consent basis for each one, and sending short, role-relevant sequences that invite an opt-in.

• Tag country on every contact and route Australian addresses to a separate list.
• Record the source: the page URL and date where each work address was published, and check it has no “no spam” notice.
• Check role fit before enrolling anyone; the offer must relate to their job.
• Drop bought, scraped and guessed addresses. They fail the conspicuous publication test.
• Put your legal name or ABN and contact details in every footer.
• Suppress unsubscribes across every campaign well inside 5 working days.
• Ask interested replies to opt in, so the relationship moves onto express consent.

For volume and warm-up, see how many cold emails per day per inbox and the email deliverability checklist.

In Scalry, which publishes this guide, cold email sequences add a footer with your business identity and address and an unsubscribe link to every send, and an unsubscribe suppresses the contact across all campaigns before the next send. Recording where each Australian address was published is still yours to do.

Rules summarised from the Spam Act 2003 (current compilation on the Federal Register of Legislation) and the ACMA's Avoid sending spam guidance; penalty unit value from ASIC's table of Commonwealth penalty units. Checked on 26 October 2026. This is a plain-English summary, not legal advice — check with an Australian lawyer for your own situation.

Frequently asked questions

Is cold emailing legal in Australia?

Only with consent. The Spam Act 2003 bans unsolicited commercial electronic messages with an Australian link. For B2B, consent can be inferred when a work address was conspicuously published without a no-spam statement and your message relates to the person's role.

Does the Spam Act apply to B2B emails?

Yes. There is no general B2B exemption. Business addresses are covered, and conspicuous publication is the main route for reaching a business contact you have no relationship with.

Can I email an Australian business address I found online?

Possibly, if it was published with the person's or organisation's agreement, has no statement refusing unsolicited messages, and your message is relevant to their role. Keep a record of where and when you found it.

Can I send an email asking for permission to market?

No. The ACMA says a message asking for consent is itself a marketing message, so it needs consent too.

How fast must I process unsubscribes in Australia?

Within 5 working days. The unsubscribe facility must work for at least 30 days after the message is sent, and cannot require a fee, a login or extra personal information.

What is the fine for breaking the Spam Act?

Penalties are in penalty units. A company with no prior record faces up to 2,000 units a day for sending without consent ($728,000 at $364 a unit); with a prior record, 10,000 units ($3.64 million). The ACMA can also issue infringement notices.

Does the Spam Act apply to companies outside Australia?

Yes, when the message has an Australian link — for example when it is accessed on a device in Australia or by an organisation that carries on business there.

How Scalry adds identification, unsubscribe links and suppression to every send is described on the cold email page.