Why these cases matter to anyone sending EDMs
The Australian Communications and Media Authority (ACMA) has been busy. Over the last few years it has penalised banks, retailers, telcos and wagering companies for breaking the Spam Act 2003, and the amounts are now regularly in the millions.
What struck me reading through the investigations is how ordinary the mistakes are. None of these companies set out to spam anyone. They sent order confirmations with a sales link in them, unsubscribe links that needed a login, VIP messages from a relationship manager's phone, or campaigns that went to people who had opted out of one channel. These are process failures, and process failures are fixable.
If you need a refresher on the rules themselves first, read our guide to Australian email marketing law and the Spam Act. In short: you need consent, you must identify the sender, and every commercial message needs a functional unsubscribe that is actioned within five working days.
The penalties, most recent first
TAB: more than $2.7 million (July 2026)
On 22 July 2026 the ACMA announced that Tabcorp (TAB) had paid more than $2.7 million for telemarketing and spam breaches. The spam part: TAB self-reported sending more than 217,000 marketing emails and SMS over 16 days to customers who had unsubscribed from those channels. The ACMA's investigations list puts the spam infringement notice at $1,254,000; the rest related to telemarketing calls to VIP customers.
The mistake: messages going to people who had withdrawn consent for that channel. Opt-outs weren't being respected across every send.
Latitude Finance: $3.96 million (April 2026)
Latitude paid $3.96 million after the ACMA found more than 2.7 million breaches between March 2024 and April 2025. More than 2.3 million marketing messages lacked accurate contact information, and 344,416 of them also had no working unsubscribe: recipients were told to reply "STOP", but many messages couldn't actually receive a reply. It was Latitude's second penalty; it paid $1.55 million in 2022, and the new breaches surfaced through reporting under the undertaking from that first case.
The mistake: sender details that weren't accurate, and an unsubscribe instruction that didn't work.
Lululemon: $702,900 (March 2026)
On 11 March 2026 the ACMA announced that Lululemon had been penalised $702,900 for sending more than 370,000 emails with no unsubscribe option between December 2024 and January 2025. Lululemon treated them as service messages: order confirmations and delivery updates. The ACMA found they also had a marketing purpose, so they were commercial messages and needed an unsubscribe.
The mistake: promotional content in transactional emails. If a message contains any promotional content, the ACMA treats it as commercial.
Betfair: $871,660 (July 2025)
Betfair paid $871,660 for messages to members of its VIP programme, which offered inducements such as account deposits and free tickets. Between March and December 2024 it sent 148 emails and texts to people who hadn't consented or had withdrawn consent, plus six messages with no unsubscribe.
The mistake: VIP messages handled outside the normal consent checks. The numbers are small; the penalty wasn't.
TAB: $4,003,270 (June 2025)
TAB's first penalty, $4,003,270, covered more than 5,700 messages to VIP customers in 2024: 2,598 SMS and WhatsApp messages with no unsubscribe, 3,148 with inadequate sender information, and 11 SMS sent without consent. These weren't emails, but the lesson applies directly to EDMs: the ACMA said the spam laws apply to personalised messages as well as generic campaigns.
The mistake: one-to-one marketing from account managers sitting outside the compliance process.
Telstra: $626,000 (March 2025)
Telstra was penalised $626,000 over 10,433,812 texts whose unsubscribe arrangements broke the rules, most of them because recipients had to give personal information to opt out. A further 43,228 texts went to Belong customers who hadn't consented or had withdrawn consent.
The mistake: an unsubscribe that asked for more than it should. You can't make people log in or hand over personal details to stop marketing, unless they agreed to that arrangement.
Commonwealth Bank: $3.55 million (June 2023) and $7.5 million (October 2024)
CBA is the clearest email case. In 2023 it was penalised $3.55 million after sending more than 61 million marketing emails that required people to log in to unsubscribe, and another 4 million with no working unsubscribe. In October 2024 it paid a further $7.5 million for more than 170 million messages without an unsubscribe, wrongly labelled as non-commercial, with 34.8 million of them sent to people who hadn't consented or had withdrawn consent.
The mistake: both of the big ones: login-gated unsubscribes, and marketing dressed up as information.
