Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.


Let me follow the heartbeat protocol strictly. I need to:

1. Read SOUL.md, USER.md, and memory files (today + yesterday)
2. Read MEMORY.md (main session)
3. Check inbox
4. Read fleet briefing
5. Read queue.json
6. Do work
7. Update status

Let me start by reading the required files and checking inbox/fleet status in parallel.

exec

node /home/ccuser/shared/scripts/inbox.js read --agent harper --unread 2>&1

node /home/ccuser/shared/scripts/fleet-cli.js briefing harper --brief 2>&1

ls /home/ccuser/harper/memory/ 2>&1 | sort -r | head -5


📭 harper: No unread messages


BAS Preparation — Due Feb 28

BAS Q2 finalized and ready for lodgement. Figures confirmed: $146.40 expenses, $13.30 GST refund. Self-lodgement confirmed. File: memory/bas-q2-fy2026.md. Awaiting Michael to log into ATO Business Portal and submit.

R&D Tax Incentive research

Research complete. Summary: Strong eligibility for AI/ML activities, 43.5% refundable offset. Critical issue: $20K minimum spend threshold. FY2024-25 registration deadline: 30 April 2026. Full report: memory/rd-tax-incentive-research.md

Monthly cost tracking — February

Complete. February burn: ~$134 AUD (up 16.7% from Jan). Over target by $6. API costs increasing with agent activity. Full report: memory/cost-tracking-2026-02.md

NSW small business grants scan

Scan complete. No new grants found beyond MVP Ventures NSW Round 3 ($20-75K, opens 9 March 2026). RateRight eligible under digital technologies priority sector.

Finance/legal task queue — grants, compliance, cost tracking


# MEMORY.md — Harper Long-Term Memory

## First Session — 2026-02-18
- First direct chat with Michael. He sends voice notes from Telegram.
- He's glad to have me online — was down for ~2 days.
- Irish accent, direct communicator, doesn't want waffle.

## Key Financial Facts
- **Company:** RateRight Pty Ltd | ABN 62 841 523 907 | Surry Hills NSW
- **Started:** Beginning of FY2025-26 (July 2025)
- **Bank balance:** ~$24,408 (AirWallex account)
- **Burn rate:** ~$700/month (active costs: Claude Max $340, Fly.io $189, Apollo $85, Twilio $76, ElevenLabs $22, Xero $10, Google Workspace $5)
- **Runway:** ~3 years
- **Revenue model:** $50/hire flat fee (pre-revenue, $0 earned so far)
- **Breakeven:** ~11 hires/month at blended $65/hire (~$715/month)
- **Backing:** Father in Ireland — family money, capital preservation critical
- **Banking:** AirWallex (Michael to give access)
- **Accounting software:** Xero (has it, doesn't use it)
- **Accountant:** None — self-lodging. I do 95% of prep, Michael clicks submit.

## Tax & Compliance Status
- **GST:** NOT registered. Not required until $75K turnover.
- **BAS:** Not required while not GST-registered and no PAYG obligations.
- **Company tax return:** First one due after June 30, 2026 (FY2025-26).
- **R&D Tax Incentive:** 43.5% refundable offset. $20K minimum spend threshold. Registration deadline for FY2025-26 is 30 April 2027.
- **Labour hire licensing:** NOT needed (RateRight doesn't pay workers).
- **Sham contracting:** LOW risk (construction tradies excluded).

## R&D Eligibility
- Michael confirmed: "this whole job is R&D" — everything spent is R&D apart from some wages.
- The 8-agent AI fleet IS the OpsMan prototype — all API costs are R&D eligible.
- Four systems all qualify: RateRight, OpsMan, Growth Engine, Phone AI.
- Need to build formal R&D activity log with technical descriptions.

## Legal Status
- Terms of Service: Draft complete
- Privacy Policy: Draft complete

## Grant Pipeline
- Industry Growth Program: $100K-$5M federal — in progress
- NSW Innovation Fund: $4M state — identified
- MVP Ventures NSW Round 3: $20-75K — opens 9 March 2026

## The Fleet (My Team)
- 8 AI agents, each with own Clawdbot gateway on the same VPS
- **Rivet (18789):** COO — coordinates team, drives priorities
- **Builder (18790):** Code — ships features, fixes bugs
- **Susan (18792):** Sales — lead gen, contractor onboarding
- **Harper (18796):** Finance/Legal — that's me
- **Sentinel (18800):** DevOps — infrastructure, monitoring
- **Radar (18804):** Intel — market research, competitor analysis
- **Herald (18808):** Comms — content, social media
- **Cog (18812):** Ops — task automation, process improvement

## Communication System
- JSONL inbox system for inter-agent messaging
- Fleet-state.json for status tracking
- Queue.json per agent for task management
- Buddy system: My primary buddy is Susan (Sales), secondary is Sentinel (DevOps)
- Fleet CLI scripts in /home/ccuser/shared/scripts/

## Hard Rules I Must Follow
- ALL code goes through Builder — I never write code
- Never send external comms without Michael's approval
- Never overwrite inbox files (append-only)
- Never trust cached data — verify live
- API keys in .env only, never in markdown or git
- Check inbox FIRST every heartbeat
- Update fleet status at END of every heartbeat

## Access Pending
- Gmail access (Michael to set up)
- AirWallex bank access (Michael to set up)

## Completed Work (Pre-Session)
- BAS Q2 prep: Complete (but may not be needed — not GST registered)
- R&D Tax Incentive research: Complete ($20K min threshold, 43.5% offset)
- Monthly cost tracking Feb: Complete (~$134 AUD)
- NSW grants scan: Complete (MVP Ventures Round 3 found)
- Tax optimization: 8 strategies identified, $8-9K/year potential savings


rd-tax-incentive-research.md
cost-tracking-2026-02.md
bas-q2-fy2026.md
archive
2026-02-19.md


date '+%Y-%m-%d' && cat /home/ccuser/harper/memory/$(date '+%Y-%m-%d').md 2>&1


# Harper Daily Log — 2026-02-19

## SMS Compliance Research — Spam Act 2003 (Builder + Susan requests)

### Request
Builder (msg-1771443457191) asked for Australian SMS legal requirements — opt-out language, ABN, etc.
Susan (msg-1771443673775) had pre-drafted compliance notes, asked 4 specific questions.

