The Spam Act 2003 states that for all commercial electronic messages sent by a business or organisation, meeting the consent requirement is mandatory. There are two types of consent—express and inferred.
When an individual or organisation first provides their email address, and you plan to send them a commercial electronic message, you must first get their express consent.
Express consent comes in many ways—filling in a form, ticking a box on a website, over the phone, face-to-face or by swapping business cards—as long as the recipient is aware they may receive commercial messages. You cannot send an electronic message to seek consent—this is in itself a commercial message because it seeks to establish a business relationship.
Businesses should keep a record of all instances where consent is given, including who gave the consent and how. Under the Act, it is up to the sender to prove that consent exists.
Inferred consent can occur:
- via an existing business or other relationship, where there is reasonable expectation of receiving commercial electronic messages
- via conspicuous publication of a work-related electronic address because it is accessible to the public, or a section of the public
- if the address is not accompanied by a statement saying no commercial messages are wanted
- the subject of the message is directly related to the role or function of the recipient.
How do I prove sufficient consent to send messages?
Keeping records is essential, as the burden of proving consent lies with the sender. Many e-mail and SMS systems have the capacity to record opt-ins and opt-outs of your database as a built-in process. However, consent, message-sending activity and unsubscribe requests can be incorporated into a simple spreadsheet or sophisticated customer relationship management system.
Using a double opt-in process, where the subscriber confirms a subscription request by reply email or SMS before they are subscribed is a good way to ensure that consent has been recorded.
Can I electronically message customers to obtain their consent to send messages?
No. Unsolicited commercial electronic messages cannot be used to gain consent.
Can I use pre-ticked boxes to obtain consent to send messages?
No. Pre-checked tick boxes—for example, on a website where people can join a mailing list—are not an acceptable way of gaining consent.
Do I have consent if recipients don’t object or unsubscribe?
No. Silence does not constitute consent.
Can someone subscribe or give consent on someone else’s behalf?
No, not unless they do so using that person's email account. Consent to receive commercial electronic messages must be given by the relevant electronic account-holder—the person responsible for that account.
Can I contact someone who has published their email or phone number online?
Consent is only inferred if the contact details are published and:
- they are accessible to the public
- they are not accompanied but a statement saying commercial messages are not wanted
- there is a strong link between what you’re promoting and the recipient’s business.