Marketing to test-drivers and enquirers: the Spam Act rules for car dealers
When you re-contact a test-driver or an enquirer with a marketing email or SMS, two laws apply at once. APP 7 of the Privacy Act governs whether you may use their personal information for direct marketing at all. The Spam Act 2003 governs the message itself: you need consent, every message must accurately identify you, and every message must carry an unsubscribe facility that still works 30 days later (s 18(1)(e)). You have to satisfy both.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Two laws, two jobs
- APP 7 (Privacy Act) governs whether you may use a customer's personal information for direct marketing. The default in APP 7.1 is that you may not. APP 7.2 lifts it for non-sensitive information you collected from the individual, where they would reasonably expect that use, you give a simple way to opt out, and they have not already opted out. Your collection notice at the test drive or enquiry is where you set that reasonable expectation.
- The Spam Act 2003 (Cth), regulated by ACMA, governs the commercial electronic message itself, the actual email, SMS or MMS. It is a separate regime from the Privacy Act.
Getting one right does not excuse the other: a compliant unsubscribe link does not fix using data you were not allowed to market to, and permission to market does not fix a message with no unsubscribe.
What the Spam Act requires for every message
The Act itself sets three rules for every commercial electronic message with an Australian link, in sections 16, 17 and 18:
- Consent. Consent is express, or reasonably inferred from the person's conduct and their business and other relationships with you (Sch 2 cl 2). A test drive alone is not a blanket opt-in. Publication is not consent either: it may not be inferred from the mere fact that an address has been published (Sch 2 cl 4(1)), and the conspicuous-publication exception in cl 4(2) reaches work and role addresses only, for messages relevant to that role, never a private buyer's.
- Identify yourself. Every message must clearly and accurately identify who authorised it and carry accurate contact details, and those details must be reasonably likely to be valid for at least 30 days after the message is sent (s 17(1)(d)). Would the contact detail on your last campaign still reach a person today?
- Unsubscribe. Every message must contain a functional unsubscribe facility, and the unsubscribe address must be capable of receiving messages for at least 30 days after the message is sent (s 18(1)(e)). The Act sets no deadline for you to action a request. It instead withdraws the consent at the end of 5 business days beginning on the day the request was sent (Sch 2 cl 6), so five business days is the outside limit, not the standard.
An electronic message is one sent to an email, instant messaging or telephone account (s 5(1)), which is how email, SMS and MMS are caught. A voice call made using a standard telephone service is expressly excluded (s 5(5)) and sits under the Do Not Call Register Act 2006 instead.
How APP 7 and the Spam Act fit together
APP 7.8 is the join, and it is blunt: "This principle does not apply to the extent that any of the following apply ... (b) the Spam Act 2003". It switches off the whole of APP 7, not selected limbs, so for the sending of a marketing email or SMS the Spam Act's consent, identification and unsubscribe rules do the work. APP 7 runs wherever the Spam Act does not reach: a posted brochure, a marketing call, and the underlying decision to use a test-driver's details for marketing at all. That is where APP 7.6(e) bites, the customer's request that you name your source for their information, which APP 7.7(b) says you answer within a reasonable period unless it is impracticable or unreasonable.
The practical rule for a dealership
Set it up at the point of collection. When someone takes a test drive or enquires, your collection notice is where you tell them you may send offers and updates, and offer the opt-out. Then keep a clean record of consent, make sure every marketing message names your dealership and carries a working unsubscribe, and push opt-outs across your whole system rather than one list, well inside the five business days for which consent survives under Sch 2 cl 6. Read: the collection notice a dealership needs
Common questions
Someone test-drove a car. Can we add them to our marketing list?
Only if you have a basis. A test drive alone is not a blanket opt-in. Set the expectation in your collection notice, rely on express consent or consent reasonably inferred from the person's conduct and business relationship with you (Sch 2 cl 2), and always give an easy opt-out. Publication is not a shortcut: consent may not be inferred from the mere fact that an address was published (Sch 2 cl 4(1)), and the cl 4(2) exception covers work and role addresses only. Pick ten contacts off your current list at random. For each one, can you say where the consent came from?
When does an unsubscribe actually take effect?
The Spam Act sets no deadline for you to action it. Sch 2 cl 6 fixes when the CONSENT lapses: a withdrawal takes effect at the end of 5 business days beginning on the day the unsubscribe message was sent, and after that a further marketing message is no longer covered by consent (s 16(1)). Acting sooner is good practice, not the rule. The unsubscribe must also be easy, and must not force them to log in or hand over extra information.
Are marketing phone calls covered by the Spam Act?
No. A message sent by voice call on a standard telephone service is not an electronic message for the Spam Act (s 5(5)), so calls sit under the Do Not Call Register Act 2006 instead. That Act carries a defence worth knowing: under s 11(3), if you submitted the number for washing against the Register and were told, within the 30 days ending on the day of the call, that it was not listed, the s 11(1) prohibition does not apply to that call. No wash, no defence.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. The Spam Act 2003 (Cth) is administered by ACMA and is separate from the Privacy Act. For advice on your specific circumstances, consult a qualified Australian legal practitioner.