The Consent Evidence File

What Reaches Us

The Instruments That Reach a Marketing Send

Two statutes do most of the work and they do not overlap: the Spam Act governs the message, the Privacy Act governs the data behind it. The rest bind narrower surfaces — the phone, the sender ID, the claim in the creative, and the contract with each ad platform.

Duty To Evidence

Every Duty, and the Column That Answers It

A duty with no evidence behind it is a hope. Each row names the clause, what it requires, and the column, table or template artefact that would be produced if a regulator asked. Where a warehouse test holds the duty in place, the test is named too — 2 of them touch consent directly.

Sensitive Information

Why Ancestry and Language Sit Under a Stricter Rule

Racial or ethnic origin is sensitive information under s 6 of the Privacy Act, which changes the test twice over. APP 3.3 requires consent before it is collected at all. APP 7.4 then requires consent before it is used for direct marketing — and unlike the rules for ordinary personal information, there is no impracticability escape and no allowance for an existing customer relationship. An ancestry-led campaign therefore stands or falls on consent alone.

The practical consequence is a collection rule: ancestry and language are self-declared by the person at opt-in, on ABS Census categories. A bought-in ancestry append cannot be used for marketing however it was collected, which is why the file has no route for one. See these columns on the prototype

In the Creative

Sender Identity, the Unsubscribe and the Sender ID

Three duties cannot be satisfied by data at all — they live in the template. They are also the three that ACMA can establish without any argument about consent, because a message either carries them or it does not.

One opt-out path serves both regimes: the link that satisfies the Spam Act unsubscribe writes the withdrawal event that satisfies APP 7. Two mechanisms would mean two chances to drift apart. See the material kit on the prototype

Ad Platforms

What Goes Up, and What Stays Behind

The custom-audience terms at Meta, Google and TikTok each require the uploader to warrant that it holds the rights and consents to share every contact point, and each restricts sensitive-category targeting on its own account. Those terms sit on top of the statutes rather than instead of them, so a breach is a contract claim and an account risk as well as a privacy question. See the platform uploads on the prototype

Where It Lives

The Record a Regulator Would Ask For

Consent is stored as an event, not as a tick. The flag on the file is the current position of that history, which is what lets a single person be traced back to the moment and the form they opted in through — and what makes a withdrawal a fact in the record rather than a manual deletion someone has to remember.

Tests that hold consent in place

Records that fail one of the 6 validation rules are quarantined rather than mailed — 6 of them on the sample file. Illustrative — from sample data See the warehouse tables on the prototype

If Someone Complains

The Seven Steps, and the Clock on Each

A complaint is not the problem; a slow or undocumented response is. The Spam Act unsubscribe duty is strict — the clock starts when the request arrives, and intent is not a defence — while the OAIC expects a person to raise a privacy complaint with the business first and gives it 30 days to answer. Both clocks run from the same moment.

OAIC — handling privacy complaintsOAIC — what a complainant is told to do firstACMA — avoid sending spam

The Timers

Every Clock in One Place

Two of these are easy to miss. A withdrawal of consent takes effect at the end of five business days, so a send queued on day four is still a send to a person who has withdrawn. And the retention window is set by the longest limitation period rather than by the marketing calendar: the privacy windows close in one to three years, but ACMA may start a Spam Act proceeding up to six years after the contravention, so six years is what the consent record and the send log have to survive.

The Downside

What It Costs to Get This Wrong

Spam Act maximums scale on three things: whether there is a prior record for that provision, whether the sender is a body corporate, and whether the higher-tier consent rule or a lower-tier rule was broken. The figures below are section 25 penalty units multiplied by the Commonwealth penalty unit of $364, which has applied since 1 July 2026.

Derived from Spam Act s 25 penalty units Calculated

How the other regimes sit beside this table

This is why consent health is a standing Leadership Team report rather than an operational detail: the downside is measured in penalty units and the evidence is a query. See the report specs on the prototype

Before Going Live

What the Pilot Needs Before Its First Send

The data side of this is built. What remains is the operating side — the entity details in the footer, the sender ID registration, and the opt-in wording that has to carry consent for two sensitive fields.

Sources

Where Each Statement Comes From

Statutory text is linked to the regulator that enforces it or to the consolidated legislation. Figures drawn from the audience file carry the sample-data label, and figures worked out from penalty units carry the calculated label, so a reader can tell at a glance which numbers move when the file changes and which move when the law does.