Is cold email legal in Australia? B2B rules for 2026
2026-10-15 · updated 2026-10-15 · 7 min read · Adam Axelsson, founder of Revexa
Only with consent. Australia's Spam Act 2003 bans sending a commercial electronic message with an Australian link unless the account-holder consented, and it has no exception for business recipients. Consent can be inferred from a conspicuously published work address of an employee, director, partner or self-employed person when the message relates to their work, but not from "the mere fact" that an address was published. We found no guidance on LinkedIn, but the Act covers instant messaging and "similar" accounts, so a sales DM likely needs consent too (our assessment).
Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.
Like Germany, Australia starts from consent even in B2B, though it allows inferred consent in defined cases. All countries: cold email laws by country.
Australia at a glance
| Situation | Rule | Source |
|---|---|---|
| Generic company address (info@) | Consent; publication alone is not enough (a role address can give inferred consent, hard to show for info@, our reading) | Sch. 2 cl. 4 |
| Named employee | Consent; inferred if conspicuously published, with no refusal statement, and the message relates to their work | Sch. 2 cl. 4(2) |
| Sole trader | Same rule; the Act names a "self-employed individual" | Sch. 2 cl. 4(2) |
| Existing customers | No EU-style soft opt-in; inferred consent needs an ongoing relationship, not just a purchase | Sch. 2 cl. 2, ACMA |
| LinkedIn and social DMs | No guidance found; the Act covers instant messaging and similar accounts (our assessment: likely covered) | s 5 |
| Cold calls to businesses | Allowed without consent (business numbers cannot be on the Do Not Call Register); the telemarketing standard applies | DNCR Act s 14, donotcall.gov.au |
| Regulator | Australian Communications and Media Authority (ACMA) | Spam Act |
| Maximum penalty | Company with no prior record: about A$728,000 per day (2,000 penalty units); with a prior record about A$3.64 million per day (our calculation) | s 25 |
What the Spam Act says
Section 16:
"A person must not send, or cause to be sent, a commercial electronic message that: (a) has an Australian link; and (b) is not a designated commercial electronic message." / "(2) Subsection (1) does not apply if the relevant electronic account-holder consented to the sending of the message."
Electronic messages include those sent to "an instant messaging account" or "a similar account" (s 5(1)). There is an Australian link when, among other things, the recipient is in Australia, or is an organisation carrying on business there, when the message is accessed (s 7). Every message must identify who authorised it and how to contact them (s 17) and include a working unsubscribe facility (s 18); a withdrawal of consent takes effect after 5 business days (Schedule 2, clause 6). Part 3 bans using address-harvesting software and harvested lists in connection with breaches of section 16. Source: Spam Act 2003, Compilation No. 10, the latest on 15 October 2026.
What ACMA says
"If you plan to send marketing messages or emails, you must first have consent from the person who will receive them."
It adds three points B2B senders often miss: "You cannot send an electronic message to ask for consent, because this is a marketing message.", "You are still responsible for making sure you have consent for any addresses you use." and "Under the Spam Act, it's up to you to prove that you have a person's consent." For customers, inferred consent needs "a provable, ongoing relationship with your business", and "It does not cover sending messages after someone has just bought something from your business." Source: ACMA, avoid sending spam (archived copy, 9 July 2026; acma.gov.au could not be read automatically).
Named employees, sole traders and published addresses
The Act does not separate legal and natural persons, and it limits what publication can do:
"For the purposes of this Act, the consent of the relevant electronic account-holder may not be inferred from the mere fact that the relevant electronic address has been published."
Schedule 2, clause 4(2) sets the conditions for inferred consent when an address reaches a particular employee, director, officer, partner or "self-employed individual": the address "has been conspicuously published", it is reasonable to assume the person agreed to that, no refusal statement accompanies it, and the messages are relevant to "the work-related business, functions or duties" of that person. Role addresses work the same way for messages about "the function or role concerned"; a general inbox like info@ has no clear function, so in our reading inferred consent is hard to show for it.
In ACMA v Clarity1 (2006), the Federal Court read "conspicuous" as "easy to be seen … readily attracting the attention" and rejected the defence where messages did not match the recipient's work, for example an address "published on his academic website" for messages that did "not relate to his academic activities". (judgment, archived copy)
LinkedIn and social media messages
No guidance found from ACMA or a court on LinkedIn. The Act covers instant messaging and similar accounts, and in June 2025 ACMA penalised TAB for "2,598 SMS and WhatsApp messages" sent to VIP customers without an unsubscribe option, saying spam laws apply "whether it’s generic campaigns or personalised messages" (ACMA). Our assessment: a LinkedIn sales message to a recipient in Australia likely needs consent.
Privacy law
The Privacy Act 1988 restricts direct marketing in APP 7, but "APP 7 does not apply to the extent that" the Spam Act or the Do Not Call Register Act apply (OAIC). For email, the Spam Act's consent rule decides (our reading).
Penalties and real cases
ACMA can issue warnings and infringement notices; the Federal Court can order civil penalties of up to 100 penalty units per contravention of section 16 and 2,000 per day for a company with no prior record, or 500 and 10,000 with one (s 25). At A$364 per unit for offences from 1 July 2026, that is about A$728,000 and A$3.64 million per day (our calculation; we have not tested how indexation applies to earlier breaches).
The recent cases we found are consumer cases, none purely B2B:
- Latitude Finance, April 2026: "paid a $3.96 million penalty" after ACMA found it "breached Australia’s spam laws more than 2.7 million times" (ACMA).
- Tabcorp (TAB), July 2026: paid more than A$2.7 million after self-reporting more than 217,000 marketing emails and SMS sent "to customers who had unsubscribed from specific marketing channels", plus 351 calls to numbers on the Do Not Call Register (ACMA).
Checklist for B2B email to Australia
- Have consent for every address before the first message: express, or inferred under the conspicuous publication rule.
- For inferred consent, record where the address was published and how your message relates to the person's work.
- Do not email to ask for consent, and do not use harvested lists.
- In every message, identify your business and how to contact it, include a working unsubscribe, and act on unsubscribes within 5 business days.
- Apply the same care to LinkedIn and other instant messages.
How Leo handles Australia
Leo, the buying-signal agent Revexa builds, blocks only Germany automatically, not Australia. The Spam Act requires consent, and you read and approve every draft in review mode, so whether you have express or inferred consent for an Australian lead is yours to check before you approve. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise.
Common questions
Is B2B cold email legal in Australia?
Only with consent. The Spam Act 2003 has no B2B exception: every commercial electronic message with an Australian link needs express or inferred consent, accurate sender details and a working unsubscribe.
Can I email an address published on a company website?
Only if the publication was conspicuous, the person agreed to it, no statement refused unsolicited messages, and your message relates to their work. Publication alone is never enough.
Does the Spam Act apply to emails sent from outside Australia?
Yes, if the message has an Australian link, for example when the recipient is physically in Australia when the message is accessed, or is an organisation carrying on business there.
What are the penalties under the Spam Act?
For a company with no prior record, up to 2,000 penalty units per day for breaches of section 16, about A$728,000 at A$364 per unit (our calculation). In 2026, Latitude Finance paid A$3.96 million and TAB more than A$2.7 million.