AI Sends Your Marketing. The Spam Act Still Fines You.

AI can send 10,000 marketing emails before lunch. The Spam Act counts every one.

In March, the retailer Lululemon paid the ACMA $702,900 for a single compliance failure: more than 370,000 marketing emails that gave recipients no way to unsubscribe. The emails were dressed up as order and delivery confirmations — but because they carried promotional content, the regulator treated every one as a commercial message. One template. 370,000 sends. One penalty most small businesses couldn't absorb.

Here's why that should worry any business now leaning on AI to run its marketing. The thing AI is best at — generating and sending personalised messages at a volume a person never could — is exactly what turns a small mistake into a six-figure one. The Spam Act 2003 doesn't care whether a human or a model hit send. If the consent isn't there, or the unsubscribe link is broken, you've breached it — at machine scale.

ACMA isn't warning anymore. It's collecting.

The Australian Communications and Media Authority has spent 2026 making examples. TAB paid more than $2.7 million in July after sending over 217,000 messages in 16 days to people who had already unsubscribed. Latitude Finance paid $3.96 million for breaching the Act more than 2.7 million times. Betfair paid $871,660 in February. ACMA says businesses have handed over more than $12 million in spam and telemarketing penalties in the past 18 months — and the Lululemon case was, in the regulator's words, the fifth action in that time against a business treating commercial messages as something else.

The Lululemon case carries the lesson that catches smaller businesses. ACMA member Samantha Yorke put it plainly: if an electronic message contains any promotional or sales content, it is a commercial message — "regardless of whether the message has any other purpose." That order confirmation with a "20% off your next order" banner stapled to the bottom? Commercial. The booking reminder that slips in an upsell? Commercial. And a commercial message needs consent and a working unsubscribe, every single time.

Why AI makes this a bigger risk, not a smaller one

It's tempting to assume an off-the-shelf AI marketing tool handles compliance for you. It doesn't. The same principle we wrote about with AI hiring tools — you own the decision, not the vendor — applies to every message that leaves your business. You chose the list. You set the campaign running. The liability is yours. An AI that pulls in contacts, writes the copy and schedules the sends has no idea who on your list actually opted in, who unsubscribed last month, or whether the "service" email it just personalised crossed the line into marketing.

This is the quiet trade-off in automating your marketing. Done right, it's genuine admin leverage — the follow-ups and reminders that used to eat an afternoon now run themselves. Done without guardrails, it's a liability that compounds with every send. And the timing matters: we're heading into Black Friday and Christmas, the heaviest email-marketing weeks of the year, when businesses routinely fire off thousands of messages a day — as Norton Rose Fulbright noted last November. More volume, more automation, and a regulator that has shown it's paying attention. If you've handed your campaigns to a tool and can't say for certain who consented to what, that's worth mapping before your next send.

Four checks before your next AI campaign goes out

None of this means pulling AI out of your marketing. It means putting a human check on the parts the law cares about. First, consent: make sure every contact your AI sends to actually opted in, and keep the record that proves it. Second, the unsubscribe: test that the link works and that requests are honoured promptly — Lululemon's failure was a missing one, repeated 370,000 times. Third, the service-versus-marketing line: if a confirmation, reminder or invoice carries any promotional content, treat it as commercial and give it an opt-out. Fourth, sender identity: the message must accurately say who it's from. Set these as rules the AI operates inside, not afterthoughts — and remember the question of whether AI-generated marketing is even legal applies to the words, not just the send.

The send button is automated. The responsibility isn't.

AI has made it trivial to run the kind of marketing that used to take a team. What it hasn't done is move the responsibility anywhere. The businesses that come out of the next few months ahead won't be the ones that sent the most — they'll be the ones whose automation ran inside rules that keep every message consented, identified and easy to leave. Get that right and AI does the work while the liability stays contained. Get it wrong and ACMA has shown, four times this year, exactly what it costs.