APP 7: Direct Marketing

Last updated 22 July 2026 · Reviewed by The PrivacyReady compliance team

The short answer

Australian Privacy Principle 7 governs using personal information for direct marketing. If you collected the information directly from the individual and they would reasonably expect it to be used for marketing, you may generally use it for that purpose provided every communication includes a simple way to opt out. Sensitive information can never be used for direct marketing without the individual's explicit consent. APP 7 sits alongside — not instead of — the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth), which impose their own consent requirements for electronic and telephone marketing.

Governing provision	Privacy Act 1988 (Cth), Schedule 1, APP 7
Core requirement	Working opt-out on every marketing communication
Sensitive information	Never for direct marketing without explicit consent
Overlapping laws	Spam Act 2003 (Cth), Do Not Call Register Act 2006 (Cth)
Third-party data	Stricter conditions apply than for data you collected directly

What APP 7 actually requires

APP 7.2 permits using or disclosing personal information for direct marketing where you collected it directly from the individual, they would reasonably expect it to be used that way (or have consented), and every marketing communication includes a simple, functioning way to opt out — which you must give effect to promptly once requested.

Where you obtained the information from a third party rather than the individual directly — for example, a purchased marketing list — APP 7.3 imposes stricter conditions, generally requiring consent or a reasonable expectation established through a clear, prior notice. Sensitive information can never be used for direct marketing purposes without explicit consent, under any circumstances.

How this interacts with the Spam Act and Do Not Call Register

APP 7 is a privacy-specific overlay, not a replacement for Australia's other marketing laws. The Spam Act 2003 requires consent before sending commercial electronic messages (email, SMS) and a functional unsubscribe mechanism. The Do Not Call Register Act 2006 restricts telemarketing calls to numbers on the register. A marketing campaign needs to satisfy all three regimes, not just APP 7.

Common SME failure modes

No opt-out, or a broken one — an unsubscribe link that doesn't work, or an opt-out request that isn't actioned.
Marketing to purchased lists without the individual having consented or reasonably expecting to hear from you.
Sensitive-information marketing — for example, a health or allied-health provider marketing services based on a condition inferred from treatment history, without explicit consent.
Treating an existing customer relationship as blanket consent for any future marketing, regardless of relevance or time elapsed.

Practical compliance steps

Confirm every marketing channel includes a working, low-friction opt-out.
Action opt-out requests immediately, not at the next scheduled list update.
Do not use sensitive information (health, sexual orientation, religious belief, etc.) to target or personalise marketing without explicit consent.
If you use purchased or third-party lists, verify the consent basis before sending anything.
Cross-check campaigns against Spam Act and Do Not Call Register requirements, not just APP 7.

Frequently asked questions

Can I email existing customers marketing without asking again?

Generally yes, where they would reasonably expect it given the existing relationship and every message includes a working opt-out — but this is narrower than blanket, indefinite permission, and separately still needs to satisfy the Spam Act's consent requirements for commercial electronic messages.

Does a pre-ticked marketing consent checkbox satisfy APP 7?

A pre-ticked box is weak evidence of genuine consent and is best avoided, particularly for sensitive information where explicit consent is required. An unticked, clearly labelled opt-in is a safer approach.

What if a customer asks to stop receiving marketing but I keep sending order confirmations?

That distinction is fine — an opt-out under APP 7 relates to direct marketing communications, not transactional or service messages necessary to fulfil an order, which fall under a different primary purpose.

Use the free Direct Marketing Check to see whether your marketing practices meet APP 7 across 16 common Australian scenarios.

Check my marketing practices →