Can I Email or Text Customers Marketing Without Consent?
How the Spam Act and APP 7 interact, where the existing-customer exception ends, and the free tools to check your marketing practices.
Generally no. The Spam Act 2003 (Cth) requires consent — express or reasonably inferred — before sending commercial electronic messages, and APP 7 of the Privacy Act 1988 (Cth) separately restricts using personal information for direct marketing. A narrow exception exists for an existing customer relationship, but every message must still include a functioning unsubscribe option.
Last updated: 2 July 2026
Two laws, two tests
| Law | What it governs |
|---|---|
| Spam Act 2003 (Cth) | Consent to send a commercial electronic message (email, SMS, MMS) |
| APP 7, Privacy Act 1988 (Cth) | Whether personal information can be used for direct marketing at all, and the right to opt out |
Where businesses get caught out
Businesses often treat "they bought something from us" as a blanket licence to market indefinitely. It isn't — the existing customer exception under the Spam Act is narrow, and APP 7 separately requires that the individual would reasonably expect the follow-up marketing and can opt out at any time, free of charge.
A second common gap: purchased or scraped contact lists. Sending marketing to a list acquired from a third party rarely satisfies either the Spam Act's consent requirement or APP 7's "reasonable expectation" test, since the individual never had a direct relationship with your business.
Relevant free tools
Check your marketing activities against the APP 7 direct marketing rules.
Check what to do with personal information you received but didn't ask for.
Check your collection notices cover everything APP 5 requires.
Related Privacy Act questions
When to check your marketing practices
- — You send marketing emails or SMS to anyone who hasn't actively opted in
- — You market to past customers on the assumption that one purchase is ongoing consent
- — You've purchased or scraped a contact list from a third party
- — Your unsubscribe link doesn't work or takes more than one step
- — You're not sure which of your campaigns count as direct marketing under APP 7
Frequently asked questions
Can I email or text customers marketing without consent?
Generally no. The Spam Act 2003 (Cth) requires consent — express or reasonably inferred — before sending commercial electronic messages, and APP 7 of the Privacy Act 1988 (Cth) separately restricts using personal information for direct marketing. A narrow exception exists for an existing customer relationship, but every message must still include a functioning unsubscribe option.
What's the difference between the Spam Act and APP 7?
The Spam Act 2003 (Cth) governs consent for sending commercial electronic messages (email, SMS). APP 7 of the Privacy Act 1988 (Cth) separately governs whether a business is permitted to use someone's personal information for direct marketing purposes at all, and requires a simple way to opt out, regardless of channel.
Do I need an unsubscribe link on marketing emails?
Yes. Every commercial electronic message must include a functional unsubscribe facility under the Spam Act 2003 (Cth), and APP 7 requires that an individual can opt out of direct marketing at any time, free of charge.
Can I market to a customer who bought something once?
In limited circumstances. An existing customer relationship can support an inferred consent argument under the Spam Act, but APP 7 still requires that the individual would reasonably expect their information to be used for marketing, and they must be able to opt out easily at any time.
Run the free direct marketing checker to see which of your campaigns need a consent or opt-out fix.
Check my marketing practices →