Email marketing, spam rules and privacy for online stores

For many online stores, email is the channel that turns one-off buyers into repeat customers. Unlike paid ads, you don't pay every time someone sees your message. But Australia has clear rules for commercial email and SMS under the Spam Act 2003, enforced by the Australian Communications and Media Authority (ACMA), and privacy rules administered by the Office of the Australian Information Commissioner (OAIC).

This guide covers the essentials: consent, identification and unsubscribe under the Spam Act, when the Privacy Act applies, and practical data security for small stores. It is general information, not legal advice.

The Spam Act in brief

The Spam Act applies to commercial electronic messages, including marketing emails, SMS and instant messages, with an Australian link. ACMA summarises the rules in three steps:

1. Consent. Only send commercial messages to people who have agreed to receive them.
2. Identify. Include accurate information about who sent the message and how to contact you.
3. Unsubscribe. Make it easy for people to opt out, and honour requests within five working days.

Breaches can lead to significant penalties, and ACMA has taken enforcement action against businesses of all sizes.

Consent

Express consent

Express consent is when someone actively agrees to receive your marketing, for example by ticking an unticked box or signing up to your newsletter. It is the clearest and safest basis. Good practice:

• use a clear sign-up form that explains what people will receive;
• don't pre-tick consent boxes;
• keep records of when and how each person consented.

Inferred consent

ACMA explains that consent can sometimes be inferred from an existing business relationship and the person's reasonable expectations, for example when someone has bought from you and the marketing relates to that relationship. Inferred consent is narrower and less certain than express consent, so many stores ask customers to opt in at checkout.

What doesn't count

• Bought or rented lists. Buying a list doesn't give you consent from the people on it.
• Harvested addresses. Using software to collect email addresses for spam is prohibited.
• Business cards or public addresses, unless the context clearly implies consent to your type of message.

Identification

Every commercial message must clearly identify the business that authorised it and include accurate contact information. Most email platforms add your business details to the footer automatically. Make sure they're correct and current.

Unsubscribe

Every commercial message must include a functional unsubscribe facility. ACMA says it must:

• be clearly presented and easy to use;
• be free of charge (apart from normal costs of sending a reply);
• work for at least 30 days after the message is sent;
• be honoured within five working days.

Don't require people to log in or give a reason, and don't keep sending marketing after they've unsubscribed.

SMS marketing

The same rules apply to SMS: consent, identification and a functional way to unsubscribe, such as replying STOP. Keep messages relevant and infrequent, because SMS feels more intrusive than email.

The Privacy Act

The Privacy Act 1988 and the Australian Privacy Principles (APPs) regulate how covered organisations collect, use, store and disclose personal information.

Does it apply to you?

The OAIC explains that most businesses with an annual turnover of $3 million or less are not covered, but some small businesses are, including those that:

• trade in personal information (for example, selling customer data or buying it);
• provide health services;
• are contracted service providers for a Commonwealth contract;
• have opted in to be covered.

Many small dropshipping stores will be exempt, but check the OAIC's guidance for your situation. Privacy law is also being reformed, so stay up to date.

Good practice anyway

Even if you're exempt, customers trust stores that handle their data well. Platforms and payment providers may also require a privacy policy. A clear privacy policy should explain:

• what personal information you collect (name, address, email, order history);
• why you collect it and how you use it;
• who you share it with, such as suppliers, couriers, payment providers and marketing tools;
• whether information goes overseas, which is common when suppliers are overseas;
• how customers can access or correct their information and make a complaint.

Sharing data with suppliers

Dropshipping requires sharing customer names and addresses with suppliers. Share only what's needed for delivery, choose suppliers that protect data, and mention this sharing in your privacy policy. If you're covered by the Privacy Act, the APPs include rules on overseas disclosure.

Data breaches

If you're covered by the Privacy Act, the Notifiable Data Breaches scheme requires you to notify affected individuals and the OAIC about eligible data breaches likely to result in serious harm. Even if you're not covered, a breach can damage trust and lead to fraud, so have a plan.

Data security basics

The Australian Signals Directorate's cyber.gov.au site has free guidance for small businesses. Basics include:

• turning on multi-factor authentication for your store, email, bank, domain and ad accounts;
• using a password manager and unique passwords;
• keeping software updated, including store apps and plugins;
• limiting access so staff and contractors only see what they need;
• backing up important data, such as order exports and customer lists;
• watching for phishing, especially fake platform or supplier emails.

Building a list the right way

The most valuable email lists are built from people who genuinely want to hear from you. Offer a clear reason to subscribe, such as product guides, restock alerts or early access to new ranges. Tell people how often you'll email, then stick to it. Remove addresses that bounce, and consider re-confirming consent with subscribers who haven't opened your emails in a long time.

Key points

The Spam Act requires consent, clear sender identification and a working unsubscribe in every commercial email or SMS, with unsubscribes honoured within five working days. Don't buy lists. Most businesses with turnover of $3 million or less aren't covered by the Privacy Act, but there are exceptions, and a clear privacy policy and good security are wise for every store. Share only necessary data with suppliers and protect your accounts with multi-factor authentication.

Related guides

Read pricing and margins, refunds and consumer guarantees and ABN and business names.