Is cold emailing legal in Australia?

The short answer

Cold emailing another business is legal in Australia when you follow the Spam Act 2003. Three rules apply to every marketing email: you need consent, you must say who you are, and you must give a working way to unsubscribe. The Act has no general exemption for business-to-business email. What it does have is a narrow form of consent that covers many first emails to businesses: an address the business has published so people can contact it, used for something relevant to its work.

The regulator is the Australian Communications and Media Authority (ACMA). Everything below is drawn from the Act and from ACMA's and the OAIC's published guidance, linked at the end. It is general information, not legal advice. If your situation is unusual, or you plan to send at volume, talk to a lawyer.

Is your email a commercial message?

The Spam Act applies to commercial electronic messages: email, SMS and similar messages that offer, advertise or promote goods or services. A first email from a commercial cleaner to a strata manager offering to quote on common-area cleaning is commercial. So is a follow-up that mentions your services.

It does not take much. In March 2026 ACMA said that if a message contains any promotional or sales content, it is commercial, whatever its other purpose. That came in a case about delivery and order emails that also carried sales links. If an email is partly a sales message, treat the whole email as one.

Consent: the rule most people get wrong

You may only send a commercial email with the recipient's consent. Schedule 2 of the Act says consent can be express, or reasonably inferred from conduct and from business and other relationships.

Express consent

The person has told you they want to hear from you: they filled in a form, ticked a box, or said yes in person or on the phone. ACMA calls this best practice. Two catches. You cannot send an email to ask for consent, because that email is itself a marketing message. And it is up to you to prove consent, so keep a record of who agreed, when and how.

Inferred consent from a relationship

ACMA describes this as usually needing a provable, ongoing relationship, such as an account or a membership, with marketing directly related to it. It is less reliable than express consent and rarely covers a first email to a business you have never dealt with.

Inferred consent from a published address

This is the one that matters for business-to-business email. Clause 4 of Schedule 2 starts with a warning: consent cannot be inferred from the mere fact that an address has been published. ACMA repeats the point in its compliance alerts. The clause then sets out an exception for conspicuous publication. Consent is taken to exist when all of these are true:

• The address lets the public contact a particular person or role: an employee, a director, a partner, a self-employed person, an office holder, or whoever performs a particular function or role in an organisation (an enquiries or accounts inbox, for example).
• The address has been conspicuously published.
• It is reasonable to assume it was published with that person's or organisation's agreement.
• The publication does not say they don't want unsolicited commercial messages at that address, or words to that effect.

Even then, the consent covers only messages relevant to that person's work-related business, functions or duties, or to that role.

What relevance looks like

Save your proof. A dated screenshot or saved copy of the page where you found each address is the simplest record that it was published, by whom, and with no 'no marketing' note beside it.

Bought lists and harvesting

ACMA says that if you buy or use a marketing list, you are still responsible for having consent for every address on it. The Act also bans supplying, acquiring or using address-harvesting software (software designed or marketed for searching the internet for addresses and collecting them) and any list made with it. A bought list of 'decision makers' usually fails on both counts: you can't show where each address was published, and you can't rule out that software built it. Find addresses yourself, one business at a time, on each business's own site.

What every email must include

Who you are

Section 17 requires every commercial message to clearly and accurately identify who authorised it and how to contact them, and that information must stay valid for at least 30 days after you send. ACMA's guidance adds: use your business's correct legal name, or your name and ABN, and if someone else sends on your behalf, the message must still name your business as the one that authorised it.

A plain signature does the job. For a made-up cleaning business:

Sam, Bayside Commercial Cleaning (ABN 00 000 000 000)

0400 000 000, sam@baysidecleaning.example, Wynnum QLD

If you'd rather not hear from us, reply with 'unsubscribe' and we'll take you off our list.

A way to stop

Section 18 requires a clear statement that the recipient can unsubscribe by sending a message to an address in your email, and that address must keep working for at least 30 days. ACMA's checklist for the unsubscribe option: clear instructions, honoured within 5 working days, no fee, no cost beyond normal use of the address, working for at least 30 days, and no login, account or extra personal information needed to use it.

Asking people to reply with 'unsubscribe' is one of ACMA's own examples, so you don't need special software. You need a habit: whoever reads the inbox acts on every 'stop', 'remove me' or 'please don't email' the same day, however it is worded. Under clause 6 of Schedule 2, a withdrawal of consent takes effect at the end of 5 business days, and it ends consent you inferred from a published address too.

Keep the address of everyone who asked to stop on a do-not-contact list, and check every new batch against it. Deleting their details is how people end up emailed twice.

The Do Not Call Register and the Privacy Act

The Do Not Call Register does not cover email

The Do Not Call Register is for phone and fax numbers. It stops unsolicited telemarketing calls and marketing faxes to registered numbers. Email sits under the Spam Act instead, so there is no register to check an email address against.

If you follow up an email with a phone call, telemarketing rules apply to the call. ACMA's guidance sets calling hours of 9am to 8pm on weekdays and 9am to 5pm on Saturdays, with no telemarketing calls on Sundays or national public holidays. Callers must give their name and their employer's name, say why they are calling, and end the call when asked.

Where the Privacy Act fits

The Privacy Act 1988 covers businesses with annual turnover over $3 million, plus some smaller ones regardless of turnover, including businesses that trade in personal information. Most small businesses are not covered. The OAIC's guidance says Australian Privacy Principle 7, the direct marketing principle, does not apply to marketing covered by the Spam Act or the Do Not Call Register Act, so for email the Spam Act is the rule that matters. If the Privacy Act does cover your business, its other principles still apply to how you collect, store and use the names and contact details you keep. Buying or selling contact lists can count as trading in personal information, which is one more reason to stay away from them.

What ACMA does when the rules are broken

ACMA can take a business to the Federal Court, issue an infringement notice, give a formal warning or accept a court-enforceable undertaking. It often starts smaller: after a complaint, ACMA may send a compliance alert asking the business to check its consent, sender details and unsubscribe process, and it may investigate serious or ongoing problems.

Recent outcomes from ACMA's published investigations:

• Lululemon paid $702,900 after sending more than 370,000 emails with commercial content and no way to unsubscribe (announced March 2026).
• Telstra paid $626,000 over more than 10.4 million texts with unsubscribe arrangements that broke the rules, most of which asked people for personal information to opt out (announced March 2025).
• Betfair received an $871,660 infringement notice for marketing emails and SMS sent without consent and without a working unsubscribe (report dated May 2025).
• Tabcorp received a $1,254,000 infringement notice for marketing emails and SMS sent without consent (report dated December 2025).

These are large companies sending at scale, but the rules are the same for a two-person business. The Act sets a maximum penalty for each contravention, with a separate cap for many contraventions on the same day, so a careless batch of emails is treated as many breaches, not one.

A plain checklist before you press send

1. The address was published by the business itself, for example on its own website, so people can contact it.
2. Nothing near it says no unsolicited or marketing email.
3. Your email is about their work: what they do, buy or could refer.
4. You kept a dated copy of where you found the address.
5. Your business name (legal name, or your name and ABN) and contact details are in the email.
6. The email says plainly how to unsubscribe, and the reply address works.
7. The address is not on your do-not-contact list.
8. Every request to stop is actioned well within 5 business days and stays actioned.
9. No bought, scraped or harvested lists.

Getting the law right is the easy part. Choosing who to write to and what to say is harder; how to find business clients and how to get referrals from other businesses cover both. Curlew works the same way: it writes only to businesses at the address each has published on its own website, with the client's business name and a way to stop in every email.

This is general information, not legal advice.