### Findings
- **Three mandatory requirements** for commercial electronic messages: (1) Consent, (2) Sender identification, (3) Unsubscribe facility
- **No B2B exemption** in the Spam Act — Schedule 1 only exempts factual info, government/charity, educational institutions
- **Cold SMS = non-compliant** without prior consent (express or inferred). ACMA: "You cannot send an electronic message to ask for consent"
- **ABN not required** by Spam Act specifically, but best practice
- **Recommended footer:** "RateRight Pty Ltd | Reply STOP to opt out" (42 chars)
- **NEW compliance item:** SMS Sender ID Register mandatory from 1 July 2026 — branded sender IDs must be registered or messages labelled "Unverified"
- **Consent strategy needs Michael's decision** — cold SMS outreach is technically a breach, options: phone first, get consent via other channel, or accept risk

### Actions
- Sent definitive analysis to Builder and Susan
- ACK'd both messages
- Need to flag consent strategy decision to Michael

---

## Cold Email Legal Requirements (Builder follow-up msg-1771445403153)

### Request
Builder asked: is cold emailing construction companies legal? Is cold email safer than cold SMS?

### Findings
- Same Spam Act rules apply to email and SMS — no legal distinction
- No B2B exemption for either channel
- Meeting request emails that promote RateRight = CEM (purpose test)
- Practically, cold email to published business addresses carries lower enforcement risk
- Phone calls are safest: B2B calls EXEMPT from Do Not Call Register Act
- Recommended outreach order: Phone → Email (published addresses) → SMS (highest risk)
- Sent analysis to Builder and Susan

---

## NSW Digital Work Systems Bill — Compliance Review (Radar msg-1771435306778)

### Assessment
Bill passed 12 Feb 2026 but NOT YET IN EFFECT. Defines "digital work system" as algorithm, AI, automation, or online platform. Creates new s21A duty for PCBUs re: worker H&S from digital work systems.

**RateRight risk: LOW.** Duty applies to "workers at work in the business" — tradies are independent contractors using a marketplace, not RateRight's workers. No compliance action needed now. Watch for commencement date, SafeWork NSW guidelines, and federal harmonisation.

Full analysis sent to Radar.

---

## Radar Regulatory Update — 20:35 AEDT
- Radar flagged NSW legislative changes (no immediate RateRight impact):
  1. Fair Trading & Building Legislation Amendment Bill 2026 — stronger licence cancellation powers
  2. WHS Regulation changes from 1 Jul 2026 — Codes of Practice carry greater legal weight
  3. DBPA expansion to class 3/9c buildings from 1 Jul 2026 — strata bond 2%→3%
- **Assessment:** No compliance action needed now. Changes reinforce trade licensing verification value — potential marketing angle for Herald. Noted for future compliance calendar if RateRight handles licensing checks.
- Full report: `/home/ccuser/shared/reports/radar-003-sydney-construction-market-feb2026.md`


2026-02-19

# Harper Daily Log — 2026-02-19

## SMS Compliance Research — Spam Act 2003 (Builder + Susan requests)

### Request
Builder (msg-1771443457191) asked for Australian SMS legal requirements — opt-out language, ABN, etc.
Susan (msg-1771443673775) had pre-drafted compliance notes, asked 4 specific questions.

### Findings
- **Three mandatory requirements** for commercial electronic messages: (1) Consent, (2) Sender identification, (3) Unsubscribe facility
- **No B2B exemption** in the Spam Act — Schedule 1 only exempts factual info, government/charity, educational institutions
- **Cold SMS = non-compliant** without prior consent (express or inferred). ACMA: "You cannot send an electronic message to ask for consent"
- **ABN not required** by Spam Act specifically, but best practice
- **Recommended footer:** "RateRight Pty Ltd | Reply STOP to opt out" (42 chars)
- **NEW compliance item:** SMS Sender ID Register mandatory from 1 July 2026 — branded sender IDs must be registered or messages labelled "Unverified"
- **Consent strategy needs Michael's decision** — cold SMS outreach is technically a breach, options: phone first, get consent via other channel, or accept risk

### Actions
- Sent definitive analysis to Builder and Susan
- ACK'd both messages
- Need to flag consent strategy decision to Michael

---

## Cold Email Legal Requirements (Builder follow-up msg-1771445403153)

### Request
Builder asked: is cold emailing construction companies legal? Is cold email safer than cold SMS?

### Findings
- Same Spam Act rules apply to email and SMS — no legal distinction
- No B2B exemption for either channel
- Meeting request emails that promote RateRight = CEM (purpose test)
- Practically, cold email to published business addresses carries lower enforcement risk
- Phone calls are safest: B2B calls EXEMPT from Do Not Call Register Act
- Recommended outreach order: Phone → Email (published addresses) → SMS (highest risk)
- Sent analysis to Builder and Susan

---

## NSW Digital Work Systems Bill — Compliance Review (Radar msg-1771435306778)

### Assessment
Bill passed 12 Feb 2026 but NOT YET IN EFFECT. Defines "digital work system" as algorithm, AI, automation, or online platform. Creates new s21A duty for PCBUs re: worker H&S from digital work systems.

**RateRight risk: LOW.** Duty applies to "workers at work in the business" — tradies are independent contractors using a marketplace, not RateRight's workers. No compliance action needed now. Watch for commencement date, SafeWork NSW guidelines, and federal harmonisation.

Full analysis sent to Radar.

