Does Australia's Spam Act apply to WhatsApp and Messenger marketing?
TL;DR: Quick Summary
- Yes. The Spam Act 2003 covers commercial electronic messages sent by email, SMS, MMS and instant messaging, including WhatsApp and Messenger, the same way it covers email.
- ACMA has penalised more than $12 million for spam and telemarketing breaches in the past 18 months, including two separate actions against the same company for WhatsApp and SMS marketing.
- A functional unsubscribe facility isn't optional: ACMA has penalised businesses for making it hard to find, requiring a login, or continuing to send past the 5-business-day window.
- Consent tracked per channel matters more than consent tracked per customer. ACMA's most recent case penalised messages to customers who'd unsubscribed from one channel, not from marketing altogether.
- Meta's Utility template category and the Spam Act ask different questions. A message Meta approves as Utility can still be commercial under Australian law.
Australian regulators have penalised businesses more than $12 million for spam and telemarketing breaches in the past 18 months, by ACMA's own count. Two of those penalties landed on the same brand, Tabcorp's TAB, for the same category of channel: SMS and WhatsApp marketing.
If your business sends promotions or re-engagement messages over WhatsApp or Messenger to Australian customers, the Spam Act 2003 applies the same way it applies to email. This guide covers what counts as a commercial message, the three obligations every message has to clear, where ACMA has enforced, and how the rules compare across Australia, New Zealand and Singapore.
Does the Spam Act cover WhatsApp, Messenger and instant messaging?
Yes. The Spam Act 2003 applies to commercial electronic messages sent by email, SMS, MMS and instant messaging, including WhatsApp and Messenger. The Act doesn't name platforms. It covers the message by what it is and what it's for, not which app carries it.
ACMA has already enforced this reading against WhatsApp directly. Tabcorp's TAB brand paid $4,003,270 after ACMA found thousands of SMS and WhatsApp messages sent to VIP customers between February and May 2024 breached the Act's consent, identification and unsubscribe rules.
What makes a message "commercial"
A commercial electronic message is one where the purpose, or one of its purposes, is to offer, advertise or promote goods, services or a business. Purpose is judged by content, not by what a business calls the message internally or which template category it was sent under.
What's not covered: voice calls, and where the Do Not Call Register applies instead
Voice calls are the one channel the Spam Act expressly excludes. Outbound sales and telemarketing calls sit under the separate Do Not Call Register Act 2006, enforced by the same regulator, ACMA, but under a different register and a different set of rules.
The three obligations: consent, identification, unsubscribe
Every commercial electronic message sent to an Australian recipient has to clear three tests. Missing any one makes the message non-compliant, regardless of the offer inside it.
Expressed vs inferred consent, and why ACMA prefers expressed
Expressed consent is a customer directly opting in: ticking a box, replying "yes", signing up on a form. Inferred consent relies on an existing business relationship and a reasonable expectation the customer would want the message. It's weaker evidence and harder to defend if ACMA asks for proof. Where both are available, ACMA's own guidance favours express consent obtained on clear, accessible terms.
The four unsubscribe failures ACMA has actually penalised
ACMA's Tabcorp determination lists the failures in practice, not in theory: requiring extra personal information to unsubscribe, requiring an account login, omitting the unsubscribe link entirely, and continuing to send beyond the five-business-day window. Each was a separate, documented breach inside the same case.
Consent is per channel, not per customer
ACMA's July 2026 action against TAB is the sharper lesson. The regulator found more than 217,000 marketing emails and SMS sent over 16 days to customers who had unsubscribed from a specific channel, not from marketing altogether. ACMA treated that channel-level withdrawal as binding on its own terms.
A record that stores a customer's channel preference but doesn't enforce it at send time is exactly the gap ACMA penalised. Consent tracked per customer isn't the same as consent tracked and honoured per channel, and the Act requires the second one.
The trap: when a "service message" is legally a marketing message
Not every message needs consent. A delivery update or appointment reminder, sent for a purely factual purposes, falls outside the Spam Act's definition of a commercial message. The trap sits in the word "purely": add a promotional line to it, and the whole message becomes a commercial electronic message, obligations included.
ACMA's enforcement priority on disguised commercial messages
ACMA's stated enforcement focus includes messages sent under a factual or service pretext that carry a commercial purpose. A shipping update that closes with "and here's 20% off your next order" is a marketing message wearing a receipt's clothes, and ACMA assesses it as one.
How Meta's template categories interact with Australian law
Meta's WhatsApp Business Platform sorts every template into Marketing, Utility or Authentication. A template that mixes utility content with promotion gets reclassified as Marketing by Meta itself, but that reclassification exists for Meta's own pricing and delivery rules. It has no legal bearing on whether ACMA treats the message as commercial under Australian law.
The utility-template mistake
Getting a template approved as Utility doesn't make it Spam-Act compliant. Meta asks what a message is for, to set a price. ACMA asks what its purpose is, to decide whether consent and an unsubscribe link were required. A template can pass one test and fail the other.
Discover the power of WhatsApp with SleekFlow!
Unleash your full potential with WhatsApp Business API. Your customers are waiting!
What ACMA enforcement actually looks like
Every figure below comes from ACMA's own newsroom, not a secondary summary.
Tabcorp (TAB): $4,003,270 for SMS and WhatsApp, 17 June 2025
ACMA's determination covers conduct between February and May 2024: messages sent without an unsubscribe option, without adequate sender information, and 11 sent without consent.
Tabcorp (TAB): $2.7m+ for email and SMS, 22 July 2026
ACMA found 217,000 messages sent over 16 days to customers who'd unsubscribed from that specific channel. TAB self-reported the breach.
PointsBet: $500,800, 17 June 2025
ACMA's release doesn't detail the channel for this one. It was reported in the same quarterly enforcement round as the first TAB penalty, for breaching spam rules.
The conduct behind the first TAB penalty happened in 2024; ACMA published the finding and penalty on 17 June 2025.
A pre-send checklist for ANZ messaging
Confirm consent is expressed or inferred, and documented, before the first message goes out.
If consent was withdrawn from one channel, suppress that channel specifically. Don't treat it as withdrawal from everything, and don't leave it active because the customer record still shows "opted in" elsewhere.
Every message includes an accurate sender name and contact details, not just a business account name.
Every message includes a working, no-login opt-out, honoured within 5 business days.
If a message mixes a factual update with any promotional content, treat the whole message as a commercial electronic message.
Don't rely on a Meta Utility template approval as proof of Spam Act compliance. Assess the message's purpose separately, on Australian rules.
How Australia compares to New Zealand
New Zealand's Unsolicited Electronic Messages Act 2007 was modelled directly on Australia's Spam Act, with the same three obligations and a near-identical unsubscribe window. The two aren't identical: New Zealand's version uses more general descriptions and fewer specific exceptions than Australia's, so a message that needs a carve-out under the Australian Act may not need one under New Zealand's.
A campaign built to Australian rules will clear New Zealand's obligations on consent, identification and unsubscribe without much rework. The gap to check is New Zealand's narrower set of exceptions: don't assume an Australian carve-out (a specific exemption, a designated commercial electronic message) automatically applies across the Tasman without checking the New Zealand Act directly.
Want to outcompete your peers with SleekFlow's help?
Book your personalised demo with SleekFlow today and unlock the potential of seamless communication
