Database Reactivation in Australia: How to Win Back Customers Without Breaking the Law

Database reactivation campaigns can be one of the most cost-effective marketing strategies available to Australian businesses, but they come with serious legal obligations. Before you send that "we miss you" email to your dormant contacts, you need to understand your responsibilities under the Spam Act 2003 and the Australian Privacy Principles. Get it wrong, and you could face penalties in the millions.

The Australian Communications and Media Authority (ACMA) issued over $16 million in spam penalties in the 18 months leading up to mid-2025, with the Commonwealth Bank of Australia receiving a $7.5 million fine for sending more than 170 million non-compliant marketing messages. The message is clear: compliance is not optional.

This guide covers what Australian businesses need to know about running compliant database reactivation campaigns, including consent requirements, the regulatory framework, and practical steps you can take today.

What is Database Reactivation?

Database reactivation is a marketing strategy designed to re-engage inactive customers or contacts who have stopped interacting with your business. These might be people who made a purchase years ago, signed up for your newsletter but never opened an email, or lapsed subscribers who used to be regular buyers.

The business case is compelling. Acquiring a new customer typically costs five to six times more than retaining or reactivating an existing one. Your database of past customers represents a valuable asset, as these people already know your brand and have shown interest in what you offer. A well-executed reactivation campaign can deliver strong returns with lower acquisition costs than prospecting for entirely new leads.

However, the fact that someone once gave you their email address does not mean you can contact them indefinitely. Australian law places strict limits on when, how, and under what conditions you can send commercial electronic messages.

The Regulatory Framework: Two Laws You Need to Know

Two pieces of legislation govern how Australian businesses can contact customers for marketing purposes: the Spam Act 2003 and the Privacy Act 1988 (which includes the Australian Privacy Principles). Understanding how these interact is essential for any reactivation campaign.

The Spam Act 2003

The Spam Act regulates the sending of commercial electronic messages (CEMs), which includes marketing emails, SMS, MMS, and instant messages. It applies to any message that has an "Australian link", meaning it originates in Australia, was commissioned in Australia, or is sent to an address accessed in Australia.

The Act establishes three core requirements for every commercial message:

1. Consent: You must have the recipient's consent before sending the message. Consent can be express (explicitly given) or inferred (reasonably expected based on an existing relationship).
2. Identification: Every message must clearly identify who sent it, using your legal business name or your name and Australian Business Number. This information must remain accurate for at least 30 days after sending.
3. Unsubscribe facility: Every commercial message must include a functional way for recipients to opt out. The unsubscribe must be easy to use, free of charge, and must not require the recipient to log in or provide additional personal information.

Penalties under the Spam Act are substantial. A business sending more than 50 CEMs without consent on a single day could face fines of $313,000 or more. For systematic breaches across multiple days, penalties can escalate into the millions.

Australian Privacy Principles (APP 7)

APP 7 specifically addresses the use of personal information for direct marketing. It applies to organisations with annual turnover exceeding $3 million, as well as health service providers and businesses that buy or sell personal information.

Under APP 7, you can only use personal information for direct marketing if you collected it directly from the individual and they would reasonably expect you to use it for that purpose. If you collected information indirectly (such as from a third-party list), stricter rules apply and you will generally need explicit consent.

Sensitive information, including health data, religious beliefs, and political opinions, can only be used for direct marketing with the individual's express consent. This has implications for businesses in sectors like healthcare, fitness, and financial services.

Recent reforms to the Privacy Act have made some breaches of APP 7 subject to infringement notices, meaning the Office of the Australian Information Commissioner (OAIC) can issue fines of up to $66,000 without court proceedings.

Consent Requirements for Reactivation Campaigns

The critical question for any reactivation campaign is whether you still have valid consent to contact the people in your database. The ACMA's Statement of Expectations, released in July 2024, provides guidance on this point.

Express Consent vs Inferred Consent

Express consent is the gold standard. This occurs when someone explicitly agrees to receive marketing communications from you, such as by ticking a checkbox, signing up through a form, or verbally agreeing during a phone call. The ACMA strongly recommends businesses rely on express consent wherever possible, as it provides clear evidence of permission and reduces compliance risk.

Inferred consent is permitted in limited circumstances, but should be approached with caution. You may infer consent where someone has knowingly given you their contact details and it is reasonable to believe they would expect marketing from your business. This typically requires a clear, current, and ongoing relationship with the individual, and the marketing must be directly related to that relationship.

For example, a bank could infer consent to tell an existing savings account customer about a new savings product with better interest rates. However, it could not infer consent to market insurance products, as this falls outside the scope of the existing relationship.

The Problem of Stale Consent

Here is where many reactivation campaigns fall into trouble. The ACMA takes the view that consent has an effective expiry date. In its Statement of Expectations, the regulator warns businesses not to rely on "consent that is old, where a consumer would not expect it to still apply."

The ACMA gives a specific example: telemarketing consent becomes "stale" after three months unless the consumer has agreed to a longer period in terms and conditions. While this guidance relates specifically to telemarketing, it signals a broader regulatory expectation that consent does not last forever.

For database reactivation, this creates a significant challenge. If someone last engaged with your business two years ago, can you reasonably claim they would still expect to hear from you? The answer depends on the nature of your relationship, what consent they originally gave, and whether you have maintained any contact in the interim.

Running a Compliant Reactivation Campaign

Given these constraints, how can you reactivate dormant contacts legally? The following framework will help you stay on the right side of the law.

Segmenting by Risk Level

When auditing your database, categorise contacts based on their consent status and recency of engagement:

What Happens If You Get It Wrong

The consequences of non-compliance have never been more severe. ACMA enforcement has escalated significantly, with a growing number of investigations and higher penalties. Here are some notable cases:

Beyond financial penalties, the ACMA can accept court-enforceable undertakings that require businesses to implement independent compliance reviews, regular reporting, and remediation programs. The reputational damage from being named in an ACMA media release can also be significant.

Frequently Asked Questions

Key Takeaways

Database reactivation can deliver excellent returns, but only when done right. The regulatory environment is getting tougher. With ACMA penalties now reaching into the millions and Privacy Act reforms strengthening enforcement powers, the cost of getting it wrong far exceeds the effort of getting it right.

Before launching any campaign, audit your database to verify valid consent, recognise that consent can become stale, ensure every message includes proper identification and a functional unsubscribe, honour opt-outs promptly, and keep detailed records to demonstrate compliance if challenged.

If anything's still not clear, you might find the answer in our FAQ.