Understanding Australia's anti-spam legislation

You will learn

Learn about Australia's anti-spam legislation and message requirements to help you remain compliant.

In Australia, the sending of SMS and email marketing messages is regulated by the Spam Act 2003 (Spam Act) and the Spam Regulations 2021. The Spam Act was designed to protect people from receiving spam, or “unsolicited commercial electronic messages.” It applies to the sending of commercial electronic messages (CEMs) and governs who you can send to and what your messages need to include.

This information is not legal advice. Klaviyo recommends that you consult with your legal counsel to make sure that you comply with the Spam Act and all other applicable laws in connection with your marketing program.

About Australia’s Spam Act and regulations

The Spam Act regulates the sending of any CEMs, including:

• Email
• SMS and MMS
• Instant messages

The 3 main requirements under the Spam Act for sending messages are:

• Obtain proper consent
• Provide identification information and contact details
• Include a method to unsubscribe/opt out of messaging

The Australian Communications and Media Authority (ACMA) enforces the Spam Act. Violations can result in financial penalties. Maximum penalties are set in penalty units and vary by the provision breached, whether the sender is a company or an individual, and whether they have a prior record of breaches.

What is consent under the Spam Act 2003?

There are 2 types of consent under the Spam Act: express and inferred. Express consent means someone explicitly opts in to receiving marketing messages from your organization. Inferred consent depends on the person’s conduct and their business or other relationship with you.

As a best practice, you should keep records of when you get consent, including the:

• Type of consent
• Consent method
• Date/time an individual consented

When someone opts in through a Klaviyo sign-up form, Klaviyo records their consent on their profile. You can also import consent status and timestamps from another provider. Keep your original records showing how that consent was obtained.

Express consent

Express consent means someone directly gives you permission to send them marketing messages via a certain channel. If you rely on express consent, obtain it before sending a CEM.

When someone consents to receive one type of electronic marketing message, this does not count as permission to send them any other type of CEM. For instance, if you have someone’s consent for email, you can only send them emails; it does not count as permission to send SMS, mobile push, or any other kind of message.

There are several ways someone can give you their express consent, including:

• Signing up via a form
• Checking a box on a website
• Telling you over the phone

Note that someone simply giving you their information (email, phone number, etc.) does not count as them granting permission to message them.

Some types of CEMs (such as SMS) always require express consent when using Klaviyo. However, others (such as email) allow inferred consent in certain circumstances. Follow both the applicable laws for the area you’re sending to and Klaviyo’s terms and policies, applying the stricter requirement where they differ.

Inferred consent

Inferred, also called implied, consent is permissible in only a few scenarios. It is also typically a gray area, so express consent is preferred and recommended in all cases.

This type of consent may apply when someone has knowingly and directly given you their information, and it is reasonable to believe they would expect to receive marketing messages from your business. This does not give you permission to message them for anything; inferred consent is limited to something specific.

Inferred consent typically comes into play when you have an existing relationship (a “provable, ongoing relationship”) with the recipient, and the marketing you want to send them is directly related to that relationship. You may have a business relationship with someone who provided their contact information when they subscribed to a service, has an account, or is a member. If the marketing is relevant to that relationship, you may have the person’s inferred consent to send messages relevant to your business relationship with them.

Message requirements under the Spam Act

In addition to obtaining the proper consent, the Spam Act requires that you include the following information in every CEM:

• Your legal business name, or your company name and Australian business number
  • If someone else sends messages on your behalf, the CEM must still identify you as the business that authorized the message
  • This information must remain correct for at least 30 days after you send your message
• Contact details for your business or a link to your business’s contact details
  • Your contact information must remain correct for at least 30 days after you send your message
• An opt-out mechanism (e.g., an unsubscribe link) that:
  • Presents unsubscribe instructions clearly
  • Honors the request to unsubscribe within 5 working days
  • Does not require the payment of a fee
  • Does not cost more than the usual amount for using the address (such as a standard text charge)
  • Is functional for at least 30 days after you sent the message
  • Does not force recipients to provide extra personal information or create or log into an account to unsubscribe

In emails, the typical approach is to add your business name, contact details, and opt-out instructions to the footer. By default, Klaviyo adds an unsubscribe link to marketing emails that do not already contain one, but that fallback footer does not add your contact details. Check that your email includes all the required information before sending.

In Australia, you can send SMS using a registered branded sender ID or a long code. Branded sender IDs help recipients recognize your business, but they cannot receive replies or send MMS. To send MMS to Australian recipients, use a long code.

Klaviyo includes an unsubscribe link by default for branded sender IDs. With a long code, include unsubscribe instructions, such as “Reply STOP to opt out.” Before sending, check that your message identifies your business, provides contact details or a link to them, and includes a working opt-out method. Learn more about setting up and registering a branded sender ID.

Best practices

While not explicitly required by the Spam Act, the following are best practices for sending CEMs in Australia:

• Include at least 1 link to your website
• Send messages between 9 a.m. and 8 p.m. in the recipients’ local time (for SMS and direct messages); use quiet hours for flows and quiet hours for campaigns to manage SMS sending times. Review the configured quiet-hours window and time zone for Australian recipients; enabling quiet hours does not automatically enforce 9 a.m.–8 p.m. in each recipient’s local time
• Do not use common spam-related phrases in your messages or email subject lines; e.g., “free money”
• Provide value: every CEM should be helpful to the recipient; if not, subscribers will likely opt out
• Avoid sending a lot of emojis and using acronyms unless you know your audience understands or responds positively to them
• Do not overload recipients with too many messages; for instance, use Smart Sending to limit how often someone can receive messages via a certain channel

Sending to Australian recipients using Klaviyo

When sending to Australian recipients using Klaviyo, it’s important that you also comply with Klaviyo’s Terms of Service and Acceptable Use Policy, which, in certain cases, may be more strict than Spam Act requirements.

Additional resources