Can I add my customers to my email list?

The Spam Act recognises two kinds of consent.

Express consent means the person knowingly agreed to receive marketing from you, for example by ticking a box on your website, filling in a form, or agreeing over the phone or in person. This is the safest option. You can't email or text someone to ask for consent, because that request is itself a marketing message.

Inferred consent can arise where someone has an ongoing relationship with your business, such as a membership, subscription or account, and the marketing is directly related to that relationship. The ACMA says it does not cover sending messages after someone has just bought something from you. So a past customer list, on its own, isn't a mailing list.

There's a narrow exception for work addresses published conspicuously, such as on a company website. You can send messages relevant to that person's role, unless the publication says they don't want unsolicited commercial messages.

If you buy or rent a list, you're still responsible for having consent for every address. Using lists created with address-harvesting software is banned.

The rules apply to commercial electronic messages: emails, texts and other electronic messages that offer, advertise or promote goods or services.

Receipts and delivery updates that are purely factual aren't marketing. But the ACMA says if a message contains any promotional content, it is commercial, even if its main purpose is factual. A discount code in an order confirmation, a banner ad on an invoice or a link to a sale can all turn a service message into marketing. The simplest fix is to keep service messages and promotions separate.

Each commercial message must:

• Identify you. Use your correct legal business name, or your name and ABN, and include contact details that stay accurate for at least 30 days after sending.
• Include an unsubscribe with clear instructions that works for at least 30 days, costs nothing to use, and doesn't require the person to log in, create an account or give extra personal information.
• Honour unsubscribes within 5 business days.

These rules still apply when an agency or email platform sends the messages for you.

Under the Spam Act, it's up to you to prove you had consent. Record who consented, when and how, and keep a copy of the sign-up wording. Make sure unsubscribes flow through to every tool you send from.

If the Privacy Act also covers your business, you need to handle those email addresses in line with the Australian Privacy Principles, including your privacy policy, collection notices and security. The separate direct marketing principle (APP 7) generally doesn't apply to emails and texts covered by the Spam Act, but other principles still do.

The ACMA enforces the Spam Act and regularly issues penalties, including to retailers that messaged customers without consent or after they had unsubscribed.