$7.36M in ACMA Spam Fines: Clinic Email Marketing Rules 2026

Key takeaways

• Three 2026 ACMA enforcement actions against Lululemon, Latitude Finance and TAB total more than $7.36 million in confirmed Spam Act penalties
• Lululemon paid $702,900 for sending more than 370,000 emails that mixed order-confirmation content with marketing links and no unsubscribe option
• Latitude Finance paid $3.96 million in April 2026, a repeat offence after an earlier $1.55 million penalty in 2022, over more than 2.7 million breaches
• TAB paid more than $2.7 million partly for sending 217,000+ marketing emails and SMS in a 16-day window to customers who had already unsubscribed
• ACMA’s rules require a working unsubscribe function actioned within 5 working days, functional for at least 30 days
• AHPRA’s advertising penalty is $120,000 per breach for a body corporate and $60,000 for an individual, up from $10,000 and $5,000 before a 2022 amendment, and in force nationally, including Western Australia, since July 2024
• Under Australian Privacy Principle 7, health information is “sensitive information”, and the OAIC’s guidance states it can only be used for direct marketing with the individual’s consent, not the reasonable-expectation option available for other personal information

Three Australian businesses paid a combined total of more than $7.36 million in 2026 for breaking the Spam Act with their email and SMS marketing. Lululemon, Latitude Finance and TAB are not clinics, but the law they broke covers every business sending commercial email in Australia, cosmetic clinics included.

A clinic’s booking system sends appointment confirmations. Its CRM sends recall reminders. Its marketing platform sends offers to a patient list. Every one of those is a commercial electronic message once it carries any promotional content, and every one of them sits under the same Spam Act rules that just cost TAB $2.7 million.

Clinics carry two extra layers most businesses never face: the Privacy Act’s rules on health information, and AHPRA’s advertising rules, which apply to a newsletter the same way they apply to a website. Here is what each layer actually requires, and what it means for the systems sending your clinic’s emails.

What the Spam Act Actually Requires

The Spam Act 2003 covers any commercial electronic message, which includes email, SMS and instant messages with promotional content. ACMA’s guidance sets out three obligations: consent, identification and an unsubscribe facility.

Consent can be express (a patient ticks a box or signs up directly) or inferred, where there is a provable, ongoing relationship and the message relates to that relationship. ACMA specifically warns businesses against treating a one-off purchase or a website enquiry as automatic grounds to add someone to a marketing list. Every message also has to accurately identify the sending business and its contact details.

The unsubscribe rule is where most breaches happen. ACMA requires a functioning unsubscribe option that a business must action within five working days, and that mechanism has to keep working for at least 30 days after the message was sent. It cannot demand a login, personal information or payment to process.

Takeaway: consent, sender identification and a genuinely working unsubscribe link are the three legal minimums for any clinic email, and the unsubscribe rule is the one enforcement keeps catching businesses on.

What Three 2026 Enforcement Actions Actually Show

Lululemon’s penalty is the clearest warning for any business running automated transactional emails. ACMA found more than 370,000 emails, sent between December 2024 and January 2025, mixed order and delivery content with sales material and had no unsubscribe option. ACMA’s own position is that a message counts as commercial the moment it carries any promotional content, regardless of its other purpose. A clinic’s appointment-confirmation email that also promotes a treatment offer sits in exactly that category.

TAB’s case shows what happens when a fix does not reach every system. Between February 2024 and June 2025, ACMA found 351 calls to numbers on the Do Not Call Register, 82 calls outside permitted hours, and nearly 4,000 calls without proper identification. Separately, over a 16-day period, TAB sent more than 217,000 marketing emails and SMS to customers who had already unsubscribed. The total penalty was more than $2.7 million.

Latitude Finance is the repeat-offender case. It paid $3.96 million in April 2026, a follow-on to an earlier $1.55 million penalty from 2022 for the same kind of breach: more than 2.3 million marketing messages sent without accurate contact details, and 344,416 of them with no working unsubscribe function, even where a “reply STOP” option existed on paper but did not process correctly in practice.

Takeaway: none of these three breaches came from a single rogue email; each came from an automated system that kept sending after something had already gone wrong.

The Extra Layer: Health Information and the Privacy Act

A clinic’s marketing list is not just a contact list. It is a list of people who can be identified as patients of a health service, which the Privacy Act classes as health information, and health information is sensitive information under Australian Privacy Principle 7.

Under APP 7, a business can generally rely on a reasonable expectation of use, or on consent, for direct marketing. The OAIC’s guidance states that reasonable-expectation option does not apply to sensitive information: sensitive information can only be used for direct marketing with the individual’s consent. A general business can sometimes rely on a reasonable expectation built from an existing relationship. A clinic working with health information does not get that option; the OAIC’s guidance requires consent as the baseline.

That distinction matters for how a clinic’s booking or intake form is built. A checkbox buried in terms and conditions, or a list built by importing patient records into a marketing platform without a separate opt-in step, does not meet the consent standard the OAIC describes for sensitive information.

