Direct marketing can be one of the fastest ways to grow a small business.
Whether you’re building a mailing list, running SMS promotions, calling leads, or sending letters to households in your local area, direct marketing helps you reach customers without waiting for them to find you first.
But because direct marketing involves contacting people (often using their personal information), there are some important legal rules you need to get right in Australia. The good news is: once you understand the basics, compliance becomes a straightforward checklist you can build into your systems from day one.
Below, we’ll walk you through the key Australian laws that commonly apply to direct marketing, the practical steps to reduce risk, and the legal documents that help you stay on track as you scale.
What Counts As Direct Marketing (And Why The Law Cares)
In simple terms, direct marketing is when you market your product or service by contacting someone directly, rather than advertising broadly to the public.
It can include:
- Email campaigns (newsletters, promotions, cart abandonment emails, “come back” offers)
- SMS and MMS campaigns (discount codes, appointment reminders that include promotions)
- Phone calls to prospects or customers (including “warm” leads from a web form)
- Direct mail (letters, flyers, catalogues addressed to individuals or delivered to residences)
- Social media direct messages or inbox marketing (this can raise Spam Act and privacy issues depending on the platform, how you contact someone, and whether you’re using personal information to target the message)
- Retargeting and custom audiences (when you upload customer lists or match users based on identifiers)
The law cares because direct marketing often involves:
- using or sharing personal information (names, emails, phone numbers, addresses, purchase history)
- contacting people in a way that can be intrusive or unwanted
- making claims about pricing, products, and offers that can mislead customers if not handled carefully
If you get compliance right, you not only reduce legal risk - you also build trust, improve deliverability, and protect your brand reputation.
The Main Laws That Apply To Direct Marketing In Australia
Australian direct marketing rules don’t sit in one single “Direct Marketing Act”. Instead, compliance usually comes from a few core regimes working together.
The Spam Act 2003 (Email, SMS, And Other Electronic Messages)
If you send marketing by email or SMS, the Spam Act 2003 is usually front and centre.
While the details can get technical, most small businesses can think of the Spam Act as having three pillars:
- Consent: you generally need consent to send marketing messages.
- Identification: your message must clearly identify who is sending it (your business name and contact details).
- Unsubscribe: every marketing message must include a functional way to opt out.
Consent can be express (the person actively opts in) or inferred (there is an existing relationship and the marketing is within reasonable expectations). In practice, express consent is usually the safer and easier option to prove later.
It’s also important to operationalise these rules. For example, unsubscribe requests generally need to be easy to use, free (or low cost), and honoured promptly (typically within 5 business days). You also can’t send further marketing after someone has unsubscribed (even if they’re still a customer), unless they later opt back in.
If your marketing relies on a list you “got from somewhere”, this is the moment to slow down and check it. Purchased lists, scraped lists, and unclear opt-ins are where many businesses get into trouble.
If you’re building or refining your campaign process, it’s worth checking your approach aligns with email marketing compliance basics (especially around consent and opt-out mechanics).
The Do Not Call Register Act 2006 (Telemarketing Calls)
If your direct marketing includes calling numbers (including mobile numbers), you also need to think about the Do Not Call Register.
As a general rule, if a number is listed on the Do Not Call Register, you can’t make telemarketing calls to that number unless an exception applies. There are also rules around calling hours, caller identification, and abandoning calls.
In practice, this usually means you need systems to:
- check numbers against the Do Not Call Register before calling (and re-check at appropriate intervals)
- call only within the permitted hours (which differ depending on the day)
- ensure your caller ID is not blocked and the recipient can identify and contact your business
- stop calling if someone asks you to (including maintaining internal do-not-call lists)
This catches many startups out when they scale outbound sales quickly - for example, hiring a contractor to “just start calling leads” without a clean process for checking the register and logging consent.
If outbound calls are part of your growth plan, keeping your scripts, calling practices, and lead sources aligned with telemarketing requirements is key.
Direct marketing messages are still “advertising”, and that means the Australian Consumer Law (ACL) can apply.
