Business-to-business cold email is lawful in Australia under the Spam Act 2003, subject to consent, identification and unsubscribe requirements. Australia deserves particular care for one reason: the regulator enforces actively and has issued substantial penalties to well-known companies, including for unsubscribe failures rather than for sending as such.
Express or inferred. Inferred consent can arise from an existing business relationship, or where a work-related address is conspicuously published without a statement declining unsolicited messages — and your message relates to that role.
The message must clearly identify the sender and include accurate contact details that remain valid.
A functional opt-out in every commercial message, honoured within the period the Act specifies. This is where enforcement most often bites.
The Spam Act prohibits supplying, acquiring or using address-harvesting software and harvested-address lists. This makes list provenance a legal question in Australia, not merely a deliverability one. A purchased list whose origin the seller cannot document is a compliance risk regardless of how well the campaign is run.
Beyond the Spam Act, the Privacy Act 1988 and its Australian Privacy Principles govern personal information, which includes named business email addresses that identify an individual.
The principle that most often surprises people is purpose limitation: personal information collected for one purpose generally cannot be used for an unrelated one. An address published so customers can request a quote was not published so that vendors could build a prospecting database — and repurposing it that way is exactly the tension the APPs are concerned with.
Yes. The Act covers commercial electronic messages generally, and does not exempt business-to-business communication. The consent, identification and unsubscribe requirements apply whether you are writing to a consumer or to a company.
Broadly, an existing business relationship, or a work-related address conspicuously published without any statement declining unsolicited messages, where your message relates to that person's role. It is narrower than it sounds: relevance to the role is doing real work in that test, and a published address does not imply consent to receive anything at all.
The Act sets a specific short period, and this is the requirement regulators have most visibly enforced. The safe practice is to process opt-outs immediately and automatically, and to maintain a single suppression list across every campaign rather than per-campaign settings.
The small business exemption applies to parts of the Privacy Act, not the Spam Act — so the consent, identification and unsubscribe rules apply to you regardless of size. The Privacy Act exemption itself has conditions and exceptions that catch more businesses than people expect, so it is worth checking rather than assuming.
The Cold Outreach Machine finds the companies you sell to, writes a different email for each one, and sends them on its own — paced, inside working hours. US$299.99, paid once, live setup call included.