Most advice about email marketing is written for the American CAN-SPAM regime, which permits sending to people who never asked and requires only that you stop when told. Australia does not work that way. The Spam Act 2003 is a consent-first regime, administered by the ACMA, and the difference is not academic.
The three requirements of the Spam Act
Every commercial electronic message you send must satisfy all three.
1. Consent
Consent is either express or inferred. Express consent is someone actively agreeing to receive marketing from you — ticking an unticked box, entering an address into a subscribe field, saying yes in writing.
Inferred consent is much narrower than people hope. It can arise from an existing business relationship, or from a work address published conspicuously where the role suggests such messages are welcome and there is no statement to the contrary. It does not arise because someone handed you a card at an industry night, because they follow your studio on Instagram, or because you bought a list of architects.
A published address with “no unsolicited marketing emails” next to it is an explicit refusal. Scraping it anyway removes the inference entirely.
2. Identification
The message must clearly identify the sender and include accurate contact details that remain reachable. A studio name with no legal entity, no address and a reply-to that bounces does not meet this.
3. Unsubscribe
Every commercial message needs a functional unsubscribe facility, presented clearly, and it must keep working for at least 30 days after the message was sent. Unsubscribing must not require the recipient to log in, create an account, or explain themselves. Requests must be actioned promptly.
One-to-one email from a person to a prospect they have never dealt with is still a commercial electronic message. Sending it individually from a personal mailbox rather than through a platform changes nothing about the obligation.
The Privacy Act applies to the same list
The Spam Act governs the sending. The Privacy Act 1988 and the Australian Privacy Principles govern the data behind it, overseen by the OAIC. Small business exemptions exist but are narrower than commonly assumed and should not be relied on without checking whether one actually applies to you.
The principles that bear on a design practice's marketing:
A privacy policy that is current and findable. Not a template naming a company you are not, describing systems you do not use.
A collection notice at the point of collection. At the form, the person should be able to tell what you are collecting, why, and who you will share it with.
Use limited to the purpose collected. An address given to download a materials guide was not given for a weekly newsletter unless you asked.
Overseas disclosure. Most email and CRM platforms store data offshore. That is a disclosure, and it needs to be disclosed.
Access and correction. People can ask what you hold about them. You need to be able to answer.
Reasonable security. Including the spreadsheet of leads on somebody's laptop.
What this means for your enquiry form
The enquiry form is where both regimes meet, and it is usually where the problem starts.
Do not pre-tick the marketing consent box. Pre-ticked is not active agreement.
Separate the enquiry from the subscription. Someone asking about a kitchen renovation has consented to a reply about their kitchen renovation, not to a mailing list.
Record the evidence. Timestamp, source page, the exact wording shown at the time. If consent is ever questioned, this is the whole of your case.
Link the privacy policy from the form itself. Not only from the footer.
Keep unsubscribes forever. A suppression list only works if you never delete it. Re-importing an old CSV over a cleaned list is the classic way to re-mail people who opted out.
Phone calls are a separate regime again
Cold calling prospects engages the Do Not Call Register Act 2006, which is administered separately. If your practice does outbound calling, that register has to be part of the process — the Spam Act does not cover it.
Why the restriction works in your favour
A consent-first regime rules out volume as a strategy, which is genuinely good news for a design practice. Purchased lists were never going to win architectural work anyway; the clients worth having do not select a studio from an unsolicited email.
What does work is a list built from people who came to you — past clients, enquiries that were not ready, trade contacts, people who downloaded something genuinely useful. It is a slower list to build and a far more valuable one to own.
This article is not legal advice. The ACMA and the OAIC both publish detailed guidance, and it is worth reading rather than paraphrased.