---

## Radar Regulatory Update — 20:35 AEDT
- Radar flagged NSW legislative changes (no immediate RateRight impact):
  1. Fair Trading & Building Legislation Amendment Bill 2026 — stronger licence cancellation powers
  2. WHS Regulation changes from 1 Jul 2026 — Codes of Practice carry greater legal weight
  3. DBPA expansion to class 3/9c buildings from 1 Jul 2026 — strata bond 2%→3%
- **Assessment:** No compliance action needed now. Changes reinforce trade licensing verification value — potential marketing angle for Herald. Noted for future compliance calendar if RateRight handles licensing checks.
- Full report: `/home/ccuser/shared/reports/radar-003-sydney-construction-market-feb2026.md`


Today is 2026-02-19 (same date as the last memory file). No today-specific new memory needed. Inbox is clear, all queue tasks are complete. Let me check for anything requiring attention — the BAS deadline is 9 days away, and MVP Ventures opens in 18 days.

exec

node /home/ccuser/shared/scripts/fleet-update.js harper --status active --task "heartbeat — inbox clear, queue complete, monitoring compliance deadlines" 2>&1


Successfully wrote 253 bytes to /home/ccuser/harper/status.json


✅ Fleet state updated (cycle 1178)


Heartbeat cycle. Follow protocol strictly.


📬 harper: 1 message(s) (unread):

📩 [msg-1771450041486-0b0be5] from:builder 2026-02-18T21:27:21.486Z
   Full Rundown: What Messages Are Covered vs Not — Spam Act
   Rocky's follow-up: He wants a FULL rundown of what's covered by the Spam Act and what's not. Specifically:

1. Is it ONLY sales/marketing messages that are restricted? Or does it cover ANY business me...


BAS Preparation — Due Feb 28

R&D Tax Incentive research

Monthly cost tracking — February

NSW small business grants scan


Got an unread message from Builder — he wants a full Spam Act rundown. Let me read the full message, then research and respond.

node /home/ccuser/shared/scripts/inbox.js read --agent harper --id msg-1771450041486-0b0be5 2>&1


📬 harper: 1 message(s):

📩 [msg-1771450041486-0b0be5] from:builder 2026-02-18T21:27:21.486Z
   Full Rundown: What Messages Are Covered vs Not — Spam Act
   Rocky's follow-up: He wants a FULL rundown of what's covered by the Spam Act and what's not. Specifically:

1. Is it ONLY sales/marketing messages that are restricted? Or does it cover ANY business me...


The message is truncated. Let me get the full content.

cat /home/ccuser/shared/inboxes/harper.jsonl | grep "msg-1771450041486" 2>&1


Full Rundown: What Messages Are Covered vs Not — Spam Act

Rocky's follow-up: He wants a FULL rundown of what's covered by the Spam Act and what's not. Specifically:

1. Is it ONLY sales/marketing messages that are restricted? Or does it cover ANY business message?
2. Can we text or email someone with pure INFORMATION (not selling) — e.g. industry news, useful content, tips — without needing consent?
3. What about transactional messages (confirmations, updates to existing users)?
4. What about introductory messages that don't explicitly sell — like 'Hey, I'm Michael, I run a construction hiring platform, interested in a chat?'
5. Where exactly is the line between a commercial electronic message (CEM) and a non-commercial one?

Give the full breakdown of what's restricted vs what's free to send. Rocky wants to know ALL his options.


Good — full question in hand. This is a detailed Spam Act analysis. Let me do the research properly.

Question: Australia Spam Act 2003 commercial electronic message definition what is covered what is exempt

Question: ACMA commercial electronic message vs factual information Spam Act Schedule 1 exemptions


Question: Australia Spam Act 2003 commercial electronic message definition what is covered what is exempt

Spam Act: Everything you need to know about Spam Act 2003

At the heart of the Spam Act 2003 is the prohibition of unrequested commercial electronic messages, commonly known as spam. This rule is all-encompassing, covering a wide range of communication channels.

Spam Act 2003 - Federal Register of Legislation

6 Commercial electronic messages · 7 Australian link · 8 Authorising the sending of electronic messages · 9 Sending of electronic messages—carriage service providers · 10 Continuity of partnerships · 11 Extended meaning of use · 12 Crown to be bound ·

E-Commerce Obligations Under the Spam Act 2003 | LegalVision

The Spam Act covers messages sent via email, SMS, MMS, and instant messaging services that originate in or are accessed in Australia, with a focus on messages that offer goods, services, or business opportunities.

Avoid sending spam | ACMA

Use the correct legal name of your business, or your name and Australian Business Number (ABN). This information must remain correct for at least 30 days after you send the message. You need to make it easy for people to unsubscribe from your electronic mailing lists. Under the Spam Act, every commercial message must contain an 'unsubscribe' option that:

Section 16(1) of the Spam Act prohibits the sending of ' ...

require all email messages sent from a University email account to comply with the Spam Act 2003. Section 16(1) of the Spam Act prohibits the sending of ‘unsolicited commercial electronic

Question: Australia Spam Act 2003 commercial electronic message definition what is covered what is exempt

Avoid sending spam | ACMA


Question: ACMA commercial electronic message vs factual information Spam Act Schedule 1 exemptions

The ACMA cranks up enforcement: do your "factual" ... | Clayton Utz

However, the ACMA's most recent enforcement actions have involved messages that the businesses characterised as "factual" or "transactional" in nature and therefore thought were exempt from the consent and unsubscribe requirements of the Spam Act.

42 Additional ACMA functions · 43 Operation of State and Territory laws · 44 Implied freedom of political communication · 45 Giving effect to international conventions · 47 Regulations · CollapseSchedule 1—Designated commercial electronic messages · 1 Object · 2 Factual information ·

Is My Organisation Exempt From the Spam Act? | LegalVision

This article considers which organisations are exempt from the Spam Act. The Spam Act covers and regulates all commercial electronic messages sent by businesses that are not otherwise exempt.

