Is cold email legal in Australia?

Cold email to a business is legal in Australia, within tight limits. Under the Spam Act 2003, you can only send a marketing email to someone who has consented. For a cold email, that consent generally has to come from the way their address was published. And every marketing email, cold or not, has to say who sent it and offer a working way to unsubscribe.

This is general information, not legal advice.

Does the Spam Act apply to business-to-business email?

Yes. There's no exemption for emails to businesses. The Act applies to commercial electronic messages with an Australian link, which includes messages to an organisation that does business in Australia. A message is commercial if one of its purposes is to offer or promote goods, services or a business opportunity. A sales email to another business is squarely in.

When can you email someone you don't know?

The Act needs consent, either express (they agreed) or inferred. Inferred consent is where cold email lives, and the Act is specific about it.

First, the Act says consent can't be inferred from the mere fact that an address was published. But there's an exception for conspicuous publication. It applies when all of these are true:

• The address was conspicuously published, like on the company's own website.
• It's reasonable to assume it was published with their agreement.
• It wasn't published with a statement saying they don't want unsolicited marketing.
• Your email is relevant to their work: their role, duties or function.

So emailing the published address of a company's operations manager about a product that operations managers use can fit. Emailing the same person about something unrelated to their job doesn't.

What every marketing email needs

Even with consent, each message must:

• Clearly identify who sent it, with accurate contact details that stay valid for at least 30 days.
• Include a clear way to unsubscribe that works for at least 30 days after sending. Under the Spam Regulations, it can't cost anything, need a login or ask for more than the email address.
• Honour an unsubscribe within five business days.

The unsubscribe part isn't a technicality. In March 2026, ACMA, the regulator, announced Lululemon had paid just over seven hundred thousand dollars over marketing emails without a working unsubscribe.

Bought lists and scraped addresses

Buying a list doesn't take the responsibility off you. ACMA's guidance is that if you use a list you've bought, you're still responsible for making sure you have consent for every address on it.

Scraping is stricter. The Act bans using address-harvesting software, meaning software designed to search the internet for email addresses and collect them, or using a list made with it, for anyone in Australia or doing business here.

The penalties

ACMA can issue infringement notices or take a business to the Federal Court. Penalties are counted per contravention and per day, and they rise sharply for repeat offenders. With thousands of emails, the numbers add up quickly.

What I'd do

• Email named people at their published work address about something relevant to their job.
• Record where and when you found each address, in case you're ever asked.
• Put your business name, contact details and a one-click unsubscribe in every email, and honour unsubscribes quickly.
• Never use scraped lists, and be wary of bought ones.

Being legal is the minimum, though, and it won't get your email delivered. Sending a lot of cold email from your everyday inbox is one of the quickest ways to have Gmail start blocking it. I've written about why emails suddenly start going to spam.