The ACMA has issued a statement about its expectations for using consent to conduct e-marketing and telemarketing

The 1 July 2024 statement Consumer consent: expectations for businesses conducting telemarketing and e-marketing (Statement) issued by the Australian Communications and Media Authority (ACMA), the regulator of the Spam Act 2003 and Do Not Recall Register Act 2006, is a guide to better practice and, while not legal advice, provides helpful information about how businesses can ensure that they have adequate consent to engage in e-marketing and telemarketing activities.

What consent requirements apply?

If sending an e-marketing message, you must have the recipient’s consent before the message is sent to the consumer.

If making a telemarketing call and calling a number listed on the Do Not Call Register, you must have the call recipient’s consent to do so.

Consent

Consent may be express or inferred.

• Express consent is where a consumer has explicitly and freely consented to receiving an e-marketing message, or telemarketing call.
• Inferred consent, on the other hand, is inferred on the basis of a consumer’s existing relationship with your business and the type of product or service being marketed.

The ACMA considers that obtaining express consent is best because it is a clear, unambiguous choice made by the consumer.

If you outsource your e-marketing or telemarketing activities, you remain responsible for ensuring that you have reliable and well-maintained records of consent, and that your outsourced service provider does too. The records should include the method used to provide consent, the terms of the consent and the date/time the consent was obtained.

Should the ACMA receive complaints about marketing activities occurring without consent, the ACMA can require you to produce your consent records.

Guidance

The Statement includes examples of practices that the ACMA considers are ‘consumer friendly’ and which meet compliance obligations under the Spam Act and Do Not Call Register Act and some practices which should be avoided and are non-compliant.

Consumer friendly practices

• Obtain express consent – the consent terms and conditions must be expressed clearly and available to consumers when consent is obtained. The practice of having consent terms and conditions which are “hidden away in fine print, or in lengthy privacy policies or that require multiple click-throughs to find” is not sufficient. This is a view which has also been reiterated by both the Australian Consumer and Competition Commission¹ and the Office of the Australian Information Commissioner².
• Consent terms and conditions should address:
  • what the consent is for (eg the types of products/services and marketing channels, such as email, SMS and/or phone);
  • who will be relying on the consent (eg your business, its partners and/or affiliates);
  • the length of the consent period; and
  • the process for withdrawing consent.
• Consider using a double opt-in when obtaining consent – the ACMA example includes sending the individual “an email confirmation that consent has been given, possibly with the confirmatory email providing a click-through link or other reference to a ‘manage user preferences’ page”.
• Exercise caution when relying on inferred consent. If you wish to rely on inferred consent, you need to consider the following:
  • Is there a clear, current or ongoing relationship with the individual?
  • Are the products or services being promoted directly related to the ongoing relationship?
    If the answer to these questions is “no’’, you should not be relying on having inferred consent.
• If a recipient of a telemarketing call indicates that they want the call to stop (in any way), terminate the call immediately.
• Ensure all unsubscribe facilities in all commercial electronic messages are easy to use.
• If a person requests to be removed from a call or marketing list, ensure that this occurs within a maximum of 5 business days.
• If an individual wants to unsubscribe, provide an option which is straightforward and enables them to unsubscribe from all marketing messages (not just some types of messages).

Consumer unfriendly practices

The following practices do not meet the ACMA’s expectations and are likely to cause consumer frustration:

• Consumer contact details should not be added to marketing lists or marketing databases without their consent. The ACMA considers that consent to be added to a marketing list or database is not sufficient if a consumer simply visits a business’ website or sends the business an email.
• Do not rely on ‘old’ consent (if a consumer would not expect the consent to still be valid). In particular, the ACMA notes that a consumer’s telemarketing consent is only valid for 3 months (at which point it becomes ‘stale’ unless, under the consent terms and conditions, the consumer has agreed to a longer period).
• Consumers must not be required to log-in to accounts or provide personal information in order to unsubscribe unless they are logging-in to the electronic address that the message was sent to or the consumer otherwise agreed to terms and conditions in which it was stated clearly that the consumer would be required to log-in to unsubscribe.
• Consent must not be inferred if the relationship with the consumer is unclear or the message is not relevant to the consumer’s relationship with the business. An example provided by the ACMA is where a bank contacts a current savings account customer for the purpose of advertising insurance products.
• Consent should not be inferred from one-off purchases by consumers (for example if a consumer provides their phone number or email address so that they may be sent a receipt).
• Messages must not be sent purely because the email address or phone number has been published (this does not mean the individual has consented and various other conditions must first be met before they can be sent a marketing message).
• Pre-checked tick boxes on forms seeking consent must not be used.
• Bundled consent must not be used – the ACMA notes that “bundled consent is where a single request for consent is to be used for multiple purposes that does not allow a choice about each purpose”.
• Refer-a-friend arrangements should not be used (consent needs to be provided by the person who will be receiving the call or message).
• Consumers must not be charged to unsubscribe (except for the normal cost of a message such as a SMS).
• An unsubscribe facility in a message that only allows a consumer to unsubscribe from some types of marketing messages from the business must not be provided unless an option to unsubscribe from all types of marketing messages is also provided.
• Never reach out to consumers who have unsubscribed previously with the intention of getting them to re-subscribe unless they have consented to this contact.

Take Home Points

The costs of not holding adequate consent when engaging in marketing activities (and failing to maintain/update records of consent) can be substantial. In May 2024, Pizza Hut Australia was required to pay a $2.5 million penalty for sending texts and emails over a four month period which:

• did not include an option to unsubscribe; or
• were sent to customers who had not provided consent or had withdrawn their consent³.

Don’t find yourself in the same position – review your consent processes now. We recommend you:

A. review your marketing database to check the basis on which you hold consent.

B. check that your marketing database records the date and time when:

• consent was obtained; and
• unsubscribe requests were received.

C. check your unsubscribe processes to ensure:

• clear instructions on how to unsubscribe are included in all marketing messages;
• unsubscribe requests are actioned promptly (within 5 working days); and
• those people who have unsubscribed are segmented separately in your database.

If you have any questions regarding your marketing activities, please contact Cate Sendall.