Understanding the Spam Act: Compliance and Exemptions for Businesses | AJ Buckingham & Associates Pty Ltd

Additionally, businesses not classified under the above categories may send designated commercial electronic messages if the content consists solely of factual information. However, caution is advised when sending such messages.

Is My Organisation Exempt From the Spam Act? - DGZ

Australian Communications and Media ... organisations are exempt from the Spam Act. The Spam Act covers all commercial electronic messages sent by businesses that are not otherwise exempt....

Question: ACMA commercial electronic message vs factual information Spam Act Schedule 1 exemptions


Question: Spam Act 2003 section 6 "commercial electronic message" purpose test "offer to supply" "advertise or promote"


The ACMA cranks up enforcement: do your "factual" ...

During the last 18 months, the Australian Communications and Media Authority (ACMA) has taken enforcement action against a number of businesses that failed to ensure their electronic customer communications complied with the rules of the Spam Act. These enforcement actions have resulted in significant fines being issued totalling over $10 million in penalties.

Historically the ACMA has focused its enforcement activities on clear breaches of the spam rules, such as where a business has sent electronic marketing messages to individuals without their consent or failed to provide a working unsubscribe facility in its communications. However, the ACMA's most recent enforcement actions have involved messages that the businesses characterised as "factual" or "transactional" in nature and therefore thought were exempt from the consent and unsubscribe requirements of the Spam Act.

These recent matters highlight that it is not enough to simply characterise electronic messages to customers as "factual" or "transactional" to avoid the spam rules.

## What sorts of messages are subject to the spam rules?

To comply with the Spam Act, businesses must ensure that their commercial electronic messages are:

- sent with the consent of the recipient;

- include accurate sender identification details so the sender can be contacted by a recipient; and

- include a working unsubscribe facility that removes recipients from mailing lists within 5 business days.

Electronic messages (such as emails and SMSs) will be considered a "commercial electronic message" where if, having regard to:

- the content of the message;

- the way in which the message is presented; and

- the content that can be located using links, telephone numbers or contact information set out in the message,

it would be concluded that the purpose, or one of the purposes, of the message includes being to advertise or promote goods or services or a supplier of goods of services.

The promotional purpose does not need to be the sole or dominant purpose of the message; it just needs to be one of any number of purposes.

For example, in the case of Ticketek, the ACMA considered that Ticketek mischaracterised emails as being non-commercial because they contained event information for ticketholders. Even though the emails were intended to provide factual information to ticketholders, they also included a banner at the bottom which stated “Stay up-to-date with the latest Ticketek events” and then included links to social media accounts where Ticketek's goods and services are advertised and promoted. While the email banner may have seemed fairly innocuous, the ACMA formed the view that the call to visit Ticketek's social media accounts for information about other events meant that another purpose of the email was to advertise and promote Ticketek's goods and services. This made the emails a "commercial electronic message" regulated by the Spam Act.

## When are messages of a "factual" nature exempt from the spam rules?

The Spam Act permits the sending of commercial electronic messages – without consent or an unsubscribe facility – where the message satisfies specific conditions which make it a "designated commercial electronic message".

Designated commercial electronic messages include messages that consist of no more than factual information and certain limited additional information (which might be considered promotional) such as:

- the name, logo and contact details of the business that sent or authorised the sending of the message;

- the name and contact details of the author; and

- a working unsubscribe facility.

In the case of Ticketek, the banner calling on ticketholders to “Stay up-to-date with the latest Ticketek events” using Ticketek’s social media accounts meant that Ticketek's emails went beyond these strict conditions and remained commercial electronic messages that required consent of the recipient and a working unsubscribe facility.


Is My Organisation Exempt From the Spam Act?

Updated on January 24, 2024

 Reading time: 5 minutes

 Meets editorial guidelines

 This article meets our strict editorial principles. Our lawyers, experienced writers and
 legally trained editorial team put every effort into ensuring the information published on
 our website is accurate. We encourage you to seek independent legal advice. [Learn more](/editorial-guidelines/).

 [Follow us on LinkedIn](https://www.linkedin.com/company/legalvision-group/)

 Data is an important product for all types of organisations. Businesses often rely on email marketing and promotions to provide their customers with information about new products or to engage new customers and expand their reach. Due to the increasing value of data and personal information, the Spam Act 2003 (Cth) (Spam Act) restricts spam with the aim of protecting individuals from aggressive marketing strategies. [Australian Communications and Media Authority](https://www.acma.gov.au/avoid-sending-spam) (ACMA) monitors compliance with the Spam Act. This article considers which organisations are exempt from the Spam Act.

## What is the Spam Act and When Does It Apply?

The Spam Act covers and regulates all commercial electronic messages sent by businesses that are not otherwise exempt. [Commercial electronic messages](https://legalvision.com.au/e-commerce-obligations-under-the-spam-act-2003/) may include messages whose purpose is to advertise:

- the supply of goods and/or services;

- an interest in land;

- a supplier of land; or

- a business or investment opportunity.

Additionally, the message must be sent using an internet carriage service to an email, instant messaging, or telephone account. This includes social media accounts and text messages.

The law takes a holistic approach when determining if a message is a commercial electronic message. It looks at the content of the message, how the message presents itself, and any links the message includes. The most common forms of commercial electronic messages are email marketing campaigns.

Notably, even if your business is not required to comply with Australian [privacy laws](https://legalvision.com.au/privacy-laws-direct-marketing/), it will still be required to comply with the Spam Act. That is, there is no minimum threshold for businesses to whom the Spam Act applies.

## Exemptions

Not every organisation is restricted from sending commercial electronic messages. The Spam Act permits the sending of ‘designated commercial electronic messages’, which are messages by:

- government bodies;

- registered political parties;

- [registered charities](https://legalvision.com.au/not-for-profits-and-charities); and

- educational institutions (sent to current and past students as well as their households).

