Gaining legitimate consent | ACMA

Gaining legitimate consent

The following information is provided as a guide only and while every reasonable effort has been made to ensure the information is accurate at the time of publication on this page, it should not be relied on as legal advice or regarded as a substitute for legal advice in individual cases.

How can I ensure I can prove I have sufficient consent to send messages?

It is important to remember that the evidential burden of proving consent lies with the message sender. Keeping up-to-date records on all your marketing activities is essential. Many specialised e-mail and SMS messaging systems include the capacity to record opt-ins and opt-outs of your database as a built-in process. However, consent, message sending activity and unsubscribe requests can be incorporated into a simple spreadsheet or sophisticated customer relationship management system.

Using a double opt-in process, where the subscriber confirms a subscription request by reply email or SMS before they are subscribed, is a good way to ensure that consent has been recorded.

Can I send an electronic message to customers to obtain their consent to send messages in the future?

No. Unsolicited commercial electronic messages cannot be used to gain consent.

The Spam Act prohibits messages that aim to 'test the water', or gauge the recipient's interest in receiving future commercial messages. These kinds of messages are in themselves commercial, as they seek to establish a commercial relationship. You need to gain consent through other means.

Note that telephoning a person seeking such consent may be considered a telemarketing call and is subject to compliance with the Do Not Call Register Act.

Can I use a pre-ticked boxes to obtain consent to send marketing messages?

No. Pre-checked tick boxes—for example, on a website where people can join a mailing list—are not an acceptable way of gaining consent. For express consent to exist, a person must actively and deliberately give consent to receiving commercial electronic messages, either by checking the tick box themselves or by giving consent in some other clear and transparent way (for example, typing their email address into the 'consent' field of a web form).

If recipients don't object or unsubscribe, can I assume I have consent?

No, silence does not constitute consent. Just because a person does not actively unsubscribe from your mailing list does not mean they consent to receiving commercial electronic messages from you. You must have either express or inferred consent before you send such messages.

Can someone subscribe, or give consent, on another person's behalf?

No, not unless they do so using that person's email account. In general, consent to receive commercial electronic messages must be given by the relevant electronic account-holder - the person responsible for that account. This is normally the addressee.

However, if a second person (for example, an executive assistant, supervisor or family member) has access to that account, any consent given by that second person is taken to have come from the account-holder. If consent is mistakenly given, the account-holder can withdraw it by unsubscribing.

In some businesses, authority over electronic accounts may rest with a director or officer, rather than the actual user. The person who has the authority and capacity to act on behalf of the company, can also give consent. If you are gaining consent over the telephone and are in any doubt about who is responsible for the email address, seek clear confirmation.

Can I contact people who have published their email address or mobile telephone number online?

It is important to remember that the publication of an email address or mobile telephone number in itself does not mean there is consent to send commercial electronic messages to it.

In certain circumstances, consent to receive a commercial electronic message may be inferred if a person has published their work-related email address or mobile telephone number and:

  • it is accessible to the public or a section of the public (for example, it appears on a website, telephone directory or brochure)
  • it is not accompanied by a statement that commercial messages are not wanted
  • there is a strong link between what you are promoting and the person's role. You cannot infer someone's consent just because you believe your product or service will benefit them.

Information on business cards is not conspicuously published and you must consider the circumstances and purpose of your receiving the card before deciding whether you have inferred consent.

All commercial messages sent with inferred consent must also meet the identification and unsubscribe requirements of the Spam Act.

For more information on the three key conditions of the Spam Act, visit the links below.

Last updated: 19 May 2017