Non-compliant email opt-in — legal exposure growing with the list
The Spam Act 2003 is specific about what constitutes valid consent for commercial email. Pre-checked subscription boxes, opt-in text bundled into a checkout privacy policy checkbox, and implied consent from a transactional relationship without a separate marketing consent step — none of these satisfy the express consent requirement. The risk is not theoretical. The ACMA (Australian Communications and Media Authority) investigates complaints and can impose significant penalties. More immediately, if an email platform conducts a compliance review and finds the list was assembled without proper consent, it can restrict or terminate the account. Fixing the opt-in mechanism is not optional — and fixing it properly requires rebuilding the signup flow, not just editing a checkbox label.