However, such entities can only send messages related to their own goods or services.

Similarly, businesses that are not any of the entities listed above may send designated commercial electronic messages if the message consists of no more than factual information. However, you should use caution when sending a designated commercial electronic message. This is because anything in the message that could be considered marketing or promotional material means the entire message is commercial. Consequently, the message is subject to the restrictions set out below. An example of this may be a link to a recent promotion your business is offering in the footer of the email.

[Continue reading this article below the form](#content-next)

## When Can a Business Send Marketing Material?

The Spam Act sets out three requirements businesses must follow when sending marketing or promotional material to anyone.

### 1. Get Permission From the Recipient

The most essential requirement is to have consent from the recipient before sending them marketing or promotional material. Consent may be explicit, for instance, the recipient opts in to receive your direct marketing emails. Alternatively, it may be inferred. You must not send a commercial electronic message to an individual without their inferred or express consent.

For example, you may infer permission to send the message if the recipient has knowingly given their contact information (such as when signing up for an account with your business). Likewise, it must be reasonable to believe that the recipient would expect to receive the message from your business.

You cannot assume inferred consent if the recipient has made a one-off purchase from your business.

### 2. Identify Yourself as the Sender

Your message must accurately identify your business details, including the correct contact details for you and your business.

### 3. Make It Easy to Unsubscribe

Every commercial message must include an easy-to-use and free unsubscribe facility. Your business should action requests within five working days, although most facilities have immediate unsubscribe facilities.

ACMA has the power to complete investigations and issue fines to businesses contravening the Spam Act in one or multiple ways. This includes:

- sending a commercial electronic message to an individual more than five business days after the individual withdrew consent through an unsubscribe link;

- sending a commercial electronic message without a functional unsubscribe link;

- by allowing the individual to unsubscribe only if they provided personal information; and

- only allowing an individual to unsubscribe from future commercial electronic messages if they logged into or created an account.

## Address Harvesting Software

In addition to the above restrictions, the law prohibits businesses from using address-harvesting software. Nor can your business use lists that are created through the use of address-harvesting software. This includes software that is specifically designed to search the internet for electronic addresses and compile them into a database.

 The Ultimate Guide to Starting an Online Business

 It’s now easier than ever to start a business online. But growing and sustaining an online business requires a great deal of attention and planning.

This How to Start an Online Business Manual covers all the essential topics you need to know about starting your online business.

The publication also includes eight case studies featuring leading Australian businesses and online influencers.

[Download Now](https://go.legalvision.com.au/OnlineBusinessManual.html)

## Key Takeaways

It is essential you understand whether your organisation has any obligations under the Spam Act and comply accordingly. Failure to meet these requirements may be a breach of the law. To avoid investigation by ACMA, your business should consider the following measures:

- categorise each message as a commercial electronic message;

- review your consent records and ensure you have valid consent before sending commercial electronic messages to that individual; and

- ensure all commercial electronic messages contain a functional unsubscribe link.

If you need help understanding your obligations under the Spam Act, our experienced [privacy lawyers](https://legalvision.com.au/privacy-lawyer-lvlp/) can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on [1300 544 755](tel:+611300544755) or visit our [membership page](https://legalvision.com.au/membership/).

 Was this article helpful?

 Thanks!

 We appreciate your feedback – your submission has been successfully received.

## Register for our free webinars

### Global Expansion, Global Protection: Protecting Your Brand Across Borders

 Wednesday 18 February
 |
 11:00 - 11:45am AEDT

 Online
Protect your brand as you expand globally. Register for our free webinar.

[Register Now](https://go.legalvision.com.au/global-expansion-global-protection-protecting-your-brand-across-borders?utm_source=website&utm_medium=organic)

### Common Disputes in Retail and How to Avoid T


Question: Spam Act 2003 section 6 "commercial electronic message" purpose test "offer to supply" "advertise or promote"

A reminder about Spam: Ticketek case

Under the Spam Act (section 6), ... be concluded that the purpose, or one of the purposes, of the message is: to offer to supply goods or services; or to advertise or promote goods or services; or to advertise or promote a supplier, ...

Spam: An Examination of Private and Legislative Responses to Unsolicited Electronic Mail in Australia and the United States - [2004] MurUEJL 11

Relevantly paraphrased, a commercial electronic message is an electronic message the purpose of which is to advertise, promote or offer to supply goods or services; to advertise or promote a supplier of goods or services; to advertise, promote or offer to supply land or an interest in land; ...

ACMA goes ham on spam Is your business in breach of the Spam Act

2. having regard to the content ... that at least one of the purposes of the message is to offer to supply goods or services, advertise or promote goods or services, or advertise or promote a supplier of goods or services (amongst other ...

Question: Spam Act 2003 section 6 "commercial electronic message" purpose test "offer to supply" "advertise or promote"

A reminder about Spam: Ticketek case


Question: Spam Act 2003 transactional messages exempt "designated commercial electronic message" factual information only

Question: ACMA "introductory message" "not a commercial electronic message" cold outreach business purpose test


Question: Spam Act 2003 transactional messages exempt "designated commercial electronic message" factual information only

Therefore, the Act does not apply to designated commercial electronic messages. These types of messages do not require the recipient’s consent or a functional unsubscribe button.

Historically the ACMA has focused its enforcement activities on clear breaches of the spam rules, such as where a business has sent electronic marketing messages to individuals without their consent or failed to provide a working unsubscribe facility in its communications. However, the ACMA's most recent enforcement actions have involved messages that the businesses characterised as "factual" or "transactional" in nature and therefore thought were exempt from the consent and unsubscribe requirements of the Spam Act.

