Key takeaways
- The Australian Communications and Media Authority (the ACMA) has recently made a series of findings regarding 'electronic messages' in the gambling sector, which hint at evolving interpretations of the Spam Act 2003 (Cth).
- Although the ACMA's recent findings all relate to the gambling industry, the positions it has taken have significant implications for all businesses, including in the food and beverage sectors.
- In particular, businesses will need to carefully consider the use of push notifications, links and hyperlinks in messages, and tailored/personalised marketing practices; and should review and, where appropriate, uplift Spam Act compliance guidelines and policies, to align with the ACMA's evolving interpretation of the Act and its requirements.
Background
The ACMA's recent findings regarding PointsBet (IGA investigation; Spam Act investigation), Buddybet and Tabcorp reflect an evolving interpretation of the Spam Act in a number of respects:
- The ACMA has characterised push notifications as 'electronic messages' within the meaning of the Interactive Gambling Act 2001 (Cth) (the IGA). Although the ACMA has not to date considered push notifications under the Spam Act, there is a reasonable likelihood the regulator could have the same interpretation under this Act. Businesses that leverage push notifications to deliver marketing messages should review their practices to ensure Spam Act requirements are satisfied.
- The ACMA has continued its regulatory focus on messages 'misleadingly' sent as 'service messages', finding that even links (or hyperlinks) to a general website homepage (including hyperlinks buried in logos) can give an otherwise 'transactional' or 'service' message a commercial purpose. Accordingly, businesses should carefully review links contained in service messages and templates.
- The ACMA has confirmed that tailored or bespoke electronic messages are subject to the Spam Act in the same way as broader, widely distributed marketing campaigns.
Push notifications now in the spotlight as electronic messages
The ACMA has not historically publicly pursued organisations for delivery of push notifications under the Spam Act. However, in recent investigations into PointsBet and Buddybet's compliance with IGA obligations, it provided a detailed analysis of the operation of push notifications, and ultimately concluded they were regulated electronic messages under the IGA (an analogous concept to commercial electronic messages under the Spam Act).
The ACMA found that push notifications constituted electronic messages for the following reasons:
- Push notifications are sent using internet carriage services via Apple’s push notification services or Google’s Firebase Cloud Messaging services.
- 'Push tokens' generated by Apple or Google services qualify as electronic addresses because specific messages are sent to specific users by identifying the user of an app on a device, with the ACMA also noting that an electronic address does not need to be persistent or static.
- The Apple or Google accounts that users create to receive push notifications constitute 'similar accounts' to an email, instant messaging or telephone account for the purposes of s61GE(1)(b) of the IGA (a concept equivalent to s5(1)(b) of the Spam Act), as they permit targeting of and communications to an account holder.
Given the provisions of s61GE of the IGA closely track the language of s5 of the Spam Act, we consider it likely the ACMA could take the same position under the Spam Act—ie that push notifications constitute electronic messages under the Spam Act.
The implications of this would be significant. Businesses would be required to include accurate sender details, and an unsubscribe statement and functionality, in the push notification itself—which, in our experience, is not a practice widely adopted to date.
Accordingly, businesses should undertake a review of push notifications used for direct marketing, to ensure alignment with Spam Act requirements.
Links to general website pages may give messages a 'commercial purpose'
The ACMA's findings in relation to PointsBet confirmed that, for the purposes of the Spam Act, the 'commercial purpose' of an electronic message can be determined based on content located using links contained in the message.
In this instance, PointsBet claimed that the relevant messages were 'service messages' relating to responsible gambling or account/transaction services. However, the ACMA found at least one purpose of them was to offer goods or services, as the messages included an organisational logo that included a hyperlink to the company's website, which advertised its commercial services.
The implications of this interpretation apply across all sectors. Businesses should review template communications for links to website homepages, or other pages promoting goods or services (eg to a standard 'contact us' webpage).
While we have not seen the ACMA pursue businesses for content located via secondary links, given the regulator's approach to date it would be prudent also to ensure secondary links do not contain commercial content.
Tailored and personalised messages can still be subject to the Spam Act
While Spam Act compliance has historically been viewed as more important in regulating 'one to many' marketing messages, it equally applies to personalised communications.
The ACMA's 2025 investigation into Tabcorp found that tailored messages sent to VIP customers, offering bonus bets, deposit matches, rebates and tickets to events, contravened the Spam Act, as these messages were commercial, and should have only been sent with the customers' consent and with a functional unsubscribe facility.
We expect that, for many businesses, the application of the Spam Act to personalised 'one to one' marketing communications has not historically been on the radar. Ensuring compliance would require holistic changes in marketing practices, including regarding VIP loyalty programs, and other more personal or exclusive arrangements.