Home / Resources / Australian privacy and spam rules for marketing automation

Australian Privacy Act and Spam Act: a guide to AI marketing automation

AI makes it easy to follow up every lead within minutes. Australian rules decide who you may message and how. Here is the practical version.

The Privacy Act and the APPs

The Privacy Act 1988 and its 13 Australian Privacy Principles cover how personal information is collected, used, disclosed and secured, including direct marketing. Many small businesses with annual turnover of $3 million or less are exempt, but there are important exceptions, for example health service providers and businesses that trade in personal information. The Privacy and Other Legislation Amendment Act 2024 introduced further changes, including new transparency requirements for some automated decisions, with more reform proposed. The OAIC regulates privacy.

The Spam Act: consent, identify, unsubscribe

• Consent. Commercial emails and SMS need express or, in limited cases, inferred consent.
• Identify. Each message must clearly identify who sent it and how to contact them.
• Unsubscribe. Each message needs a functional unsubscribe, honoured within five working days.

The ACMA enforces the Spam Act and the Do Not Call Register rules for telemarketing calls and faxes.

AI tools and vendors

• Know which tools hold personal information and where it is stored.
• Check overseas disclosure obligations under APP 8 if data leaves Australia.
• Confirm whether a vendor uses your data to train models.
• Tell people in your privacy policy how you use automated tools.

A compliant set-up

1. Capture consent at the point of collection, with a timestamp and the wording shown.
2. Sync consent and unsubscribe status to every tool that sends messages.
3. Process unsubscribes automatically and quickly.
4. Keep records of consent and of what was sent.

This article is general information, not legal advice. Rules change; check current guidance from the relevant regulator.

How we approach it

Reckona AI scopes Australian automation around the Privacy Act and Spam Act from day one and states which personal information each workflow touches. See Reckona AI in Australia.

Frequently asked questions

Do I need consent to send marketing emails or SMS in Australia?

Yes, under the Spam Act commercial electronic messages generally need consent, must identify the sender and must include a functional unsubscribe.

How quickly must I process an unsubscribe in Australia?

Within five working days under the Spam Act.

Does the Privacy Act apply to small businesses?

Many businesses with annual turnover of $3 million or less are exempt, but there are exceptions, including health service providers and businesses that trade in personal information. Check whether an exception applies.

Is Australian privacy law changing?

Yes. Reforms passed in 2024 introduced new obligations and further changes have been proposed. Check the OAIC’s current guidance.