In particular, your direct marketing must not be misleading or deceptive, and you need to be careful about how you describe:
- pricing (including conditions, fees, and time limits)
- discounts (“was/now” pricing and comparisons)
- availability (“limited stock”, “only 3 left”) if that’s not accurate
- testimonials, reviews, and endorsements
- performance claims (“guaranteed results”, “cures”, “best in Australia”)
A lot of direct marketing risk comes from short-form messages (like SMS) where businesses try to squeeze big claims into tiny character limits. Even if your message is brief, it still needs to be accurate and not create a misleading overall impression.
If you want to sense-check your messaging approach, it helps to understand what regulators and courts look for in misleading or deceptive conduct.
Pricing is a particularly common trap in marketing campaigns. For example: “$99” promotions that exclude mandatory fees, or “from $X” claims that only apply in unrealistic circumstances. Getting your advertised price right can save you a lot of headaches later.
Privacy Rules (Collecting, Using, And Sharing Customer Data)
Direct marketing is heavily data-driven - and that data is often personal information.
Privacy compliance depends on your business size, what you do, and how you collect and use information. In Australia, many small businesses are exempt from the Privacy Act 1988 (Cth) if their annual turnover is $3 million or less. However, there are important exceptions (for example, if you’re a health service provider, you trade in personal information, or you are otherwise brought under the Act). Even if you are exempt, privacy expectations from customers, platforms, and commercial partners can still be high.
If the Privacy Act applies to you, the Australian Privacy Principles (APPs) include specific rules about direct marketing (APP 7). Broadly, this means you generally need to only use/disclose personal information for direct marketing in permitted circumstances, and you must provide a simple way for people to opt out of direct marketing (and honour those requests).
Common risk areas include:
- collecting emails and phone numbers without clearly telling people what you’ll do with them
- using customer data for a new purpose they wouldn’t expect (for example, sharing a list with a partner business)
- uploading customer lists to advertising platforms to create “lookalike audiences” without proper transparency
- holding data longer than you need, or storing it insecurely
Many businesses deal with this by putting the right “front-end” transparency in place - for example, a short notice at the point of collection and a clear privacy policy behind it.
In practical terms, that often means having a properly drafted Privacy Policy and using a privacy collection notice (for example, under your lead forms or checkout) so customers understand how their information will be used.
Even if you’re a small business and the Privacy Act doesn’t apply to you in a particular scenario, strong privacy practices are still a smart risk-management move - especially if you’re building a brand for long-term growth, working with enterprise clients, or preparing for investment.
Consent: The Foundation Of Compliant Direct Marketing
If there’s one concept to get right early, it’s consent.
Consent affects:
- how you build lists
- what you can send
- how confident you can be if a complaint is made
- your deliverability (spam complaints can hurt email performance even if you’re not “technically” breaking the law)
What Good Consent Practices Look Like
For most small businesses, good consent practices include:
- Clear opt-in wording (avoid vague language like “updates” if you’ll send promotions)
- No pre-ticked boxes for marketing consent
- Separate consent where possible (e.g. separate marketing consent from terms acceptance)
- Double opt-in for email lists if you want stronger evidence and list quality (not always legally required, but often helpful)
- Records of when, where, and how the person opted in
If you’re collecting consent via lead magnets (like free downloads), giveaways, webinars, or waitlists, make sure your sign-up flow is still transparent. The goal is that a reasonable person would understand they’re joining marketing communications, not just receiving a one-off resource.
Inferred Consent: Useful, But Not A Shortcut
Many businesses rely on “inferred consent” when someone becomes a customer, makes an enquiry, or has an existing relationship with the business.
Inferred consent can be valid, but it’s not a blank cheque. You should still ask:
- Would the person reasonably expect to receive this type of marketing from us?
- Is the marketing related to what they actually enquired about or purchased?
- Do we make it easy to opt out?
As your business grows, express opt-ins usually become easier to manage than trying to justify inferred consent across multiple customer journeys.
Practical Compliance Checklist For Direct Marketing Campaigns
Legal compliance is much easier when it’s built into your systems, templates, and workflows - not left to ad-hoc judgement right before a campaign goes out.
Here’s a practical checklist many small businesses use for direct marketing in Australia.
1) Know What Channel You’re Using (Email, SMS, Calls, Mail)
Different channels trigger different rules. Before you launch a campaign, identify:
- Is this an electronic message (email/SMS)?
- Is this a telemarketing call?
- Is this physical direct mail?
- Is this a message via a platform inbox (and are you using personal information to target it)?
