Most businesses collect customer details at some point. It might be a name and email from an online order, a mobile number from a booking or an address for delivery. Using those details to promote your goods or services is direct marketing. In Australia, that use is covered by Australian Privacy Principle 7 under the Privacy Act 1988.
The rules are not hard to follow once you know them. They cover when you can use personal information for marketing, how people opt out and what you must tell them if they ask. The Office of the Australian Information Commissioner (OAIC) publishes direct marketing guidance for organisations. This article sets out the main points in plain terms.
What counts as direct marketing
The OAIC describes direct marketing as using or disclosing personal information to communicate directly with someone to promote goods or services. It includes fundraising. The channel does not change the answer. Phone, SMS, mail, email, social media and online advertising can all be direct marketing.
The key is whether personal information was used to pick who receives the message. A catalogue posted to a customer by name is direct marketing. So is an email about a sale sent using details from a loyalty card sign up. A catalogue addressed “To the householder” is not, and neither is a flyer dropped into local letterboxes.
Website ads can fall either side of the line. If no personal information is used to choose which ads appear, APP 7 does not apply to them. Where ads are chosen using what you know about a person, the position is different. If you upload customer lists to an ad platform, think carefully about which side you sit on.
Which businesses the rules apply to
APP 7 applies to private sector organisations covered by the Australian Privacy Principles. Generally that means businesses and not for profits with annual turnover above $3 million. Some smaller businesses are covered too. These include private sector health service providers and businesses that buy or sell personal information.
Even if your business sits under the threshold, the rules are a sensible standard to follow. Customers tend to expect the same treatment from a small shop as from a large chain. Following APP 7 also puts you in a good spot if your turnover grows or your business model changes. It builds trust as well, which helps with repeat business.
When you can use personal information for marketing
Sensitive information has the strictest rule. This covers things like health details, political opinions, racial or ethnic origin and sexual orientation. You can only use or disclose it for direct marketing with the person’s consent. The reasonable expectation test does not open a door here.
For other personal information, one of three conditions has to apply. The first is that you collected it directly from the person and they would reasonably expect it to be used for marketing. The second is that the person has consented. The third is that it is impractical to get their consent.
Reasonable expectation
The reasonable expectation test is objective. It asks what a reasonable, properly informed person would expect, and the business must be able to justify its conduct. The APP 7 guidelines list factors that help. These include telling people at collection that their details may be used for marketing. Telling them they can opt out, and seeing that they have not, also counts.
There are limits. The OAIC says you should not assume someone would welcome marketing because of their job, interests or hobbies. If you told a person their details would only be used for something unrelated, an expectation of marketing is unlikely. Clear wording on your forms avoids most of this guesswork. Forms that collect details should also be secure, which is where an SSL certificate comes in.
Giving people a simple way to opt out
Every business doing direct marketing must offer a simple way to opt out of future messages. The OAIC says the explanation should be visible, clear and easy to understand. The process should take minimal time and effort and be free or cost only a nominal amount. You should always offer a way to opt out of all future direct marketing, not just one type.
The guidance gives some practical examples of a simple opt out. They are all low effort for the customer. Common ones include the following.
- Replying “unsubscribe” to an email.
- Replying “STOP” to a text message.
- Saying so during a phone call.
- Following opt out instructions included in a letter.
In some cases you also need a prominent opt out statement in each message. This applies when you got the information from someone else, or when the person would not reasonably expect the marketing. The statement should be in plain English and placed where people will see it. Its font should be at least as large as the main body text.
Handling requests from customers
People can ask you to stop sending them direct marketing. Once they do, you must not use or disclose their personal information for that purpose. You need to act within a reasonable period, which the OAIC says is generally no more than 30 days. You must not charge them for making the request or for acting on it.
A person can also ask where you got their details. You must tell them unless that is impracticable or unreasonable. Again, a reasonable period is generally 30 days. Keeping a note of where each contact list came from makes this an easy request to answer.
Some businesses collect details in order to pass them to other organisations for their marketing. The OAIC calls this facilitating direct marketing. If a person asks you to stop, you must do so. If you hire another business to run campaigns for you, your contract with them should reflect your APP 7 obligations.
How the Spam Act and Do Not Call Register fit in
APP 7 does not apply to the extent that the Spam Act 2003 or the Do Not Call Register Act 2006 applies. Those laws have their own rules. Commercial emails, SMS, MMS and instant messages need the recipient’s consent under the Spam Act. They must identify the sender accurately and include a working unsubscribe option.
For telemarketing, numbers on the Do Not Call Register cannot be called unless the person has consented or the caller is exempt, such as a registered charity. The Telecommunications Industry Standard applies to all telemarketing and research callers, even exempt ones. It covers matters like when calls cannot be made, required disclosures and caller identification. Where APP 7 does not apply, the other privacy principles still do. The OAIC suggests following APP 7 standards for all direct marketing anyway.
Building good habits into your marketing
Good privacy habits sit alongside the rest of your digital marketing. Start with clear collection notices on every form and checkout page. Keep your unsubscribe links working and test them now and then. Record opt outs promptly so nobody is contacted after asking to stop. These steps fit neatly beside the technical basics in an SEO checklist for small businesses.
Trust matters online. It is a big part of why so much attention goes to Google’s E-A-T guidelines, and the same idea applies to how you treat customer data. A site that is honest about privacy gives visitors one less reason to leave. Pair that with web design that ranks well on Google and your marketing has a strong base.
Frequently asked questions
Does APP 7 apply to my small business?
It depends on your turnover and what you do. Businesses with annual turnover above $3 million are generally covered. Some smaller businesses are too, such as private sector health service providers and those that buy or sell personal information.
How quickly must I stop marketing after someone opts out?
You must act within a reasonable period. The OAIC says this is generally no more than 30 days. Acting sooner is better for customer goodwill.
Can I charge someone to process an opt out request?
No. APP 7.7 says the organisation must not charge for making or giving effect to the request. The opt out process itself should be free or cost only a nominal amount.
Can I market to people using publicly available information?
You can, but APP 7 still applies. Some public registers also have their own restrictions on use. Check the register’s terms before using any details from it.
This article is general information only and is not legal advice. Privacy and marketing laws change, and other rules may apply depending on your state or territory and your industry. Speak with a qualified lawyer about your own circumstances.