Digital marketing legal obligations, a compliance guide for Australian agencies

Running a digital marketing business puts you at the centre of several overlapping legal regimes at once. Every campaign you run can involve personal information, advertising claims, emails and SMS, creative content and possibly a competition, and each of those carries its own obligations. The penalties for getting them wrong now run into the tens of millions of dollars, and they apply to the agencies that produce the work, not just the clients who pay for it.

This guide sets out the obligations that matter most for a digital marketing agency in Australia: privacy law when you collect or handle personal information, the consumer and spam laws that govern every advertisement and marketing message, copyright when you use and create content, and the state-based rules that apply if you run trade promotions for clients. It also covers the contract terms you need in place to protect your own business.

Who these obligations apply to

Some of these regimes only catch you once you cross a threshold, while others apply to every business that trades. Before you build a compliance program, work out which category your agency falls into:

Privacy Act: The Privacy Act 1988 (Cth) binds organisations whose annual turnover in the previous financial year was more than $3 million. It also catches smaller operators in particular positions: those that trade in personal information, provide health services while holding health information, act as contracted service providers to the Commonwealth, or are related to a larger entity (s 6D). The $3 million exemption has been flagged for removal in the next tranche of privacy reform, so treat it as a moving target.
Consumer law: The Australian Consumer Law (the ACL), which is Schedule 2 of the Competition and Consumer Act 2010 (Cth), applies to anyone acting in trade or commerce regardless of size. There is no turnover threshold for misleading or deceptive conduct.
Spam law: The Spam Act 2003 (Cth) applies to any commercial electronic message with an Australian link, whether email, SMS, MMS or instant message. Size is irrelevant.
Copyright: Protection is automatic on creation. Australia has no copyright registration system, so permission and licences are the only lawful routes to using someone else's work.
Competitions: State and territory gambling laws apply where entrants can participate, so a campaign open to people in several states may require several authorisations.

Even where you sit below a threshold, your clients' obligations can reach you. If you handle customer data on behalf of a client bound by the Privacy Act, the client stays accountable for how you use it, and their privacy policy will usually bind you by contract.

Privacy: collecting and handling personal information

If your agency is bound by the Privacy Act, the Australian Privacy Principles (the APPs) set the standard. The obligations that matter most in a marketing context are:

APP 1: requires an up-to-date privacy policy that is published and free to access. Failing to have one is now itself a civil penalty provision (s 13K).
APP 5: requires you to notify people, at or before collection, of what you are collecting and why.
APP 11: requires you to protect personal information from misuse, interference, loss and unauthorised access, and to destroy or de-identify it once you no longer need it. This is the obligation that governs how long you keep client lists, campaign audiences and analytics data.
APPs 12 and 13: give individuals rights to access and correct their information.

If you suffer an eligible data breach (unauthorised access, disclosure or loss that is likely to result in serious harm), the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act requires you to notify the Office of the Australian Information Commissioner and the affected individuals.

A marketing agency usually holds two kinds of personal information: its own (employees, contractors, suppliers) and data entrusted to it by clients (customer lists, contact databases, campaign audiences). For client data, your agreement should state that you will handle it only for the purposes of the engagement, in accordance with the client's privacy policy, and should require you to return or destroy it when the engagement ends.

The consequences of getting this wrong are significant. The OAIC can investigate, make determinations and accept enforceable undertakings. For a serious or repeated interference with privacy, the maximum civil penalty for a body corporate is the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover, and $2.5 million for an individual (s 13G).

Your client agreements and website terms

Your agency's contracts do double duty: they set out what you will deliver and they allocate risk. A client services agreement should cover:

Scope: the strategies, channels and deliverables, so that "digital marketing" cannot later be read to include work you did not price for.
Timelines and fees: milestones, payment terms and what happens on late payment.
IP ownership: who owns the copyright in the campaign materials, content and code your team creates. Copyright belongs to the creator by default, so without an assignment clause your agency keeps it, and without a licence back to you, your client may be unable to reuse the work.
Confidentiality: protecting both your client's data and your own pricing, tools and processes.
Limitation of liability: a cap on your liability and an exclusion of indirect loss, which is standard for a services business.
Restraint: limits on poaching your client's staff or soliciting their customers after the engagement ends. Keep these reasonable, because an overly broad restraint can be unenforceable.
Dispute resolution and termination: a process for disagreements and a way out for both sides.

If clients sign up online, your website needs terms and conditions presented through a clickwrap flow, where the client ticks a box to accept before proceeding. Keep a record of that acceptance.

One trap to watch: under the unfair contract terms reforms, a term in a standard form small business contract that is unfair is void, and penalties can apply (s 23 of the ACL). Have a lawyer review your standard terms rather than copying a template.

Consumer law: advertising claims and spam

The ACL sits at the heart of marketing compliance. Section 18 prohibits conduct in trade or commerce that is misleading or deceptive, or likely to mislead or deceive. It applies to what you say on behalf of clients as much as what you say about your own agency, and it is judged by the overall impression a campaign leaves on its audience, not by whether each sentence is literally true.

