Can a real-estate agency market to past clients and leads by email or SMS, and what do the privacy rules require?
Usually yes, but two laws govern the same campaign. APP 7 of the Privacy Act governs whether you can use someone's personal information for direct marketing: allowed under APP 7.2 if you collected it from them, they would reasonably expect it, you give a simple means to opt out, and they have not opted out. The Spam Act 2003 governs the email or SMS itself: you need consent, every message must identify you, and every message must carry a working unsubscribe, with a withdrawal of consent taking effect at the end of 5 business days.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Can you email or text past clients and leads for marketing?
In most cases yes, but you have to satisfy two different rules at once, because two different laws apply to the same message. The Privacy Act's Australian Privacy Principle 7 (APP 7) governs whether you may use a person's personal information for direct marketing at all. The Spam Act 2003 (Cth), regulated by ACMA, governs the commercial electronic message itself, the actual email, SMS, MMS or instant message you send. You need to clear both. Getting APP 7 right does not excuse a message that breaches the Spam Act, and a technically compliant unsubscribe link does not fix using data you were never allowed to market to.
What does APP 7 allow, and when do you need consent?
APP 7 starts from a prohibition: an organisation must not use or disclose personal information it holds for the purpose of direct marketing, unless an exception applies. The two exceptions that matter for agencies turn on where you got the information.
- You collected it directly from the person (APP 7.2). For personal information other than sensitive information, you can use it for direct marketing if the individual would reasonably expect it, you give a simple means to opt out, and they haven't opted out. Sensitive information always needs consent (APP 7.4). This is the common case for a vendor, landlord or applicant who dealt with you directly, especially where your collection notice flagged that you'd send them updates.
- You collected it from a third party, or the person wouldn't reasonably expect it (APP 7.3). For non-sensitive information you need the individual's consent (or it must be impracticable to obtain), a simple opt-out, and each marketing message must carry a prominent statement of that right or otherwise draw attention to it. A cold list bought from a data broker sits here, and the OAIC says inconvenience, time or cost alone does not make consent impracticable (para 7.24).
APP 7 also gives the person standing rights whichever exception you relied on (APP 7.6): to stop your marketing, to stop you passing their information on for other organisations' marketing, and to be told your source. Under APP 7.7 you cannot charge for any of it, you must give effect to a stop request within a reasonable period (the OAIC says generally no more than 30 days, para 7.37), and you must notify your source unless it is impracticable or unreasonable.
What does the Spam Act 2003 require for every marketing email or SMS?
The Spam Act sets three rules for every commercial electronic message: any email, SMS, MMS or instant message where a purpose is to offer, advertise or promote goods or services, or land or an interest in land (s 6(1)), which catches a listing alert, an appraisal offer and an open-home invitation. ACMA frames the rules as consent, identify, and unsubscribe.
- Consent. You must have the recipient's consent to send (s 16(2)). Consent means express consent, or consent reasonably inferred from the person's conduct and their business and other relationships with you (Sch 2 cl 2). Inferred consent is not unlimited and cannot be assumed from a one-off transaction forever.
- Identify yourself. The message must clearly and accurately identify the individual or organisation who authorised sending it, and include contact details reasonably likely to be valid for at least 30 days after the message is sent (s 17(1)).
- Unsubscribe. Every marketing message must contain a functional unsubscribe facility (s 18). The address must not sit behind a premium service, cost more than the usual cost of that channel, charge a fee, or require the person to log in, create an account, or hand over personal information other than the address you sent to (Spam Regulations 2021 s 7). A withdrawal of consent takes effect at the end of 5 business days (Sch 2 cl 6), and the address must stay capable of receiving unsubscribes for at least 30 days after the message is sent (s 18(1)(e)).
The Spam Act covers messages sent to an email, instant messaging or telephone account (s 5(1)). It does not cover voice calls on a standard telephone service (s 5(5)) or faxes (Spam Regulations 2021 s 6); those sit under the Do Not Call Register Act 2006. The consent, identification and unsubscribe rules are civil penalty provisions: for a body corporate with no prior record the Federal Court can order up to 100 penalty units for an unsolicited-message contravention and 50 for the others, capped at 2,000 penalty units for contraventions on a single day (ss 24, 25(3)).
What counts as consent under the Spam Act, express or inferred?
Consent under the Spam Act is broader than a ticked box, but narrower than agents often assume. Express consent is where someone directly agrees to receive marketing, an opt-in checkbox, or giving you their details on the clear basis you'll send updates. Inferred consent can arise from an existing business relationship where marketing is a reasonable expectation, but it does not flow automatically from every past contact and it weakens over time. Publishing is not consent: Sch 2 cl 4(1) says consent may not be inferred from the mere fact an address has been published, and the only exception (cl 4(2)) is a conspicuously published work-role address, carrying no no-marketing notice, where your message is relevant to that role. Using a list built with address-harvesting software is itself a contravention (s 22). If you can't point to how you got consent for a given contact, that contact is a risk.