Takeaway: the reasonable-expectation shortcut that lets a retail brand rely on a past purchase is not available to a clinic working with health information, because the OAIC’s guidance requires consent for that category.

AHPRA’s Advertising Rules Cover the Newsletter, Not Just the Website

AHPRA’s guidelines define advertising broadly: “all forms of verbal, printed or electronic public communication that promotes a regulated health service provider”, explicitly including “all electronic media that promotes a particular regulated health service provider” and “mobile communications or other displays”. A clinic’s email newsletter fits that definition the moment it promotes the clinic or its services.

That means the same rules that apply to a clinic’s website apply inside the newsletter: no testimonials, no content that creates an unreasonable expectation of benefit, and no misleading or deceptive claims. RockingWeb checks a clinic’s website against these rules, and the same provisions extend to the email content built from the same marketing calendar.

The penalty for getting this wrong increased sharply. Before a 2022 amendment to the National Law, the maximum financial penalty was $5,000 per offence for an individual and $10,000 for a body corporate. Those maximums rose to $60,000 and $120,000. As of July 2024, the higher penalties apply in every jurisdiction, including Western Australia.

Takeaway: a promotional email is advertising under AHPRA’s definition, and the same $120,000 exposure that applies to a website applies to what goes out in the newsletter.

What This Means for Your Website and Booking System

The practical fix sits upstream of the email platform. A booking form or intake process that captures explicit, opt-in consent for marketing (separate from consent to treatment) solves the Privacy Act problem before a single email goes out. A clear, working unsubscribe link that actually removes a contact from every connected system, not just the newsletter tool, solves the pattern behind all three 2026 ACMA cases.

For content, the treatments or topics that justify a dedicated landing page are the ones a clinic already sends recurring email content about: a specific procedure, a seasonal offer, or a recall series for an existing treatment. Sending traffic from a compliant email to a page built under the same AHPRA rules keeps enquiry quality consistent instead of routing patients to a page that says more than the newsletter is allowed to. Cosmetic clinic websites built with that alignment in mind reduce the gap between what a clinic can legally promise in an email and what its landing page actually says.

Takeaway: the compliance work belongs in the booking form and the CRM’s unsubscribe handling, not in a disclaimer added to the bottom of an email.

FAQ

Does the Spam Act 2003 apply to a cosmetic clinic’s email marketing?

Yes. Any business sending commercial electronic messages needs consent (express or inferred), must identify the sender accurately, and must provide a working unsubscribe function actioned within five working days. Clinics are not exempt.

Is a clinic’s promotional email newsletter considered “advertising” under AHPRA’s rules?

Yes. AHPRA’s advertising guidelines define advertising to include “all electronic media” that promotes a regulated health service provider. A promotional newsletter falls inside that definition, so testimonials, before/after content and unreasonable-expectation claims are off limits in it, the same as on a website.

Does the Privacy Act require extra consent for a clinic’s email list because it involves health information?

Under Australian Privacy Principle 7, direct marketing generally needs either a reasonable expectation of use or consent. Health information is classed as sensitive information, and the OAIC’s guidance states sensitive information can only be used for direct marketing with the individual’s consent, without the reasonable-expectation option available for other personal information.

What happens if a clinic keeps emailing patients after they unsubscribe?

It becomes a Spam Act breach that ACMA actively enforces. TAB was fined more than $2.7 million in 2026 partly for sending over 217,000 marketing emails and SMS to customers who had already unsubscribed, in just a 16-day window.

Get Your Clinic’s Marketing Systems Checked

RockingWeb reviews cosmetic clinic websites, booking forms and marketing systems against AHPRA’s advertising rules and the consent standards that apply to health information, then flags every gap against the specific rule it falls under.

Talk to us about your clinic’s email and booking systems.

Sources and References

1. AHPRA - Advertising and the law: penalty structure ($60,000 individual / $120,000 body corporate) and the July 2024 national rollout including Western Australia

2. AHPRA - Guidelines for advertising a regulated health service: the definition of advertising covering “all electronic media”, and the 2022 penalty increase from $5,000/$10,000 to $60,000/$120,000

3. OAIC - Direct marketing guidance: Australian Privacy Principle 7, and consent required for sensitive information including health information

4. ACMA - Avoid sending spam: consent types, sender identification and the 5 working day / 30 day unsubscribe rule

5. ACMA - Lululemon penalised $702k for spam breaches: 370,000+ emails, December 2024 to January 2025

6. ACMA - Latitude Finance pays $3.96m for more spam breaches: repeat offence, 2.7 million+ breaches, March 2024 to April 2025

7. ACMA - TAB pays $2.7m for telemarketing and spam breaches: 217,000+ emails/SMS to unsubscribed customers, February 2024 to June 2025

Related reading:

• AHPRA Advertising Fines for Cosmetic Clinics: the full National Law penalty structure
• Meta’s New Ad Rules Won’t Save You From a $120K AHPRA Fine: why platform approval never equals AHPRA compliance
• Email Marketing Benchmarks Australia: open and click-through benchmarks for Australian email lists