Does an open-home sign-in give us consent to text or email them?

Not by itself. A sign-in is collected so you know who entered a property you are responsible for. Consent to receive marketing is a different thing, and it has to be given for that. Two specific misunderstandings to clear: A collection-notice line is not consent. Saying "we may send you property updates" in the notice tells people what you might do. The Spam Act asks whether they agreed to receive commercial electronic messages, and notification is not agreement. There is no bulk exemption. People reach for "it was only a handful of people" or "I sent them individually". The Spam Act has no bulk threshold : one unsolicited commercial electronic message to one person is enough. Sending the same text one at a time is the same contravention, retail.

Can we text or email the people who signed in at our open home?

Q: What counts as consent for an appraisal text or a newsletter?

Consent under the Spam Act is either express or, in limited circumstances, inferred . Express is the clean route and the one to build for: the person actively agreed to receive messages of that kind. A ticked box that is not pre-ticked, a written "yes, send me appraisal and market updates" on the sign-in, or a reply of START to a clearly explained opt-in. Record what they agreed to, when, and how, because consent you cannot evidence is consent you do not have in practice. Inferred consent is narrower than agencies assume. It can arise from a conspicuously published work address where the message is relevant to that person's role, or from an existing business relationship where messages of that kind are a reasonable expectation. Attending an open home is not an existing business relationship, and a residential mobile number handed over for entry is not a conspicuously published business address. Inferred consent also weakens over time; it is not permanent. The release-the-reader point: where a person is genuinely your existing client , for example a vendor you are currently acting for or a landlord you manage for, messages about that engagement are not marketing at all, and updates

Only where you have Spam Act consent for that message, and a sign-in sheet almost never supplies it. Signing in to enter a property is consent to enter, not consent to be marketed to. Texts and emails are the same question in law: both are commercial electronic messages, so APP 6.7 hands direct marketing to APP 7, and APP 7.8 then displaces APP 7 to the extent the Spam Act 2003 applies. There is no bulk threshold, so a single text or a single newsletter is enough to contravene, and a line in your collection notice is not consent.

By Jon Oates, Founder of Privaproof · Last updated 27 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (from 1 July 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Note that the Spam Act applies to your messages whether or not the Privacy Act binds your business, so a smaller agency does not escape this one on turnover.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Which law actually governs the message?

Three layers, and getting the order right is what makes the answer usable.

1. APP 6 does not apply. Under APP 6.7, APP 6 does not cover use or disclosure by an organisation for the purpose of direct marketing, because APP 7 covers it. 2. APP 7 is then displaced for the message itself. Under APP 7.8, APP 7 does not apply to the extent the Spam Act 2003 applies, and the Spam Act applies to every commercial electronic message, which includes both SMS and email. The channel does not change the answer. 3. So the Spam Act is the operative law for the text. APP 7 continues to govern the data behind it, and APP 7.6 rights survive: a person can ask you to stop marketing, ask you not to facilitate others' marketing, and ask you to identify the source of their information, which you generally must tell them free of charge.

Sources: Privacy Act 1988 (Cth), APP 6.7, APP 7, APP 7.6 and APP 7.8 (Schedule 1); Spam Act 2003 (Cth) · OAIC APP Guidelines chapters 6 and 7 · ACMA spam rules · See also direct marketing, APP 7 and the Spam Act

Not by itself. A sign-in is collected so you know who entered a property you are responsible for. Consent to receive marketing is a different thing, and it has to be given for that.

Two specific misunderstandings to clear:

A collection-notice line is not consent. Saying "we may send you property updates" in the notice tells people what you might do. The Spam Act asks whether they agreed to receive commercial electronic messages, and notification is not agreement.
There is no bulk exemption. People reach for "it was only a handful of people" or "I sent them individually". The Spam Act has no bulk threshold: one unsolicited commercial electronic message to one person is enough. Sending the same text one at a time is the same contravention, retail.

Sources: Spam Act 2003 (Cth); Privacy Act 1988 (Cth), APP 5 (Schedule 1) · ACMA spam rules

Consent under the Spam Act is either express or, in limited circumstances, inferred.

Express is the clean route and the one to build for: the person actively agreed to receive messages of that kind. A ticked box that is not pre-ticked, a written "yes, send me appraisal and market updates" on the sign-in, or a reply of START to a clearly explained opt-in. Record what they agreed to, when, and how, because consent you cannot evidence is consent you do not have in practice.

Inferred consent is narrower than agencies assume. It can arise from a conspicuously published work address where the message is relevant to that person's role, or from an existing business relationship where messages of that kind are a reasonable expectation. Attending an open home is not an existing business relationship, and a residential mobile number handed over for entry is not a conspicuously published business address. Inferred consent also weakens over time; it is not permanent.

The release-the-reader point: where a person is genuinely your existing client, for example a vendor you are currently acting for or a landlord you manage for, messages about that engagement are not marketing at all, and updates of a kind they would reasonably expect can rest on inferred consent. The problem is the open-home attendee you have no relationship with, not your actual client base.

Sources: Spam Act 2003 (Cth) · ACMA spam rules

What must every marketing text or email contain?

Three things, and they apply to each message rather than to the campaign. They are identical for an SMS and for an email, which is why one list and one consent record can serve both.

Consent, as above.
Accurate sender identification. The message must clearly identify your business and include contact details that remain accurate for at least 30 days after sending.
A functional unsubscribe. It must be low cost, must not require the person to log in, create an account or supply extra personal information, must stay functional for at least 30 days, and you must action an unsubscribe request within 5 business days.

Then honour the opt-out across every system, not just the platform they replied to. The common failure is a person unsubscribing from the newsletter and continuing to receive SMS from the CRM because nobody joined the two lists.

Sources: Spam Act 2003 (Cth) · ACMA spam rules

What should we do instead with open-home numbers and addresses?

Use them for the thing you collected them for, and build consent separately and honestly.

Follow up about that property and that enquiry. That is the purpose the number was given for, and it is not marketing of the kind the Spam Act is aimed at.
Ask for marketing consent at the point of sign-in, as a clearly separate and optional tick, worded for what you will actually send. A visitor who wants your market updates will say yes, and then you have a defensible list rather than a risky one.
Where you want to reach a property owner about an appraisal and you have no consent, that is a call, not a text or an email, and calls are governed by the Do Not Call Register Act with their own washing requirement.

Sources: Privacy Act 1988 (Cth), APP 3.2, APP 5 and APP 7 (Schedule 1); Spam Act 2003 (Cth); Do Not Call Register Act 2006 (Cth) · ACMA spam rules · ACMA Do Not Call Register · See also can you cold-call property owners

→ The free 2-minute audit checks where your agency's marketing consent actually comes from, which is usually the gap.