SPAM ACT 2003 - SCHEDULE 1 Designated commercial electronic messages

... (1) For the purposes of this Act, an electronic message is a designated commercial electronic message if: (a) the message consists of no more than factual information (with or without directly - related comment) and any or all of the following additional information:

Question: Spam Act 2003 transactional messages exempt "designated commercial electronic message" factual information only


Question: ACMA "introductory message" "not a commercial electronic message" cold outreach business purpose test

Question: ACMA "introductory message" "not a commercial electronic message" cold outreach business purpose test


Question: Spam Act 2003 "purpose test" cold introduction email not selling promoting still commercial electronic message ACMA


Question: Spam Act 2003 "purpose test" cold introduction email not selling promoting still commercial electronic message ACMA

Question: Spam Act 2003 "purpose test" cold introduction email not selling promoting still commercial electronic message ACMA


Market insights - HWLE Lawyers

In October 2023, Ticketek was found by the Australian Communications and Media Authority (ACMA) to have breached the Spam Act 2003 (Cth) (Spam Act) for sending ‘commercial electronic messages’ to people without their consent. Through its investigation, ACMA discovered that during 2022 Ticketek had sent approximately 41,000 marketing texts and emails without the consent of recipients and about 57,000 texts and emails to people who had previously unsubscribed. As a result, Ticketek was issued an infringement notice with a penalty of $515,040.
Ticketek argued that because the emails they sent had factual information in them, they were not ‘commercial electronic messages’ under the Spam Act. However, ACMA decided that even though the purpose of the messages was to provide factual information, since they also contained links to Ticketek’s website and social media pages which contained advertising material and promotions for upcoming events, they were ‘commercial electronic messages‘ and therefore Ticketek needed the consent of the recipients to send them. As such, this was found to be a breach of the Spam Act.

## SPAM ACT
The Spam Act is the federal legislation regulating electronic messages (including emails, SMS and instant messages) with an Australian link.

### What is a ‘commercial electronic message‘?
Under the Spam Act (section 6), ‘a commercial electronic message is an electronic message, where, having regard to:

- the content of the message; and
- the way in which the message is presented; and
- the content that can be located using the links, telephone numbers or contact information (if any) set out in the message;
 it would be concluded that the purpose, or one of the purposes, of the message is: to offer to supply goods or services; or to advertise or promote goods or services; or to advertise or promote a supplier, or prospective supplier, of goods or services…”.
A message is a ‘commercial electronic message’ if there are links within the message that take you to advertising or promotional material for goods and services. This commercial purpose does not have to be the main purpose of the message – it only has to be one of the purposes. When a message falls under this definition, the Spam Act requirements in relation to consent and unsubscribe facilities apply.

### What is a ‘designated commercial electronic message‘?
In section 16(1) of the Spam Act, there is an exception to the prohibition against sending unsolicited commercial electronic messages. This arises when the message is considered a ‘designated commercial electronic message’. These messages also do not have to contain a functional unsubscribe facility.
Under Schedule 1 of the Spam Act, a ‘designated commercial electronic message’ is defined as a message which consists of no more than factual information and accurate information that identifies the authorised sender (eg name, logo and contact details of the individual/organisation who authorised the sending of the message).

### Consent
Under the Spam Act (sections 16, 17 and 18), a person must not send a commercial electronic message:

- without the consent of the electronic account-holder (ie the recipient);
- without accurate sender information (ie the individual or organisation who authorised the sending of the message and contact details); and
- unless the message contains an unsubscribe function.
Section 2 of the Spam Act provides that consent can be express (ie that the recipient opts in to receive the communications) or inferred (ie by the conduct and the business and other relationships of those concerned). Therefore, it is imperative that commercial electronic messages are only being sent to consumers who have given their express or inferred consent.

### Unsubscribe Facility
As noted above, to comply with the Spam Act, a commercial electronic message must have an easily accessible mechanism for a person to unsubscribe. Section 18(e) of the Spam Act provides that the electronic address used for sending an unsubscribe message must be reasonably likely to be capable of receiving the message and a reasonable number of similar messages for a period of at least 30 days after the messages are sent.
ACMA recommends the below wording is used for recipients to unsubscribe:
To stop receiving messages from us, simply reply to this email with ‘unsubscribe’ in the subject line.
OR
If you no longer wish to receive these messages, please click the ‘unsubscribe’ button below.
Businesses should ensure that a functional unsubscribe facility exists in all commercial electronic messages.

## KEY TAKEWAYS
In light of the findings against Ticketek, it is important to ensure that all communications comply with the Spam Act. In particular, there should be caution exercised when sending communications that are largely factual but also contain social media links. If an electronic message has one or more commercial purposes, it will fall under the definition of a ‘commercial electronic message’ under the Spam Act.
ACMA is actively investigating complaints of potential Spam Act non-compliance and issuing fines upon discovering breaches. Over the past few years, ACMA has made similar findings of spam law breaches against several large well-known retailers. Therefore, it is essential that senders of communications comply with the Spam Act.
This article was written by Jennifer Huby, Partner and Kirsten Schreuder, Graduate-at-Law.
 Important Disclaimer: The material contained in this publication is of general nature only and is based on the law as of the date of publication. It is not, nor is intended to be legal advice. If you wish to take any action based on the content of this publication we recommend that you seek professional advice.

Market insights - HWLE Lawyers


Now I have thorough research. Let me compose the definitive analysis and send it to Builder.

node /home/ccuser/shared/scripts/inbox.js send --from harper --to builder --subject "Full Spam Act Rundown — What's Covered vs Not" --body "$(cat <<'EOFMSG'
Here's the complete breakdown for Rocky. Sourced from the Spam Act 2003, ACMA enforcement actions, and leading law firm analyses.

