How to stay on the right side of Australian spam laws with B2B email marketing

Email marketing continues to be a powerful tool for businesses, tied for second place as the channel that provides the highest return on investment (ROI). It’s used by one in three marketers, and 87 per cent planned to maintain or increase their investment in 2024.1 This could be because analysts expect the number of email users to grow by 2.5 per cent in both 2024 and 2025, hitting a projected 4.73 billion users.2

However, business to business (B2B) email marketing demands careful attention to Australia’s spam laws for compliance and to maintain business reputation. Crucially, the Spam Act 2003 and related regulations set clear guidelines for commercial electronic messages, with significant penalties for non-compliance.3

## Understanding commercial electronic messages

The definition of commercial electronic messages extends beyond traditional marketing emails to include any message where one purpose is to offer, advertise, or promote goods, services, or business opportunities. This encompasses:

- marketing newsletters and updates

- product announcements

- service promotions

- business opportunity communications

- mixed-purpose messages with both commercial and non-commercial content.

Messages that seem informational may be classified as commercial if they contain links to commercial content or promote business relationships.

## The fundamentals of Australian spam laws

Australian spam legislation applies to all commercial electronic messages with an ‘Australian link,’ including B2B communications. This ‘Australian link’ exists when the message originates in Australia, the sender is in Australia when sending, or the recipient accesses the message in Australia. Unlike other jurisdictions, Australia’s laws don’t distinguish between B2B and business-to-consumer (B2C) marketing messages; both must comply with the same regulations.

The legislation focuses on three key pillars of compliance:

- Consent from recipients.

- Clear sender identification.

- Functional unsubscribe mechanism.

Each element carries equal legal weight, and failing to meet any requirement can result in substantial penalties. The Australian Communications and Media Authority (ACMA) actively monitors compliance with the Spam Act and can impose penalties of up to 500 penalty units per violation for repeat corporate offenders.4 A penalty unit (PU) is a standard amount of money used to compute penalties for many breaches of law in Australia at both the federal, and state and territory level.5

#### Obtaining valid consent

Consent forms the cornerstone of Australia’s spam legislation. The law recognises both express and inferred consent; however, the burden of proof lies with the sender. This means businesses must maintain comprehensive records of how, when, and what type of consent was obtained.

#### Express consent

Express consent represents the highest compliance standard and provides the strongest legal protection. It must be freely given, clearly communicated, and specifically informed. When obtaining express consent, businesses must explain what the recipient is consenting to, including the types of messages, the sender, and the consent’s duration.

Valid express consent can be obtained through online forms, written agreements, or verbal conversations, but documentation is key. Each consent instance should record the date, method, scope, and relevant terms. Digital systems should maintain audit trails of submissions and consent changes.

#### Inferred consent

Inferred consent requires a nuanced approach. It exists only with a provable, ongoing relationship between the sender and recipient, and the marketing content directly relates to that relationship. The ACMA emphasises that this relationship must be current and active.

For example, a B2B software provider may infer consent to email existing clients about software updates or related products; however, cannot extend this to unrelated services.

#### Email scraping tools vs consent

Email scraping tools automatically collect email addresses from online sources like websites, social media, and public directories. They crawl web pages, using pattern matching to identify text that matches email formats (like name@domain.com), process multiple pages simultaneously, and apply regular expressions or specialised parsing rules to distinguish valid email addresses from other text.

Many scraping tools also verifies the validity of collected emails, organises them into categories, and exports results in formats like comma-separated values (CSV) or Excel. While this may sound like a marketer’s dream, simply collecting email addresses through scraping doesn’t provide the required consent. Inferred consent only applies in specific business relationships with a reasonable expectation of receiving commercial messages, and scraped email addresses never provide express consent.

Email scraping itself isn’t illegal; however, using scraped emails for commercial communications without consent violates Australian law. Businesses should prioritise building email lists through legitimate opt-in methods like newsletter signups, customer purchases, or explicit permission forms.

### Sender identification requirements

The law mandates clear and accurate sender identification in every commercial message, which goes beyond including a company name. Messages must contain:

- the accurate name of the business entity authorising the message

- valid contact information that will remain accurate for at least 30 days

- clear identification of third parties sending messages on behalf of the business.

Using appropriate business entities and Australian Business Numbers (ABNs) is crucial for B2B communications. In partner marketing arrangements, all relevant parties must be properly identified.

### Unsubscribe mechanism compliance

Australian law has stringent unsubscribe requirements. Every commercial message must include a functional unsubscribe facility operation


This confirms everything I need. The key point for Builder's question: **email and SMS are treated identically under the Spam Act — no difference in rules**. And the "meeting request" angle doesn't help — if the purpose is to promote RateRight's service, it's a CEM regardless of how it's framed.

However, there's a practical nuance: **cold email is marginally safer than cold SMS** because email is more established for B2B outreach and ACMA enforcement tends to focus on high-volume SMS spam. Let me respond.

exec

node /home/ccuser/shared/scripts/inbox.js ack --agent harper --id msg-1771445403153-0b6bbc 2>/dev/null

node /home/ccuser/shared/scripts/inbox.js send --from harper --to builder --subject "RE: Cold Email Legal Requirements — Same Rules, Practical Differences" --body "Short answer: Same Spam Act rules apply to email as SMS. No legal difference. But there are practical differences.

LEGAL POSITION — IDENTICAL:
The Spam Act 2003 covers ALL commercial electronic messages: email, SMS, MMS, instant messages. The three requirements (consent, identification, unsubscribe) apply equally. Australia does NOT distinguish between B2B and B2C — both fully caught. No B2B email exemption.