The five patterns behind the fines
Line the cases up and the same few failures keep coming back.
- No working unsubscribe. Lululemon, Latitude, TAB, Betfair and CBA. Often the link simply wasn't in the template, or the "reply STOP" route didn't work.
- An unsubscribe that needs a login or personal details. CBA (login) and Telstra (personal information). Unsubscribing has to be easy and free.
- Missing or inaccurate sender identification. Latitude and TAB. The message must identify who authorised it and give contact details that stay accurate for at least 30 days.
- Sending to people who opted out. TAB (2026), Betfair, Telstra and CBA. Usually a suppression list that wasn't applied to every channel, system or send.
- "Not marketing" messages that were marketing. Lululemon and CBA. Service emails with a promotional block, and VIP or loyalty messages that never went through the consent checks.
There's also a sixth, quieter pattern: repeat offenders. Latitude and CBA were both penalised twice, and TAB has two actions in just over a year. The ACMA usually pairs a penalty with a court-enforceable undertaking, which means independent reviews and regular reporting. A second breach found under that reporting looks much worse.
A checklist to avoid each one
Run this before any EDM goes out, and audit your templates against it once a quarter.
Unsubscribe
- Every commercial email template has an unsubscribe link in the footer, including transactional templates that carry any promotional content.
- The link works in a test send to a real inbox, not just in the preview.
- Unsubscribing takes one or two clicks, no login, no password, no personal details beyond what's needed to identify the address.
- Requests are actioned within five working days, and the link keeps working for at least 30 days after the send.
- If you offer "reply STOP" or a preference centre, check the reply address is monitored or processed.
Sender identification
- The footer names the business that authorised the message (for agencies, usually the client) and gives accurate contact details.
- Footer details are pulled from one shared source, not retyped per campaign.
Consent and suppression
- One suppression list applied to every send, from every system: ESP, CRM, SMS platform and anything a VIP team uses.
- If people can opt out of one channel, check your audience logic respects that for each channel.
- Keep a record of how and when each person consented. The burden of proof is on you.
Transactional and VIP messages
- Decide in writing what counts as a service message. If a cross-sell, discount or "you might also like" block goes in, treat it as commercial.
- Bring VIP, loyalty and account-manager messages inside the same approval process as campaign EDMs.
A rules-based footer check catches most of this before send: is there an unsubscribe link, is the sender named, is the contact address present? That's the kind of thing Brand Guard in MailFois checks automatically, alongside your own brand rules. Whatever tool you use, the point is to stop relying on someone remembering.
What's changing next
Separate from the Spam Act, Parliament passed the Competition and Consumer Amendment (Unfair Trading Practices) Act 2026 (Act No. 64 of 2026, Parliament's bill record). The Treasury says unfair trading practices and subscription traps will be banned from 1 July 2027, and law firm summaries (for example Brightlaw) note it also targets drip pricing and requires an easy way to cancel subscriptions. It's enforced by the ACCC, not the ACMA, but EDMs that advertise prices or subscriptions will need to fit the new rules. Worth adding to your offer and pricing checks before mid-2027.
Frequently asked questions
What is the biggest ACMA spam penalty?
Of the cases above, the largest single penalty is CBA's $7.5 million in October 2024. TAB's combined penalties across its two actions come to more than $6.7 million.
Do order confirmation emails need an unsubscribe link?
A purely transactional email doesn't. But if it includes any promotional content, such as a discount, a product recommendation or a link to shop, the ACMA treats it as a commercial message, and it needs consent, sender identification and an unsubscribe. That's exactly what caught Lululemon.
Can I ask people to log in to unsubscribe?
Not unless they've agreed to that arrangement. CBA's 2023 penalty was largely for login-gated unsubscribes, and Telstra's for asking people for personal information.
Do the spam rules apply to one-to-one VIP messages?
Yes. TAB and Betfair were both penalised for messages to VIP customers. If the message is commercial, it doesn't matter whether it was sent to one person or a million.
How quickly must an unsubscribe be actioned?
Within five working days, and the unsubscribe facility must keep working for at least 30 days after the message was sent.