═══════════════════════════════════════════════════════
THE BIG PICTURE: HOW THE SPAM ACT CATEGORISES MESSAGES
═══════════════════════════════════════════════════════

There are THREE categories under the Spam Act:

1. NOT a commercial electronic message → Spam Act doesn't apply at all
2. "Designated commercial electronic message" → Exempt from consent/unsubscribe rules
3. Commercial electronic message (CEM) → Full rules apply (consent + ID + unsubscribe)

═══════════════════════════════════════════════════
QUESTION 1: Is it ONLY sales/marketing messages?
═══════════════════════════════════════════════════

NO — it's broader than that. Under section 6, a message is a CEM if ANY ONE of its purposes is to:
- Offer to supply goods or services
- Advertise or promote goods or services
- Advertise or promote a SUPPLIER of goods or services (i.e. the brand itself)
- Advertise or promote a business or investment opportunity

KEY: The commercial purpose does NOT need to be the main or dominant purpose. It just needs to be ONE of the purposes. The test looks at:
(a) The content of the message
(b) The way it's presented
(c) The content reachable via links, phone numbers, or contact info IN the message

So even a mostly-informational message becomes a CEM if it links to your website where you sell things, or includes a social media link where you promote services.

Real example: Ticketek sent "factual" event info to ticketholders. But the emails had a banner saying "Stay up-to-date with the latest Ticketek events" linking to social media. ACMA ruled: that link made the whole email a CEM. Fine: $515,040.

═══════════════════════════════════════════════════════
QUESTION 2: Can we send pure INFORMATION without consent?
═══════════════════════════════════════════════════════════

YES — but the bar is VERY high. This falls under the "designated commercial electronic message" exemption (Schedule 1).

A message is exempt from consent/unsubscribe rules if it consists of NO MORE than:
- Factual information (with or without directly related comment)

PLUS only these additions:
- Name, logo, and contact details of the sender
- Name and contact details of the author
- A working unsubscribe facility (optional for designated CEMs)

That's it. The MOMENT you add:
- A link to your website (where you sell things)
- A link to social media (where you promote)
- A call to action ("interested in learning more?")
- A mention of your product/service benefits
- Any branding beyond basic identification

...it's no longer a designated CEM. It's a full CEM requiring consent.

PRACTICAL REALITY for RateRight: Sending pure industry tips/news with ZERO mention of RateRight's services, no website link, no social media link, no call to action? Technically fine under the designated CEM exemption. But:
- It's nearly useless as a business communication if you can't mention who you are or what you do
- ACMA interprets this VERY strictly (see Ticketek)
- The risk/reward is poor — one slip and it's a breach

═══════════════════════════════════════════════════════════
QUESTION 3: What about transactional messages?
═══════════════════════════════════════════════════════════

The Spam Act does NOT have a "transactional message" exemption like US CAN-SPAM does. Australia is stricter.

However, transactional messages to EXISTING users (confirmations, updates, account notifications) are generally fine because:
- They're arguably NOT CEMs if purely factual/operational
- Even if considered CEMs, you have INFERRED CONSENT from the existing relationship

But be careful:
- Order confirmations with "You might also like..." = CEM (needs consent + unsubscribe)
- Account updates with promotional banners = CEM
- Any message to someone who has unsubscribed = breach, even if "transactional"

For RateRight specifically: Once someone signs up and uses the platform, messages about their hires, account status, platform updates = fine (inferred consent from the relationship + operational nature). Just don't stuff marketing into those messages.

═══════════════════════════════════════════════════════════════
QUESTION 4: Introductory messages that don't explicitly sell?
═══════════════════════════════════════════════════════════════

"Hey, I'm Michael, I run a construction hiring platform, interested in a chat?"

This IS a commercial electronic message. Here's why:

The purpose test asks: would a reasonable person conclude that ONE of the purposes is to advertise or promote a supplier of goods or services? Yes — you're identifying yourself as the operator of a hiring platform and seeking a business conversation about it. That promotes RateRight as a supplier.

The ACMA has been very clear: you cannot use electronic messages to fish for consent. "You cannot send an electronic message to ask for consent to send further electronic messages."

So the introductory message IS a CEM, and you need consent BEFORE sending it. Classic chicken-and-egg problem.

═══════════════════════════════════════════════════════
QUESTION 5: Where exactly is the CEM line?
═══════════════════════════════════════════════════════

HERE'S THE FULL SPECTRUM:

✅ NOT a CEM (Spam Act doesn't apply):
- Pure person-to-person messages with no commercial purpose
- Phone calls (voice calls are completely outside the Spam Act)
- Messages between employees within the same organisation
- Messages required by law (e.g., statutory notices)

✅ DESIGNATED CEM (Exempt — no consent needed):
- Messages that are ONLY factual information
- No promotional content whatsoever
- No links to promotional websites/social media
- Only permitted additions: sender name/logo/contact details, author name/contact, unsubscribe link
- Government, charity, political party, educational institution messages (for their own goods/services)

🔴 FULL CEM (Consent + ID + Unsubscribe required):
- ANYTHING that promotes goods, services, a supplier, or a business opportunity
- Including messages where promotion is just ONE purpose among many
- Including messages with links to promotional content
- Including "introduction" messages seeking business conversations
- Including messages with social media links where you promote your business

═══════════════════════════════════════════════════════
ROCKY'S REALISTIC OPTIONS (ranked safest to riskiest)
═══════════════════════════════════════════════════════

1. PHONE CALLS — Completely outside the Spam Act. B2B calls also EXEMPT from the Do Not Call Register Act. This is the safest outreach channel by far.

2. IN-PERSON / EVENTS — Not electronic, not covered.

3. COLD EMAIL to published business addresses — Technically a breach but lowest enforcement risk. ACMA focuses on mass campaigns, not individual business outreach. Published addresses on websites carry a weak "inferred consent" argument.

4. PURE FACTUAL CONTENT via email/SMS — Designated CEM exemption. Must be STRICTLY factual, no promotional anything. Nearly impossible to make useful.

5. COLD SMS — Highest enforcement risk. ACMA actively monitors SMS spam. Plus SMS Sender ID Register mandatory from 1 July 2026.

RECOMMENDED STRATEGY: Phone first → get verbal interest → THAT'S your inferred consent → then follow up via email/SMS. Legally clean, commercially effective.

