What does APP 7 allow, and when do you need consent?

APP 7 starts from a prohibition: an organisation must not use or disclose personal information it holds for the purpose of direct marketing, unless an exception applies. The two exceptions that matter for agencies turn on where you got the information . You collected it directly from the person (APP 7.2). You can use it for direct marketing if the individual would reasonably expect you to use it that way, and you give a simple means to opt out, and they haven't opted out. This is the common case for a vendor, landlord or applicant who dealt with you directly, especially where your collection notice flagged that you'd send them updates. You collected it from a third party, or the person wouldn't reasonably expect it (APP 7.3). Here you need the individual's consent (or it must be impracticable to get consent), you must give a simple opt-out, and each marketing message must prominently draw attention to the opt-out. A cold list bought from a data broker sits here. APP 7 also gives the person two standing rights: they can ask you to stop marketing to them (you must comply within a reasonable period, free of charge), and under APP 7.6 they can ask you where you got their information, w

Can a real-estate agency market to past clients and leads by email or SMS, and what do the privacy rules require?

Q: What does the Spam Act 2003 require for every marketing email or SMS?

The Spam Act sets three rules for every commercial electronic message , any email, SMS, MMS or instant message that offers, advertises or promotes goods, services or property. ACMA frames them as consent, identify, and unsubscribe. Consent. You must have the recipient's consent to send. Consent can be express (they ticked a box, gave you their address to be contacted) or inferred from an existing business relationship and their conduct, but inferred consent is not unlimited and cannot be assumed from a one-off transaction forever. Identify yourself. The message must clearly and accurately identify the agency or person who sent it or authorised it, and include contact details that stay accurate for at least 30 days after sending. Unsubscribe. Every message must contain a functional unsubscribe facility. It must be low-cost, must not require the person to log in, create an account, or hand over extra personal information. You must action any unsubscribe request within 5 business days, and the facility must stay functional for at least 30 days after the message is sent. The Spam Act covers email, SMS, MMS and instant messaging. It does not cover voice telemarketing calls or faxes; tho

Usually yes, but two laws stack. APP 7 of the Privacy Act governs whether you can use someone's personal information for direct marketing, generally allowed if you collected it from them, they'd reasonably expect it, and you offer an easy opt-out. The Spam Act 2003 governs the email or SMS itself: you need consent, every message must identify you, and every message must carry a working unsubscribe you action within 5 business days.

By Jon Oates, Founder of Privaproof · Last updated 22 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Can you email or text past clients and leads for marketing?

In most cases yes, but you have to satisfy two different rules at once, because two different laws apply to the same message. The Privacy Act's Australian Privacy Principle 7 (APP 7) governs whether you may use a person's personal information for direct marketing at all. The Spam Act 2003 (Cth), regulated by ACMA, governs the commercial electronic message itself, the actual email, SMS, MMS or instant message you send. You need to clear both. Getting APP 7 right does not excuse a message that breaches the Spam Act, and a technically compliant unsubscribe link does not fix using data you were never allowed to market to.

APP 7 starts from a prohibition: an organisation must not use or disclose personal information it holds for the purpose of direct marketing, unless an exception applies. The two exceptions that matter for agencies turn on where you got the information.

You collected it directly from the person (APP 7.2). You can use it for direct marketing if the individual would reasonably expect you to use it that way, and you give a simple means to opt out, and they haven't opted out. This is the common case for a vendor, landlord or applicant who dealt with you directly, especially where your collection notice flagged that you'd send them updates.
You collected it from a third party, or the person wouldn't reasonably expect it (APP 7.3). Here you need the individual's consent (or it must be impracticable to get consent), you must give a simple opt-out, and each marketing message must prominently draw attention to the opt-out. A cold list bought from a data broker sits here.

APP 7 also gives the person two standing rights: they can ask you to stop marketing to them (you must comply within a reasonable period, free of charge), and under APP 7.6 they can ask you where you got their information, which you generally must tell them.

What does the Spam Act 2003 require for every marketing email or SMS?

The Spam Act sets three rules for every commercial electronic message, any email, SMS, MMS or instant message that offers, advertises or promotes goods, services or property. ACMA frames them as consent, identify, and unsubscribe.