This helps you apply the right compliance checks from the start.
2) Check Your List Source
Ask where your list came from and whether consent is clear.
- If it’s from your website forms: do you have clear consent wording and a notice at collection?
- If it’s from purchases: did customers opt in at checkout (or would marketing be reasonably expected)?
- If it’s from events: did people give details for contact later, and was marketing explained?
- If it’s from a third party: do you have written assurances and evidence of consent?
If the source is unclear, it’s often safer to run a re-permission campaign (or rebuild the list) than to risk complaints.
3) Make Unsubscribe Easy (And Actually Action It)
From a practical perspective, unsubscribing shouldn’t require:
- logging into an account
- calling your business
- explaining why
- waiting days for manual processing
Make opting out quick, obvious, and reliable - and ensure you don’t keep marketing someone who has opted out (including across different tools your team uses). For electronic marketing, you should also make sure your unsubscribe method stays functional for at least 30 days after the message is sent.
4) Be Careful With Offers, Urgency, And “Too Good To Be True” Claims
Direct marketing works because it can be persuasive and time-sensitive - but urgency tactics can create legal issues if they’re not genuine.
If you use phrases like “ends tonight”, “limited stock”, “exclusive invite”, or “guaranteed savings”, make sure:
- you can back it up
- the terms and conditions are clear (especially for discounts)
- the overall impression isn’t misleading
5) Manage Third Parties (Agencies, CRMs, Lead Gen Providers)
Many businesses outsource direct marketing to:
- marketing agencies
- lead generation providers
- appointment setters or outbound callers
- email/SMS platform providers
Outsourcing doesn’t outsource responsibility. You should have clear written agreements about:
- who owns the data
- how consent is collected and evidenced
- what messages can be sent and under what brand name
- security expectations and breach reporting
This is one of those areas where getting the contract right early can save you a lot of pain later - especially if you switch providers or need to prove your compliance history.
What Legal Documents Help Protect Your Business When Doing Direct Marketing?
Direct marketing is often “systems-based”. That means your legal protection shouldn’t live in someone’s head - it should live in your documents, workflows, and customer-facing notices.
Depending on your business model, these documents are commonly relevant:
- Privacy Policy: sets out how you collect, use, store, and disclose personal information, including for marketing and analytics. For many businesses, a tailored Privacy Policy is one of the most important foundations.
- Privacy Collection Notice: a short notice at the point you collect personal information (web forms, checkout, bookings) explaining what you’re collecting and why. A compliant privacy collection notice helps reduce surprises and complaints.
- Website Terms And Conditions: useful if you collect leads through your website, run promotions, or manage accounts and subscriptions.
- Promotion Terms And Conditions: if you run giveaways, referral offers, competitions, or time-limited promotions, clear terms can reduce disputes and improve ACL compliance.
- Marketing Services Agreement: if an agency or contractor runs your campaigns, a written agreement helps set boundaries around data use, consent standards, and deliverables.
- Customer Contract Or Terms Of Service: if you sell ongoing services or subscriptions, your customer terms can also address communications, notices, and how you handle account updates.
Not every business needs every document, and the right setup depends on how you sell and how you market. But as you scale direct marketing, having the right documents in place makes compliance repeatable - and that’s what reduces risk long-term.
Key Takeaways
- Direct marketing includes email, SMS, phone calls, direct mail, and other targeted outreach - and the legal rules vary depending on the channel you use.
- For email and SMS campaigns, the Spam Act typically requires consent, clear sender identification, and a working unsubscribe function (and you need systems to action opt-outs within required timeframes).
- For outbound calls, you’ll usually need to consider the Do Not Call Register rules (including calling-hour limits) and set up processes before you scale your sales team.
- Direct marketing is still advertising, so the Australian Consumer Law applies - especially around misleading claims, discounts, and advertised pricing.
- Because direct marketing is data-driven, privacy compliance matters: be transparent at collection, use personal information appropriately, and protect customer data. If the Privacy Act applies to your business, APP 7 contains specific rules about direct marketing and opt-outs.
- The easiest way to stay compliant is to build a repeatable workflow: list source checks, consent records, opt-out handling, and clear documentation with any agencies or contractors.
If you’d like help setting up compliant direct marketing systems (including privacy documents and campaign terms), you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
