Guide
Is B2B cold email legal in Australia? The Spam Act, quoted
Australia allows cold email to a published work address on conditions, and then adds a second rule about how the address was found.
Short answer
Yes, with consent, and consent can be inferred. The Spam Act prohibits unsolicited commercial email unless the account-holder consented [1] [2]. Consent can be inferred from a conspicuously published work address when your message is relevant to the person's role [7]. A second rule matters here: the Act restricts address-harvesting software, defined as software designed or marketed for searching the internet for addresses and collecting them [12]. Tools that search the web for addresses may fall under it.
General information, not legal advice, as of the date above. Where a regulator says its guidance is under review, we say so. If your situation is unusual, ask a lawyer who practises in that country.
The starting point: consent
Section 16(1) says: "A person must not send, or cause to be sent, a commercial electronic message that" has an Australian link and is not a designated message [1]. Section 16(2) lifts the ban when "the relevant electronic account-holder consented to the sending of the message" [2]. The Act applies to messages with an Australian link, so it reaches an Australian recipient wherever you are.
What counts as consent
Schedule 2 defines consent as express consent, or "consent that can reasonably be inferred from: (i) the conduct; and (ii) the business and other relationships; of the individual or organisation concerned" [3]. Then it closes the obvious shortcut: consent "may not be inferred from the mere fact that the relevant electronic address has been published" [4]. An address being findable is not enough.
Inferred consent from conspicuous publication
Clause 4(2) of Schedule 2 makes an exception. It covers addresses that reach a particular employee, director, officer, partner, office-holder or self-employed individual, or the person in a particular role. Consent is inferred when all of these hold:
- "the electronic address has been conspicuously published; and" [5]
- it would be reasonable to assume that the publication was done with the agreement of the person, or of the organisation for a role address;
- the publication is not accompanied by "a statement to the effect that the relevant electronic account-holder does not want to receive unsolicited commercial electronic messages at that electronic address" [6], or a statement to similar effect;
- the message is relevant to "the work-related business, functions or duties of the employee, director, officer, partner, office-holder or self-employed individual concerned" [8].
This is close to Canada's conspicuous publication rule, with one difference: the Australian text asks whether it is reasonable to assume the publication was agreed. The Act's own words for the result: the account-holder "is taken, for the purposes of this Act, to have consented" [7].
The address-harvesting rules
Section 4 defines the term: "address-harvesting software means software that is specifically designed or marketed for use for: (a) searching the internet for electronic addresses; and (b) collecting, compiling, capturing or otherwise harvesting those electronic addresses" [12]. A harvested-address list is a list whose production is "to any extent, directly or indirectly attributable to the use of address-harvesting software" [13].
Section 22(1) then says: "A person must not use: (a) address-harvesting software; or (b) a harvested-address list" if the person is in Australia, or is a body that carries on business there [14]. Sections 20 and 21 cover supplying and acquiring them.
Section 22(2) limits that: it "does not apply in relation to the use of address-harvesting software or a harvested-address list, if the use was not in connection with sending commercial electronic messages in contravention of section 16" [15]. Read plainly, the exposure is greatest when a message to a harvested address has no valid consent behind it.
Whether a particular tool is "specifically designed or marketed" for this is a question of fact about that tool. We are not aware of a ruling that settles it for tools that read an organisation's own website. Treat any product that searches the web for addresses, ours included, as one that may fall under these rules.
Decision table
| Situation | Can you write? |
|---|---|
| Work address published on the organisation's site, email about the reader's role, no refusal notice | Yes, consent inferred |
| Same, but the page says no unsolicited commercial messages | No |
| Address published, email unrelated to their role | No: the inference needs relevance |
| Address guessed, or not conspicuously published | No: nothing to infer consent from |
| Address from a list built with search-and-collect software | High risk: the harvesting rules apply |
What every email must contain
- The message "clearly and accurately identifies the individual or organisation who authorised the sending of the message" and includes "accurate information about how the recipient can readily contact that individual or organisation" [9].
- "a statement to the effect that the recipient may use an electronic address set out in the message to send an unsubscribe message" to the sender [10].
- A withdrawal of consent takes effect "at the end of the period of 5 business days" from the day the unsubscribe message was sent [11]. Honour it sooner.
How Honest Intros fits
Honest Intros finds addresses by reading organisations' own websites and records the page each one came from. It shows a warning on Australian companies, "Australia restricts addresses found by software", and you decide whether to keep them in the campaign. We do not tell you that the harvesting rules do or do not apply to this: that is for you or a lawyer to judge. Every email carries your details and an unsubscribe link, an opt-out stops all further email at once, and you approve each batch.
Questions
Is B2B cold email legal in Australia?
Yes, with consent, which can be inferred when the address was conspicuously published, carries no refusal notice and your email is relevant to the person's work. Being published alone is not enough.
What is address-harvesting software under the Spam Act?
Software specifically designed or marketed for searching the internet for electronic addresses and collecting them. Using it, or a list made with it, is restricted for people and businesses in Australia.
Can I use a tool that finds email addresses on websites to email Australian companies?
It may fall under the harvesting rules, depending on how the tool is designed or marketed. The restriction on use does not apply where the use is not connected with sending messages in breach of the consent rule, but take advice before relying on that.
See what it would write for you
Paste your website. Honest Intros learns what you sell and shows who it would write to, and what it would say.
Free to start. Nothing is sent until you approve it.