Marketing to test-drivers and enquirers: the Spam Act rules for car dealers
When you re-contact a test-driver or an enquirer with a marketing email or SMS, two laws apply at once. APP 7 of the Privacy Act governs whether you may use their personal information for direct marketing at all. The Spam Act 2003 governs the message itself: you need consent, every message must identify you, and every message must carry a working unsubscribe you action within 5 business days. You have to satisfy both.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Two laws, two jobs
- APP 7 (Privacy Act) governs whether you may use a customer's personal information for direct marketing. Broadly, you can if you collected the information from them, they would reasonably expect it, and you give an easy way to opt out. Your collection notice at the test drive or enquiry is where you set that reasonable expectation.
- The Spam Act 2003 (Cth), regulated by ACMA, governs the commercial electronic message itself, the actual email, SMS or MMS. It is a separate regime from the Privacy Act.
Getting one right does not excuse the other: a compliant unsubscribe link does not fix using data you were not allowed to market to, and permission to market does not fix a message with no unsubscribe.
What the Spam Act requires for every message
ACMA frames the Spam Act as three rules for every commercial electronic message:
- Consent. You need the recipient's consent, which can be express (they opted in) or inferred from an existing relationship where marketing is a reasonable expectation. A test drive alone is not a blanket opt-in to ongoing marketing; set the expectation clearly at collection.
- Identify yourself. Every message must clearly identify your dealership and include contact details.
- Unsubscribe. Every message must contain a functional unsubscribe facility. You must action an unsubscribe request within 5 business days (Spam Act 2003 (Cth)), and the unsubscribe facility must stay functional for at least 30 days after the message is sent (Spam Act 2003 (Cth) s 18).
The Spam Act covers email, SMS, MMS and instant messaging. Voice telemarketing calls sit under the separate Do Not Call Register regime.
How APP 7 and the Spam Act fit together
APP 7.8 is the join: APP 7 does not apply to the extent that the Spam Act applies. So for the sending of a marketing email or SMS, the Spam Act's consent, identification and unsubscribe rules do the work. But APP 7 still governs whether you were allowed to use that personal information for marketing in the first place, and the person's right to opt out of direct marketing generally and to ask where you got their details. In practice you comply with the Spam Act for the message and APP 7 for the data behind it.
The practical rule for a dealership
Set it up at the point of collection. When someone takes a test drive or enquires, your collection notice is where you tell them you may send offers and updates, and offer the opt-out. Then keep a clean record of consent, make sure every marketing message names your dealership and carries a working unsubscribe, and process opt-outs within 5 business days across your whole system, not just one list. Read: the collection notice a dealership needs
Common questions
Someone test-drove a car. Can we add them to our marketing list?
Only if you have a basis. A test drive alone is not a blanket opt-in. Set the expectation at collection (your notice), rely on consent or a genuine inferred-consent basis, and always give an easy opt-out. If you cannot point to how you got consent for a contact, that contact is a risk.
How fast do we have to honour an unsubscribe?
Within 5 business days (Spam Act 2003 (Cth)). After that, that person must not receive further marketing from you unless they opt back in. The unsubscribe must also be easy, and must not force them to log in or hand over extra information.
Are marketing phone calls covered by the Spam Act?
No. The Spam Act covers email, SMS, MMS and instant messaging. Voice telemarketing calls fall under the Do Not Call Register regime and separate rules.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. The Spam Act 2003 (Cth) is administered by ACMA and is separate from the Privacy Act. Privaproof's car-dealer documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.