How do APP 7 and the Spam Act fit together?
They do not simply stack, and APP 7.8 is the reason. APP 7.8 says APP 7 does not apply to the extent that the Spam Act 2003 or the Do Not Call Register Act 2006 applies, so for the sending of a marketing email or SMS the Spam Act's consent, identification and unsubscribe rules do the work. Neither the Act nor the OAIC's APP 7 guidelines spell out where "to the extent" stops. What is clear is that the Spam Act regulates messages, not whether you were entitled to use the information for marketing in the first place. So comply with the Spam Act for the message, and do not assume APP 7 has stopped applying to the data behind it.
| Layer | Which law | What it governs |
|---|---|---|
| The data | APP 7 (Privacy Act) | Whether you may use the personal information for direct marketing; opt-out and source-request rights (APP 7.6), subject to the APP 7.8 displacement |
| The message | Spam Act 2003 | Consent to send, sender identification, working unsubscribe; consent lapses 5 business days after withdrawal (Sch 2 cl 6); contact details valid 30 days (s 17(1)(d)) |
| Voice calls | Do Not Call Register Act 2006 | Telemarketing calls and faxes (not covered by the Spam Act) |
What does this look like for a real-estate agency in practice?
The safest position is built at the point of collection, not the point of sending. When a vendor lists with you, a buyer enquires, a landlord onboards, or an applicant submits a rental application, your collection notice is where you set the "reasonable expectation" that lets APP 7.2 apply later, say plainly that you may send market updates, appraisals or listings, and offer the opt-out. Then keep a clean record of consent per contact, make sure every marketing email and SMS names your agency and carries a working one-tap unsubscribe, and process opt-outs within 5 business days across your whole system, not just the one list. For how the collection notice does this groundwork, see collection notices for real estate agencies and privacy policy vs collection notice. For the full picture, see the 2026 real-estate privacy guide.
Common questions
Can I email past clients I haven't dealt with in years?
Only if you can still stand behind consent. Inferred consent from an old, one-off transaction weakens over time and isn't open-ended. If you can't show how or when you got consent for that contact, treat re-marketing to them as a risk and consider a genuine opt-in first.
Do I need an unsubscribe link on an SMS too?
Yes. The unsubscribe rule applies to any commercial electronic message that is not a designated commercial electronic message (s 18(1)(b)), so SMS and MMS as well as email. The address must be functional and stay capable of receiving unsubscribes for at least 30 days after you send (s 18(1)(e)).
When does an unsubscribe actually take effect?
The Spam Act does not set a deadline for you to action it. Sch 2 cl 6 fixes when the CONSENT lapses: a withdrawal takes effect at the end of 5 business days beginning on the day the unsubscribe message was sent, and after that a further marketing message is no longer covered by consent (s 16(1)). The unsubscribe must also not have required them to log in, create an account, or provide personal information other than the address you sent to (Spam Regulations 2021 s 7(6)).
Does APP 7 or the Spam Act apply to my email newsletter?
Both, in their lanes. The Spam Act governs the message (consent, your identity, unsubscribe). APP 7 governs whether you were allowed to use those contacts' personal information for marketing, plus the opt-out and source-request rights in APP 7.6, except to the extent APP 7.8 hands the subject to the Spam Act. Comply with both.
Are phone marketing calls covered by the Spam Act?
No. The Spam Act covers email, SMS, MMS and instant messaging. Voice telemarketing calls and marketing faxes fall under the Do Not Call Register Act 2006, which bars an unsolicited telemarketing call to a registered number (s 11(1)) unless the account-holder consented. Washing your list is a defence only if the number came back unregistered during the 30-day period ending at the end of the day of the call (s 11(3)). If you outsource the calling, s 12 requires the agreement itself to require compliance with the Act.
How Privaproof helps
The Privaproof Kit includes collection notices and privacy wording written for the specific ways real-estate agencies collect and later market to contacts, setting up the APP 7.2 "reasonable expectation" at collection and pointing to the opt-out, and it's kept current as the rules change. They're templates you tailor to your agency: privacy tools and general information, not legal advice.
See where your agency stands: free 2-minute self-audit →
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: ACMA: Avoid sending spam; OAIC: APP 7 direct marketing guidelines; Spam Act 2003 (Cth); Do Not Call Register Act 2006 (Cth).