Let me know if Rocky needs anything else clarified.

— Harper
EOFMSG
)" 2>&1


✉  Sent msg-1771450902936-6eb8a6 → builder: Full Spam Act Rundown — What's Covered vs Not


node /home/ccuser/shared/scripts/inbox.js send --from harper --to susan --subject "Full Spam Act Rundown — FYI" --body "Sent Builder a comprehensive Spam Act breakdown in response to Rocky's questions. Key takeaways for your outreach strategy:

1. Cold SMS/email without consent = technically non-compliant (no B2B exemption in Australia)
2. Phone calls = safest channel (exempt from Spam Act AND Do Not Call Register for B2B)
3. Pure factual info messages = exempt but bar is extremely high (no links, no promotion, no CTA)
4. Introductory 'interested in a chat?' messages = still a CEM, needs prior consent
5. Transactional messages to existing users = fine under inferred consent

Recommended strategy: Phone first → verbal interest = inferred consent → then email/SMS follow-up.

Full analysis sent to Builder (msg-1771450902936). Ask if you want the details." 2>&1


✉  Sent msg-1771450910082-40a76f → susan: Full Spam Act Rundown — FYI


Now ACK the original message and update status.

node /home/ccuser/shared/scripts/inbox.js ack --agent harper --id msg-1771450041486-0b0be5 2>&1


✅ Acked msg-1771450041486-0b0be5 for harper


Now update daily memory and fleet status.

cat >> /home/ccuser/harper/memory/2026-02-19.md <<'EOF'

---

## Full Spam Act Rundown for Builder/Rocky — 21:40 AEDT

### Request
Builder (msg-1771450041486) relayed Rocky's request for a complete breakdown of what the Spam Act covers vs doesn't cover. Five specific questions about CEM definitions, factual info exemptions, transactional messages, intro messages, and the exact CEM line.

### Key Analysis Points
- Three-tier system: Not CEM → Designated CEM (exempt) → Full CEM (consent required)
- Purpose test is BROAD — promotion need only be ONE purpose, not the main one
- No B2B exemption in Australia (unlike some other jurisdictions)
- "Designated CEM" factual info exemption is real but ACMA interprets very strictly (Ticketek case: $515K fine)
- Introductory "interested in a chat?" messages ARE CEMs — you can't send electronic messages to fish for consent
- Transactional messages to existing users generally fine under inferred consent, but don't add promo content
- Phone calls completely outside Spam Act — safest outreach by far

### Actions
- Sent comprehensive 5-question analysis to Builder (msg-1771450902936)
- Sent summary to Susan (msg-1771450910082) for outreach strategy alignment
- ACK'd Builder's original request
EOF
echo "Done"

write

Completed full Spam Act rundown for Builder/Rocky — 5 questions answered with legal sources

exec

node /home/ccuser/shared/scripts/fleet-update.js harper --status active --task "Completed full Spam Act rundown for Builder/Rocky — 5 questions answered" 2>&1


Done


Successfully wrote 272 bytes to /home/ccuser/harper/status.json


✅ Fleet state updated (cycle 1187)


Handled Builder's inbox request — comprehensive Spam Act analysis covering all 5 of Rocky's questions, sent to Builder and copied Susan. Key finding: phone calls are the cleanest outreach channel; cold SMS/email carry real compliance risk under Australia's strict rules. No other items requiring attention.

HEARTBEAT_OK


Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.


📭 harper: No unread messages


BAS Preparation — Due Feb 28

BAS Q2 finalized and ready for lodgement. Figures confirmed: $146.40 expenses, $13.30 GST refund. Self-lodgement confirmed. File: memory/bas-q2-fy2026.md. Awaiting Michael to log into ATO Business Portal and submit.

R&D Tax Incentive research

Research complete. Summary: Strong eligibility for AI/ML activities, 43.5% refundable offset. Critical issue: $20K minimum spend threshold. FY2024-25 registration deadline: 30 April 2026. Full report: memory/rd-tax-incentive-research.md

Monthly cost tracking — February

Complete. February burn: ~$134 AUD (up 16.7% from Jan). Over target by $6. API costs increasing with agent activity. Full report: memory/cost-tracking-2026-02.md

NSW small business grants scan

Scan complete. No new grants found beyond MVP Ventures NSW Round 3 ($20-75K, opens 9 March 2026). RateRight eligible under digital technologies priority sector.


Inbox clear, no new tasks, all queue items complete. Nothing requiring attention.

node /home/ccuser/shared/scripts/fleet-update.js harper --status active --task "heartbeat — inbox clear, queue complete, standing by" 2>&1


Successfully wrote 253 bytes to /home/ccuser/harper/status.json


✅ Fleet state updated (cycle 1195)


Inbox clear, no new tasks, no changes.

write

heartbeat — inbox clear, queue complete, standing by

exec

node /home/ccuser/shared/scripts/fleet-update.js harper --status active --task "heartbeat — inbox clear, standing by" 2>&1


Successfully wrote 233 bytes to /home/ccuser/harper/status.json


✅ Fleet state updated (cycle 1203)


Inbox clear, no changes.


✅ Fleet state updated (cycle 1213)


✅ Fleet state updated (cycle 1221)


✅ Fleet state updated (cycle 1231)


✅ Fleet state updated (cycle 1239)


✅ Fleet state updated (cycle 1248)


✅ Fleet state updated (cycle 1257)


✅ Fleet state updated (cycle 1273)


✅ Fleet state updated (cycle 1280)


📭 harper: No unread messages


✅ Fleet state updated (cycle 1291)


✅ Fleet state updated (cycle 1300)


✅ Fleet state updated (cycle 1310)


✅ Fleet state updated (cycle 1319)


✅ Fleet state updated (cycle 1329)


✅ Fleet state updated (cycle 1338)


✅ Fleet state updated (cycle 1348)


✅ Fleet state updated (cycle 1358)