Am I Allowed to Market to This Person?
Select the ways your business markets to customers and prospects. Get an instant APP 7 check across 16 common Australian practices.
Under APP 7 of the Privacy Act 1988 (Cth), using or disclosing personal information for direct marketing is prohibited by default. It's only permitted where the information was collected directly and the individual would reasonably expect it, or they've consented (or consent was impracticable to obtain) — and in both cases, only if a simple opt-out is offered and honoured. Sensitive information can never be used for direct marketing, even with consent. Select the practices below to see where your gaps sit.
Last updated: 2 July 2026
How each practice is scored
| Result | Meaning |
|---|---|
| Compliant | Not direct marketing at all, or you have a lawful basis and a simple opt-out that you offer and honour |
| Gap | Banned outright regardless of any opt-out, or you don't currently offer and honour one where it's required |
Why direct marketing gets businesses in trouble
Most businesses assume an opt-out link fixes everything. It doesn't. APP 7 has an absolute bar on using sensitive information — health data, inferred political opinions, religious beliefs — for direct marketing, no matter what consent was given. No opt-out mechanism makes that use permitted.
APP 7 also isn't the only law in play. The Do Not Call Register Act 2006 (Cth) governs telemarketing calls, and the Spam Act 2003 (Cth) governs commercial emails and SMS. A campaign can satisfy APP 7's consent and opt-out conditions and still breach one of those Acts if it targets a registered number or a contact with no consent basis at all.
Direct marketing check
Select every marketing practice your business currently uses. For each one that isn't automatically exempt or banned outright, tell us whether you offer and honour a simple opt-out. You'll get an instant APP 7 report at a permanent URL you can revisit or share.
When you need a direct marketing check
- — Your email, SMS or telemarketing campaigns have never been reviewed against APP 7
- — You're newly covered by the Privacy Act following the 1 July 2026 threshold removal
- — You buy contact lists, run co-branded promotions, or use loyalty program data for targeting
- — Your marketing touches health, political, religious or other sensitive information
- — You're preparing for an OAIC inquiry or a compliance audit
Frequently asked questions
What does APP 7 of the Privacy Act require?
APP 7 prohibits using or disclosing personal information for direct marketing unless it was collected directly with a reasonable expectation of marketing, or the individual consented (or consent was impracticable), and in both cases a simple opt-out is offered and honoured.
Can a business ever use sensitive information for direct marketing?
No. APP 7.4 bans it outright — health information, inferred political opinions, religious beliefs and other sensitive information can never be used for direct marketing, even with consent.
Does APP 7 cover telemarketing calls and spam emails too?
APP 7 applies alongside the Do Not Call Register Act 2006 (Cth) and the Spam Act 2003 (Cth) — a campaign needs to satisfy both APP 7 and whichever of those Acts applies to the channel.
What does the free direct marketing check check?
It checks the practices you select against a catalogue of 16 common Australian scenarios, flagging which need a lawful basis and opt-out you don't currently have, which are banned outright, and which are exempt.
Select your practices above to get an instant APP 7 direct marketing report.
Get my direct marketing report →