ROCKY'S SPECIFIC SCENARIOS:
(a) 'Emailing businesses to arrange a meeting with the person who hires' — If the PURPOSE is to promote RateRight's service, it's a CEM even if framed as a meeting request. The Spam Act looks at whether any purpose is to offer/advertise/promote goods or services. Requesting a meeting to pitch RateRight = commercial purpose = CEM.
(b) 'Emailing them about RateRight's service' — Clearly a CEM. All three requirements apply.

IS COLD EMAIL SAFER THAN COLD SMS? Legally: no. Practically: marginally.
- Same legal risk under the Spam Act
- But ACMA enforcement historically targets high-volume SMS spam more aggressively
- Email is more culturally accepted for B2B outreach in Australia
- Email has a lower complaint rate for personalised 1-to-1 outreach vs mass blasts
- The 'conspicuous publication' defence is slightly stronger for email — if a business publishes their email on their website, there's an argument (not bulletproof) for inferred consent that they expect business enquiries

THE SAFEST OUTREACH ORDER:
1. Phone calls (NOT covered by Spam Act at all — covered by Do Not Call Register Act instead, and B2B calls are EXEMPT from the DNCR)
2. Cold email to published business email addresses (lowest practical risk — arguable inferred consent from conspicuous publication)
3. Cold SMS (highest risk — ACMA most active here)

RECOMMENDATION: Phone-first strategy for initial contact, then get express consent for email/SMS follow-ups. If email outreach proceeds, use published business emails, personalise each message, include proper identification and unsubscribe, and keep volumes low.

Sent copy to Susan." 2>/dev/null

node /home/ccuser/shared/scripts/inbox.js send --from harper --to susan --subject "FYI: Cold Email vs Cold SMS — Legal Comparison" --body "Builder asked about cold email legality. Summary: Same Spam Act rules apply to email and SMS — no legal difference, no B2B exemption for either. But practically, cold email to published business addresses carries lower enforcement risk than cold SMS. Phone calls are the safest channel — B2B calls are exempt from the Do Not Call Register. Recommended outreach order: (1) Phone, (2) Email to published addresses, (3) SMS. Full analysis sent to Builder." 2>/dev/null


✅ Acked msg-1771445403153-0b6bbc for harper


✉  Sent msg-1771446667089-c2df16 → builder: RE: Cold Email Legal Requirements — Same Rules, Practical Differences


✉  Sent msg-1771446667138-2d0b52 → susan: FYI: Cold Email vs Cold SMS — Legal Comparison


Now update daily log and status:

edit

---

## Cold Email Legal Requirements (Builder follow-up msg-1771445403153)

### Request
Builder asked: is cold emailing construction companies legal? Is cold email safer than cold SMS?

### Findings
- Same Spam Act rules apply to email and SMS — no legal distinction
- No B2B exemption for either channel
- Meeting request emails that promote RateRight = CEM (purpose test)
- Practically, cold email to published business addresses carries lower enforcement risk
- Phone calls are safest: B2B calls EXEMPT from Do Not Call Register Act
- Recommended outreach order: Phone → Email (published addresses) → SMS (highest risk)
- Sent analysis to Builder and Susan

---

## NSW Digital Work Systems Bill


Successfully replaced text in /home/ccuser/harper/memory/2026-02-19.md.

    ...
 22 - Need to flag consent strategy decision to Michael
 23
 24 ---
 25
+26 ## Cold Email Legal Requirements (Builder follow-up msg-1771445403153)
+27
+28 ### Request
+29 Builder asked: is cold emailing construction companies legal? Is cold email safer than cold SMS?
+30
+31 ### Findings
+32 - Same Spam Act rules apply to email and SMS — no legal distinction
+33 - No B2B exemption for either channel
+34 - Meeting request emails that promote RateRight = CEM (purpose test)
+35 - Practically, cold email to published business addresses carries lower enforcement risk
+36 - Phone calls are safest: B2B calls EXEMPT from Do Not Call Register Act
+37 - Recommended outreach order: Phone → Email (published addresses) → SMS (highest risk)
+38 - Sent analysis to Builder and Susan
+39
+40 ---
+41
 26 ## NSW Digital Work Systems Bill — Compliance Review (Radar msg-1771435306778)
 27
 28 ### Assessment
 29 Bill passed 12 Feb 2026 but NOT YET IN EFFECT. Defines "digital work system" as algorithm, AI, automation, or online platform. Creates new s21A duty for PCBUs re: worker H&S from digital work systems.
    ...


exec

node /home/ccuser/shared/scripts/fleet-update.js harper --status active --task "Cold email compliance research — sent to Builder and Susan. Phone-first strategy recommended." 2>/dev/null

write

Cold email compliance research — sent to Builder and Susan. Phone-first recommended.


✅ Fleet state updated (cycle 1166)


Successfully wrote 265 bytes to /home/ccuser/harper/status.json


Processed Builder's follow-up on cold email legality.

**Key finding:** Same Spam Act rules apply to email and SMS — no B2B exemption for either. But practically:
- **Phone calls are safest** — B2B calls are exempt from the Do Not Call Register
- **Cold email to published business addresses** carries lower enforcement risk than cold SMS
- **Cold SMS** is highest risk (ACMA most active here)

**Recommendation sent:** Phone-first for initial contact → get express consent → then email/SMS follow-ups. Analysis sent to Builder and Susan.