Consent. You must have the recipient's consent to send. Consent can be express (they ticked a box, gave you their address to be contacted) or inferred from an existing business relationship and their conduct, but inferred consent is not unlimited and cannot be assumed from a one-off transaction forever.
Identify yourself. The message must clearly and accurately identify the agency or person who sent it or authorised it, and include contact details that stay accurate for at least 30 days after sending.
Unsubscribe. Every message must contain a functional unsubscribe facility. It must be low-cost, must not require the person to log in, create an account, or hand over extra personal information. You must action any unsubscribe request within 5 business days, and the facility must stay functional for at least 30 days after the message is sent.

The Spam Act covers email, SMS, MMS and instant messaging. It does not cover voice telemarketing calls or faxes; those sit under the Do Not Call Register Act 2006 and separate telemarketing rules.

Consent under the Spam Act is broader than a ticked box, but narrower than agents often assume. Express consent is where someone directly agrees to receive marketing, an opt-in checkbox, or giving you their details on the clear basis you'll send updates. Inferred consent can arise from an existing business relationship where marketing is a reasonable expectation, but it has limits: it does not flow automatically from every past contact, it can weaken over time, and simply publishing an email address (or scraping one) is not consent if that address is published with a no-marketing notice. If you can't point to how you got consent for a given contact, that contact is a risk.

How do APP 7 and the Spam Act fit together?

They overlay rather than duplicate, and APP 7.8 is the join. APP 7.8 says APP 7 does not apply to the extent that the Spam Act 2003 or the Do Not Call Register Act 2006 applies. So for the sending of a marketing email or SMS, the Spam Act's consent, identification and unsubscribe rules do the work. But APP 7 still governs everything the Spam Act doesn't reach: whether you were allowed to use that personal information for marketing at all, the individual's right to opt out of direct marketing generally, and their right under APP 7.6 to ask where you got their details. In practice you comply with the Spam Act for the message and with APP 7 for the data behind it.

Layer	Which law	What it governs
The data	APP 7 (Privacy Act)	Whether you may use the personal information for direct marketing; source-request and opt-out rights
The message	Spam Act 2003	Consent to send, sender identification, working unsubscribe (5 business days / 30 days)
Voice calls	Do Not Call Register Act 2006	Telemarketing calls and faxes (not covered by the Spam Act)

What does this look like for a real-estate agency in practice?

The safest position is built at the point of collection, not the point of sending. When a vendor lists with you, a buyer enquires, a landlord onboards, or an applicant submits a rental application, your collection notice is where you set the "reasonable expectation" that lets APP 7.2 apply later, say plainly that you may send market updates, appraisals or listings, and offer the opt-out. Then keep a clean record of consent per contact, make sure every marketing email and SMS names your agency and carries a working one-tap unsubscribe, and process opt-outs within 5 business days across your whole system, not just the one list. For how the collection notice does this groundwork, see collection notices for real estate agencies and privacy policy vs collection notice. For the full picture, see the 2026 real-estate privacy guide.

Common questions

Can I email past clients I haven't dealt with in years?

Only if you can still stand behind consent. Inferred consent from an old, one-off transaction weakens over time and isn't open-ended. If you can't show how or when you got consent for that contact, treat re-marketing to them as a risk and consider a genuine opt-in first.

Do I need an unsubscribe link on an SMS too?

Yes. The Spam Act's unsubscribe rule applies to every commercial electronic message, SMS and MMS as well as email. It must be functional, easy, and stay working for at least 30 days after you send.

How fast do I have to action an unsubscribe?

Within 5 business days. After that the person must not receive further marketing messages from you, and the unsubscribe must not have required them to log in, create an account, or provide extra personal information.

Both, in their lanes. The Spam Act governs the message (consent, your identity, unsubscribe); APP 7 governs whether you were allowed to use those contacts' personal information for marketing and their right to opt out and ask for the source. You comply with both.

Are phone marketing calls covered by the Spam Act?

No. The Spam Act covers email, SMS, MMS and instant messaging. Voice telemarketing calls and faxes fall under the Do Not Call Register Act 2006 and separate telemarketing rules.

How Privaproof helps

The Privaproof Kit includes collection notices and privacy wording written for the specific ways real-estate agencies collect and later market to contacts, setting up the APP 7.2 "reasonable expectation" at collection and pointing to the opt-out, and it's kept current as the rules change. They're templates you tailor to your agency: privacy tools and general information, not legal advice.

See where your agency stands: free 2-minute self-audit →

This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: ACMA: Avoid sending spam; OAIC: APP 7 direct marketing guidelines; Spam Act 2003 (Cth); Do Not Call Register Act 2006 (Cth).