SPAM Act 2003 Compliance for Australian Small Business Using WhatsApp in 2026

What the SPAM Act 2003 Actually Requires

The Spam Act 2003 (Cth) is Australia's primary anti-spam legislation. It applies to commercial electronic messages — broadly defined as messages that offer, advertise, or promote goods, services, or business opportunities.

The Act has three core requirements for any commercial electronic message:

1. Consent: The recipient must have consented to receiving the message, either expressly (actively opted in) or by inference (an existing business relationship makes consent reasonable).

2. Identification: The message must accurately identify the sender. The sender's name and contact details must be correct and the recipient must be able to contact the sender.

3. Unsubscribe: Every commercial message must include a functional unsubscribe mechanism. The unsubscribe must be functional for at least 30 days after the message is sent, and the sender must honour opt-out requests within 5 business days.

The Spam Act applies to any commercial electronic message sent by or on behalf of an Australian business, regardless of where the message is delivered. A WhatsApp message sent from an Australian business to an Australian recipient is covered. A WhatsApp message sent from an Australian business to an overseas recipient is also covered if it originates from Australia.

The Australian Communications and Media Authority (ACMA) enforces the Spam Act. The Act also provides for civil action by recipients.

Consent: Express vs Inferred — The Critical Distinction

The consent requirement is where most Australian small businesses run into compliance risk with WhatsApp.

Express consent is the clearest form: the recipient has actively agreed to receive commercial messages from the sender. This can be collected via:
- A checkbox during online checkout: 'I agree to receive promotional messages from [Business] via WhatsApp'
- A verbal opt-in recorded in a CRM: the customer agrees during a sales call
- A digital form with a WhatsApp opt-in field
- A reply to a message asking 'Would you like to receive our weekly specials via WhatsApp? Reply YES to opt in'

Express consent must be specific — consent to email marketing does not automatically extend to WhatsApp marketing.

Inferred consent applies where there is a business relationship that makes it reasonable to infer the recipient would expect commercial messages. The SPAM Act 2003 and ACMA guidance identify relevant factors:
- The recipient has made a purchase or used the service recently
- The message relates to goods or services the recipient has already used
- The business relationship is current and active
- The recipient displayed an intention to receive such communications

Inferred consent is time-limited and context-limited. A customer who bought from a business two years ago and has not engaged since is a poor candidate for inferred consent. A customer who purchased last week can reasonably be sent a related follow-up offer.

What inferred consent does not cover: Cold outreach to people who have not had a business relationship with you. Purchasing a contact list and sending WhatsApp marketing. Scraping phone numbers from social media. These are unequivocal Spam Act violations.

The Unsubscribe Obligation in a WhatsApp Context

Every commercial WhatsApp message must contain a clear and functional unsubscribe mechanism. Under the Spam Act, this mechanism must:
- Be clearly presented in the message
- Be functional for at least 30 days after the message is sent
- Result in the sender honouring the opt-out request within 5 business days
- Not require the recipient to pay anything to unsubscribe
- Not require the recipient to do more than send a single reply or click

In WhatsApp terms, this typically means including a phrase like 'Reply STOP to opt out of these messages' in every commercial message. When a recipient replies STOP, the system must process the opt-out within 5 business days — no further commercial messages to that number.

For businesses using the WhatsApp Business API with pre-approved templates, Meta's platform includes built-in opt-out functionality that can satisfy this requirement. For businesses using manual WhatsApp messaging (WhatsApp Business app), the unsubscribe obligation requires a manual process — someone must monitor for STOP replies and update the contact list accordingly.

An unsubscribe mechanism that doesn't work — a dead email address, a non-functional reply address, a number that nobody monitors — is itself a Spam Act violation. ACMA can take action against businesses whose unsubscribe processes fail.

For ongoing marketing lists, audit your unsubscribe mechanism quarterly: send a test STOP reply to yourself and verify the opt-out is processed within the required timeframe.

ACMA Enforcement Powers and Real Penalties

The ACMA has broad enforcement powers under the Spam Act. The penalty regime distinguishes between:

Infringement notices (administrative fines): For less serious individual contraventions, ACMA can issue infringement notices without court proceedings. The fixed penalty is currently 60 penalty units for an individual or 300 penalty units for a body corporate (the penalty unit value is updated annually by the Commonwealth — in 2026, one penalty unit equals $313).

Civil penalties (court-imposed): For serious or repeated contraventions, the ACMA can seek civil penalties through the Federal Court. The maximum civil penalty for a body corporate is 10,000 penalty units per contravention — approximately $3.13 million at 2026 rates. For a continuing contravention, penalties can compound.

The '$782,500 per day' figure often cited refers to older enforcement guidance. The current penalty amounts under the Spam Act are calculated per the penalty unit framework above, with high maximums for serious or repeated breaches.

ACMA's published enforcement actions provide useful real-world context:
- A major Australian real estate group was issued an infringement notice for sending unsolicited SMS and email marketing
- An Australian retailer faced enforcement after failing to honour unsubscribe requests within the required timeframe
- Enforcement has targeted businesses in healthcare, hospitality, financial services, and retail

The ACMA also publishes an annual spam report with industry breakdown data. Hospitality, retail, and financial services businesses appear frequently in complaint data.

How WhatsApp Business API Templates Interact with the Spam Act

Businesses sending automated WhatsApp messages at scale use the WhatsApp Business Platform (API). Meta requires all outbound messages to use pre-approved message templates — templates are reviewed by Meta before they can be used.

Meta's template review process assesses whether a template complies with WhatsApp's Business Messaging Policy. This is a separate process from Spam Act compliance. Meta's approval of a template does not mean the template is compliant with Australian law.

However, the WhatsApp Business Platform does provide structural support for Spam Act compliance:

• Opt-in requirement: Meta requires that businesses only send marketing messages to users who have actively opted in to receive WhatsApp messages from that business. This aligns with the Spam Act's consent requirement.
• Opt-out mechanism: Meta's platform supports opt-out keywords (STOP, UNSUBSCRIBE) and can be configured to process these automatically. This aligns with the unsubscribe obligation.
• Template identification: Templates must clearly identify the sending business — this aligns with the identification requirement.

Practical guidance for Australian small businesses using WhatsApp Business API:
1. Do not add a user to your marketing template send list unless they have actively opted in
2. Configure automatic processing of opt-out keywords
3. Include your business name in every template
4. Keep records of when each contact opted in, via which mechanism

SPAM Act Compliance Checklist for Australian Small Business

Before sending commercial messages via WhatsApp, Australian small businesses should verify:

Consent:
- [ ] Do I have express or demonstrably inferred consent for each recipient?
- [ ] Can I document when and how each contact consented?
- [ ] Is my consent specific to WhatsApp marketing (not just email or general marketing)?
- [ ] For inferred consent: is the business relationship current and active?

Identification:
- [ ] Does every commercial message include my business name?
- [ ] Is my contact information accurate and reachable?

Unsubscribe:
- [ ] Does every commercial message include a clear opt-out instruction ('Reply STOP')?
- [ ] Is the opt-out mechanism functional (someone monitors STOP replies)?
- [ ] Do I process opt-outs within 5 business days?
- [ ] Do I maintain a suppression list of opted-out contacts?

Ongoing:
- [ ] Do I periodically re-verify consent for contacts I haven't engaged with in 12+ months?
- [ ] Do I review my unsubscribe process quarterly?
- [ ] Do I keep records of consent, opt-outs, and message sends?

The Spam Act applies whether you send 10 messages or 10,000. The volume of sending affects the scale of enforcement risk, but compliance obligations apply from the first commercial message.