Three related prohibitions matter in practice:

Section 29: prohibits false or misleading representations about goods or services, including their price, quality, benefits and sponsorship.
Section 35: prohibits bait advertising: you cannot advertise goods or services at a specified price if there are reasonable grounds to believe you cannot supply them at that price for a reasonable period or in reasonable quantities.
Substantiation: every factual claim needs a reasonable basis. Before a campaign launches, make sure the client can substantiate each claim, including testimonials and before-and-after results.

The penalties are steep. For contraventions of the unfair practices provisions, a court can order a body corporate to pay the greater of $100 million, three times the benefit obtained, or 30 per cent of adjusted turnover, and $2.5 million for an individual (s 224). Damages and injunctions are also available, and an agency that produces a misleading campaign can be exposed as a person involved in the client's contravention, so "the client approved it" is not a defence.

Spam is a separate regime. Under the Spam Act 2003 (Cth), you must not send a commercial electronic message with an Australian link without the recipient's consent (s 16). Consent can be express or inferred, but it cannot be inferred merely from the fact that an address has been published. The Spam Act also requires sender identification and a functional unsubscribe, and a withdrawal of consent takes effect within five business days. The Federal Court can impose civil penalties measured in penalty units, up to 2,000 penalty units in a day for a first-time corporate offender and up to 10,000 penalty units in a day for a repeat offender (s 25). The Australian Communications and Media Authority enforces the Act and can also issue infringement notices.

Intellectual property: using and owning creative work

Most campaigns use content made by other people: stock photographs, music, video and fonts. Copyright is automatic in Australia, so finding something online is not a licence. Before you use someone else's content, you need permission or a licence that covers exactly how you intend to use it.

Music is a common example. Playing a track in an advertisement or on a client's website involves the musical work, and collecting societies such as APRA AMCOS grant licences for that use on behalf of composers and publishers. The sound recording itself may need a separate licence. Stock photo and video sites grant licences too, and "royalty-free" means you pay once for a defined use, not that you can do anything with the image.

A common misconception is that changing a work by a certain amount avoids infringement. Infringement turns on whether you have reproduced a substantial part of the work, so crops, filters and edits do not automatically protect you. Moral rights, including the right of attribution, also survive even where copyright has been assigned.

Two practical steps: clear campaign names and logos for trade mark conflicts before you invest in branding, and make sure your client agreements assign IP in the work you create and licence back what you need for your portfolio.

Competitions and trade promotions

If you run competitions to promote a client's products or services, state and territory gambling law applies. The key distinction is between a game of skill and a game of chance. Where winners are determined by chance, the promotion is a lottery and, in most states and territories, requires an authorisation or permit. Games of skill are generally not regulated as lotteries.

The requirement depends on where entrants can participate:

In NSW, a trade promotion lottery with a prize pool over $10,000 needs a trade promotion gaming authority from NSW Fair Trading, and you must notify Fair Trading at least 10 business days before the promotion starts, under the Community Gaming Act 2018 (NSW).
The ACT requires a permit under the Lotteries Act 1964 (ACT) where residents can enter.
Western Australia requires authorisation under the Gaming and Wagering Commission Act 1987 (WA).
The Northern Territory requires approval to run a trade lottery.

Fees apply, and the position differs in other states, so check the rules in every state and territory where people can enter.

Every promotion also needs terms and conditions: who the promoter is (you or your client), who can enter (including age and location limits), how to enter, the prize, the dates, how the winner is chosen and notified, and what happens to entrants' personal information.

Compliance checklist for your agency

Work through these items before your next campaign goes live:

Confirm whether your agency is an APP entity (turnover above $3 million, or a carve-out applies) and, if so, publish a compliant privacy policy and collection notices.
Put a client services agreement in place covering scope, fees, IP ownership, confidentiality, a liability cap and termination.
Review your standard terms for unfair terms, and add a clickwrap acceptance flow to your website.
Keep written evidence that every factual claim in every campaign can be substantiated.
Build consent records for every marketing list, include an unsubscribe in every message, and never infer consent from a published address alone.
Use only licensed content, and keep the licences on file.
For competitions, confirm in advance whether a permit is needed in each state where entrants can participate, and prepare full terms and conditions.

Where a lawyer can help

A commercial lawyer can take most of this work off your plate. A practitioner can draft your client services agreement and website terms, review your privacy policy and data handling clauses against the APPs, stress-test the substantiation behind your claims, prepare competition terms and conditions and handle permit applications, and put IP assignments and licences in place. Much of the value is in the review: a lawyer who knows how the ACCC, the OAIC and the ACMA actually enforce these regimes can tell you which standard clauses are enforceable and which claims are risky before they are published.

Start with a data and claims audit

The obligation that catches marketing agencies by surprise is usually substantiation. The ACCC does not need to show that anyone was actually misled, only that the overall impression of a campaign was likely to mislead, and the agency that produced the campaign often ends up in the frame alongside the client.

This week, do two things. Map where personal information flows through your business: what you collect, where it is stored, who can access it and how long you keep it. Then list every factual claim currently live in your campaigns and confirm each one has a written basis. If either exercise throws up gaps, treat them as the priority. Misleading conduct has no size threshold at all, and privacy penalties start well below where most agencies think they do, so these are the two areas where a small agency can carry a large exposure.