Spam Act Compliance for Professional Services Email Marketing: Consent, Unsubscribe & What 'Inferred Consent' Actually Covers

26 August 2026·5 min read

Quick answer: Under the Spam Act 2003, every commercial email needs three things: consent (express, or reasonably inferred from an existing business relationship), clear sender identification, and a working unsubscribe you actually action. "Inferred consent" isn't a loophole for cold-emailing your whole database — it only stretches to people you have a genuine, current relationship with, and it fades over time. Below is a consent-audit checklist, an email footer template, and how this plays out for real professional-services sending. ✨

Almost every professional services business has an email list that's grown a bit... organically — old client emails, enquiry-form sign-ups, business cards from a networking night three years ago. Sending to all of it the same way is exactly where Spam Act problems start. Here's what the rules actually say, and how to get your list genuinely compliant without gutting your audience. 💖

What most firms get wrong

Treating a business card as an opt-in to an ongoing newsletter — a single professional exchange usually isn't enough on its own.
Never testing their own unsubscribe link — plenty are broken, slow, or require an email reply nobody ever answers.
No clear sender name or business identity in the footer, just a generic "info@" address.
Assuming inferred consent lasts forever rather than fading once the relationship goes cold.
Buying or scraping lists and emailing them cold, then being surprised at the complaint rate.

The consent-audit checklist + footer template

Run every segment of your list through this before your next send:

1. Where did this contact come from? (Express opt-in / active client relationship / one-off enquiry / business card / purchased list)
2. Did they take an action implying they'd expect ongoing emails from us? (Subscribed to a newsletter = yes. Asked one question once = no.)
3. Is the relationship still current, or has it gone stale?
4. Does this send clearly identify us as the sender, with a real business name?
5. Is there a working, one-click unsubscribe, actioned promptly and kept on a suppression list?

Footer template: "You're receiving this because [you're a client of / you enquired with / you subscribed to] [Business Name]. [Business Name], [suburb/state]. Unsubscribe at any time."

Three worked examples

Same three tests, different lists. 📈

Accounting firm client newsletter: sending quarterly tax updates to current and recent clients generally sits on reasonably inferred consent — there's an active, ongoing relationship. It still needs a clear sender name and a genuine unsubscribe on every send, and anyone who unsubscribes needs to actually stop receiving it.

Financial planner nurturing new enquiries: someone who books a discovery call or downloads a guide has usually given clear, express consent for related follow-up. Someone who emailed once with a general question hasn't — adding them to an ongoing marketing sequence off the back of that single email is the grey area to avoid.

Real estate agent emailing their database: past vendors and buyers from five years ago are the classic "has this gone stale" case. The relationship was genuine once, but inferred consent weakens over time — a periodic re-permission campaign ("still want market updates from us?") is the safer way to keep an older database active.

How the three pillars actually work together

Consent is either express (someone actively opted in — a form checkbox, a signed engagement, a newsletter sign-up) or reasonably inferred from an existing, genuine business relationship. Inferred consent is narrower than most people assume — it generally covers content related to that relationship, not an unrelated pitch. Sender identification means the recipient can tell, clearly, who's actually sending the email and how to contact that business. Unsubscribe means a functioning, low-friction opt-out that you honour within a reasonable time — not a mailto link that dead-ends, and not a form that still lets someone slip through next campaign.

💡 Heads up: inferred consent isn't permanent — a contact you haven't engaged with in years is a much weaker claim to "reasonable inference" than one you spoke with last month. If a chunk of your list is old and cold, a short re-permission campaign is worth more than the risk of sending to it blind.

Mistakes to avoid

Adding every enquiry to your main newsletter by default, regardless of what they actually asked for.
Letting unsubscribes sit in an inbox instead of an automated suppression list.
Using a no-reply address with no real business identity attached to it.
Assuming a purchased or scraped list is ever a safe starting point — it generally isn't.
Never reviewing an old database for contacts the relationship has genuinely lapsed with.

Please note: this is general information, not legal advice — how consent and inferred consent apply to your specific lists depends on your circumstances. Check current guidance from the Australian Communications and Media Authority (ACMA) or have a solicitor review your email practices before relying on this.

Frequently asked questions

What's the real difference between express and inferred consent?

Express consent is a clear, active yes — a checkbox, a sign-up form, a verbal or written agreement. Inferred consent is a reasonable assumption based on an existing relationship and what a person would expect, given the context — it's real, but it's narrower and easier to get wrong than express consent, so treat it as the fallback, not the default.

Can I email someone who just gave me their business card at a networking event?

Honestly, it's a grey area — a card exchange alone is thin grounds for an ongoing marketing sequence, though it may support a single relevant follow-up. If you want them on your list properly, it's worth getting an explicit yes rather than assuming the card implied one.

How long does inferred consent actually last?

There's no fixed use-by date, which is the honest limit of this whole area — it's a judgement call based on how recent and active the relationship is. As a practical habit, treat contacts you haven't engaged in over a year or two as ones to re-confirm rather than keep assuming.

What actually happens if I get this wrong?

Complaints can be made to ACMA, and repeated or serious non-compliance can carry penalties — but for most professional services businesses, the bigger everyday cost is reputational: being marked as spam or losing trust with the exact people you want as clients. Getting consent right is as much a trust move as a compliance one. 🌴

Keep reading 🤍

Written by

Kate, founder of Chronically Online

I help Gold Coast and Brisbane businesses grow with branding, websites and marketing that actually works.

Work with me ✦