Spam Law Update: Lululemon Fined Over $700,000 for Breach of Australian Spam Laws March 30, 2026

The Australian Communications and Media Authority (ACMA) has fined Lululemon Athletic Australia more than $700,000 for breaching the Spam Act 2003 (Cth). The decision highlights the importance for businesses of ensuring that all electronic marketing communications, including automated service messages, comply with Australian spam laws.

The law on spam messaging

Electronic marketing communications in Australia are regulated by the Spam Act 2003 (Cth) (Spam Act). The Act applies to commercial electronic messages, which include emails, SMS messages and other electronic communications sent for the purpose of advertising, promoting or offering to supply goods or services.  Where a message is considered commercial, the business sending the message must ensure that it is sent with the consent of the recipient, clearly identifies the sender and includes a functional unsubscribe facility.

Certain entities, including government bodies, registered political parties, registered charities and educational institutions, are exempt from these requirements. There is also an exception for messages that contain only factual information. These are known as designated commercial electronic messages (DCEMs) and do not require consent or an unsubscribe facility. However, businesses should exercise caution when relying on this exemption. If a message contains any promotional or marketing content, even where the primary purpose of the message is service related, the communication may still be classified as a commercial electronic message and subject to the Spam Act requirements.

Enforcement by ACMA

The Australian Communications and Media Authority (ACMA) is responsible for enforcing compliance with the Spam Act. ACMA receives complaints from the public, investigates potential breaches and takes enforcement action where necessary. Its enforcement powers include issuing infringement notices, imposing financial penalties and requiring businesses to implement compliance programs. Consumers who believe they have received spam can report the message directly to ACMA.

The Lululemon investigation

ACMA investigated Lululemon in relation to emails sent to customers in December 2024 that did not include an unsubscribe function.

Lululemon argued that the emails were designated commercial electronic messages and therefore exempt from the Spam Act requirements. The company characterised the emails as service messages, such as order confirmations and delivery updates.

ACMA rejected this argument. Although the emails primarily contained service related information, they also included links directing customers to Lululemon’s website, including links labelled “shop womens” and “shop mens”. ACMA determined that these links constituted promotional content. Because the messages contained promotional material, they were considered commercial electronic messages and were therefore required to include an unsubscribe function.

ACMA ultimately found that Lululemon had breached the Spam Act and imposed a penalty of more than $700,000. In addition to the fine, Lululemon entered into a court enforceable undertaking requiring it to conduct an independent review of its spam law compliance and provide regular reports to ACMA.

Key takeaways for businesses

ACMA noted that this was the fifth enforcement action it has taken in the past 18 months involving businesses that had incorrectly classified their electronic communications. These compliance failures have resulted in more than $6.7 million in penalties during that period. The decision highlights that even small promotional elements can cause a message to fall within the definition of a commercial electronic message. Businesses should therefore ensure that they obtain consent from recipients, clearly identify themselves as the sender and include a functional unsubscribe facility in all commercial electronic communications.

Regularly reviewing marketing templates and automated communications, such as order confirmations or delivery notifications, is an important step in maintaining compliance. Even something as simple as including a promotional website link within a service email may be enough to trigger the application of the Spam Act.