Email Marketing Compliance Do’s & Don’ts When Buying Lists and Data Scraping

Email marketing can be exceptionally effective – but engaging in it is also rife with legal risk. Read this post to uncover some important do’s and don’ts if tapping social networks and buying lists for email marketing campaigns in Australia: 

Email Marketing Compliance Do’s & Dont’s

Don’t: Buy Email Marketing Lists in Australia 

Buying an email marketing list in Australia is not illegal but sending emails without consent might be.  

To send marketing emails legally, you must have either inferred or express consent – according to Australia’s SPAM Act. When you buy an email marketing list, you may not have either express or inferred consent. As a result, you will likely be in breach of the SPAM Act if you use the purchased list to boost your email marketing recipient list.  

And under the Privacy Act, you have an obligation to give notice of collection whenever you collect personal information – whether that’s directly from people or indirectly (like when you buy a list from a third party).  This means that whenever you buy a list, you need to think about how you can give notice. 

The Business Case for Not Purchasing Email Lists 

Beyond being unlawful, there are sound business reasons for not sending unsolicited marketing emails to users who haven’t consented to receive them from you. They include:  

  • The practice can harm your organisation’s reputation. 
  • Subscribers who may really want to see your emails might not because increased ‘spam’ reports can result in your marketing email visibility being limited by email providers. That is, your emails may end up in spam mailboxes more often.  
  • Sending marketing emails to recipients who don’t care to receive them can negatively affect the quality of the data you receive about your marketing campaign performance. As a result, you’ll have lower-quality data when you need it to make decisions about your marketing.  

Do: Use Legal Methods to Gain Consent & Subscribers 

Some proven and legal methods you can use to increase your subscriber count and gain consent include: 

  • Add a popup to your website and/or social media pages that asks visitors to sign up for marketing emails.  
  • Create informative content that can only be accessed if the website visitor provides their email address – for example an eBook on a relevant topic.   
  • Incentivise signing up for marketing emails with access to a promo code, annual birthday gifts, or other discounts.   
  • If you’re a retailer, ask your sales staff to seek verbal consent at the time of purchase. Many email marketing platforms can link to POS Systems, automatically adding the email addresses provided by customers at the point of sale to your marketing list.  Though of course you also need to think about providing the appropriate privacy notices as well. 
  • Create an email newsletter signup form and add it to several strategic spots on your website.   
  • Ask participants in company events or competitions to provide consent to receive marketing emails. 

Read more about legally collecting email addresses

It Depends: Using LinkedIn Contacts 

LinkedIn can be a phenomenal platform for organisations looking to expand their reach. However, it’s not always legal to amass email addresses from LinkedIn. 

Don’t: Scrape LinkedIn for Email Addresses 

Australia’s SPAM Act specifically prohibits the supply, acquisition and use of ‘Address-harvesting software’, as well as email addresses produced by address-harvesting software.  

Address-harvesting software refers to programs that are designed to crawl the web, find email addresses, and compile them into a list. This process is commonly referred to as scraping and, in addition to it not being legal in Australia, it is highly controversial.  

LinkedIn’s database has been targeted by scraping software in multiple high-profile events. Recently, it settled a lawsuit against Matheos Pty Ltd after the company scraped its database without authorisation. (Note, this was a breach of LinkedIn’s Use Agreement, not any specific law.) 

LinkedIn was previously subject to numerous scrapes, resulting in the data of at least 700 million users being posted for sale in hacker forums. 

Do: Share Quality Content on LinkedIn & Encourage Users to Subscribe 

By sharing quality content on LinkedIn and leaving a link for viewers to ‘subscribe for more’, you’re more likely to end up with a highly engaged email marketing list. Your readers are people who genuinely want to see your content – and they’re more likely to convert into paying customers in the future. 

It Depends: Generate a List from Publicly Available Information 

It is not illegal to generate a list from publicly available information. The OAIC outlines that personal information can be used for direct marketing if it is collected from sources like:  

  • A public record, such as a telephone directory. 
  • A membership list of a business, professional or trade organisation.  
  • An online, paper, or phone survey or competition.  
  • An online account that shows your purchase history or browsing habits. 

It would also include generic email addresses contained on public websites, such as or  

Read more about using work email addresses for marketing purposes. 

Things to Consider Before Sending Cold Emails

However, there are two other things to consider before hitting send:  

  1. Organisations that opt to use this tactic must still comply with The Spam Act; The Do Not Call Register Act; and Australian Privacy Principle 7.  

Source: OAIC:  

  1. You may breach the terms of use of certain email marketing platforms if you gather email addresses this way. Mailchimp, for instance, considers using publicly available data to be a violation of its Acceptable Use Policy. So, while you may be allowed to send the email under Australian law, you may not send it to subscribers who have not consented to receive it using Mailchimp (and various other platforms).  

Compliant Email Marketing with Privacy 108 

Does your organisation need help following Australia’s direct marketing laws? We can help.  

Speak with one of our privacy lawyers – starting with a free consultation. 

Privacy108 Contact Page Form

  • We collect and handle all personal information in accordance with our Privacy Policy.

  • This field is for validation purposes and should be left unchanged.

Privacy108 Contact Page Form

  • We collect and handle all personal information in accordance with our Privacy Policy.

  • This field is for validation purposes and should be left unchanged.

Privacy, security and training. Jodie is one of Australia’s leading privacy and security experts and the Founder of Privacy 108 Consulting.