Is LinkedIn outreach legal in Australia? What the Spam Act and Privacy Act mean for your messages

The rules at a glance

Two federal laws matter: the Spam Act 2003, run by the ACMA, and the Privacy Act 1988, run by the OAIC. LinkedIn's User Agreement sits on top of both.

What the Spam Act actually says

Section 5(1) defines an electronic message as one sent "to an electronic address in connection with: (i) an email account; or (ii) an instant messaging account; or (iii) a telephone account; or (iv) a similar account." For an instant message, the account-holder is "the individual or organisation who is responsible for the relevant instant messaging account" (s4). A LinkedIn inbox looks like an instant messaging account, but that is a reading of the text, not a ruling.

Section 6 makes a message commercial if, "having regard to" its content, its presentation and "the content that can be located using the links, telephone numbers or contact information (if any) set out in the message", one of its purposes is to offer or promote goods or services. That last part matters on LinkedIn. A friendly note with a link to your calendar or pricing page can be commercial because of where the link goes. King & Wood Mallesons wrote up a case where the ACMA found that social media links and a promotional banner made Ticketek's otherwise factual emails commercial; Ticketek paid $515,040 and gave a three-year enforceable undertaking.

Under s7 the Act applies if the message starts in Australia, the sender is here, or the recipient is here when they read it. So a Sydney founder messaging a buyer in Auckland or Singapore is still covered, with the local rules there on top. Our posts on outreach in New Zealand and outreach in Singapore cover those.

Consent is defined in Schedule 2 as "(a) express consent; or (b) consent that can reasonably be inferred from: (i) the conduct; and (ii) the business and other relationships" of the person. The route most cold B2B email relies on is conspicuous publication in clause 4. Clause 4(1) says consent "may not be inferred from the mere fact that the relevant electronic address has been published." Clause 4(2) infers it only when the address lets the public reach a particular employee or role, it "has been conspicuously published", it is reasonable to assume it was published with their agreement, and there is no statement saying they don't want unsolicited commercial messages. Even then, the message must be "relevant to the work-related business, functions or duties" of that person.

Every commercial message must also "clearly and accurately" identify who authorised it, with contact details valid for at least 30 days (s17), and state clearly that the person can unsubscribe through an address in the message that works for 30 days (s18). A withdrawal takes effect within 5 business days.

Penalties are civil and set in penalty units (s25). A company with no prior record faces up to 100 penalty units per contravention, capped at 2,000 for all contraventions on one day; with a prior record, 500 and 10,000. ASIC lists the Commonwealth penalty unit at $364 from 1 July 2026. Our arithmetic: up to A$36,400 per unsolicited message and A$728,000 a day for a first offender. The ACMA can also issue infringement notices.

What the Privacy Act adds

The Privacy Act only binds businesses above a size line. Under s6D(1) a business is small, and exempt, if its "annual turnover for the previous financial year is $3,000,000 or less". The exemption is lost by a business that discloses personal information "for a benefit, service or advantage", or pays to collect it, so data sellers and buyers are caught unless people consented. The Spam Act has no such turnover line, so a two-person startup is still bound by it.

For businesses inside the Act, APP 3 says to collect "only by lawful and fair means" and "only from the individual unless … it is unreasonable or impracticable to do so". APP 7.3 allows direct marketing with information collected from someone else, such as a public profile, only with consent or where "it is impracticable to obtain that consent", and then each communication needs "a prominent statement that the individual may make such a request" to opt out. If someone asks where you got their details, you must tell them. APP 7.8 switches APP 7 off to the extent the Spam Act applies. The Act also covers overseas organisations that carry on business in Australia (s5B(3)).

The law is moving. The 2024 amendments added a statutory tort for serious invasions of privacy from 10 June 2025 and privacy policy rules on automated decisions from 10 December 2026, and left the small business exemption alone. A 2026 exposure draft, open for comment from 31 August to 18 September, would replace APP 3's collection rules with a single "fair and reasonable" test and says "The framework does not require consent for direct marketing, but entities must obtain consent to trade personal information". It "remains subject to further consideration by government".

What nobody has tested yet

We found no court decision or regulator page that settles these, so we give no verdict.

1. Whether a LinkedIn message or InMail goes to "an instant messaging account" or "a similar account" under s5. We could not load the ACMA's site to check its current guidance, and nothing we did read names LinkedIn.
2. Whether a connection request note is a commercial electronic message. It turns on the s6 purpose test, and that test includes linked content, which on LinkedIn could mean your profile.
3. Whether a LinkedIn profile counts as a conspicuously published address under clause 4. The clause is written around a published address the public can use, plus the work-relevance test.
4. How APP 7's "impracticable to obtain consent" limb applies to leads taken from public profiles.

On scraping in general, the OAIC and 11 other regulators said in August 2023 that "Personal information that is publicly accessible is still subject to data protection and privacy laws in most jurisdictions". Microsoft, LinkedIn's owner, was among the companies they wrote to.

When to send: reach, clocks and the Australian calendar

LinkedIn's ad tools showed 18.0 million members in Australia in late 2025, 84.7% of adults, per DataReportal; those are registered accounts, not monthly users. In 2024 LinkedIn's ANZ country manager told Forbes Australia that 15 million of the country's 16 million workers and tertiary students were on it.

Timing matters. Green Hat and 6sense's 2025 APAC buyer study, as reported by ContentGrip, found the vendor at the top of the shortlist won 76% of the time and 95% of winners were on the day-one shortlist. That is the case for reaching people when a signal appears, such as a job change, a hiring push or engagement with a competitor's posts.

Australia is not one time zone. NSW daylight saving runs from Sunday 4 October 2026 to Sunday 4 April 2027, and Queensland, Western Australia and the Northern Territory don't observe it. Our arithmetic from the standard offsets: from October to April the country runs on five clocks, from UTC+8 in Perth to UTC+11 in Sydney, Melbourne, Hobart and Canberra, with Adelaide half an hour behind them and Brisbane an hour behind. In summer, 9am in Sydney is 6am in Perth.

The financial year starts on 1 July; the Acts Interpretation Act defines it as "a period of 12 months starting on 1 July". If your buyers budget on that year, aim to be in the conversation before it closes on 30 June. Public holidays differ by state. In NSW, Christmas is Friday 25 December 2026 with an extra day on Monday 28 December, Australia Day is Tuesday 26 January 2027, Easter runs from Friday 26 to Monday 29 March 2027 and the King's Birthday is Monday 14 June 2027. Queensland marks the King's Birthday on the first Monday in October instead.

The quiet stretch is the summer school break. Victorian schools finish on Friday 18 December 2026 and start again on Wednesday 27 January 2027; NSW Eastern division students return on Thursday 28 January. That is when parents take leave. We think replies drop in that window, but that is our inference, not a measured figure.

Choosing a tool for outreach in Australia

Here is what we could check on Bingle's own pages on 24 October 2026. We make Bingle, so weigh this section with that in mind. For the questions to put to any vendor, from the A$ cost and GST to where your data is held, see how to choose a LinkedIn outreach tool in Australia.

Bingle watches LinkedIn for buying signals, from comments on your competitors' posts to job changes, hiring and funding, and ranks the people who fit your ideal customer by fit and timing, with the reason shown. It writes each message in your voice, and message drafts wait in an approval queue for your OK unless you switch review off for that sequence, which gives you a place to check each one has your name, your business and an opt-out line. Any reply stops the sequence. It sends from your own LinkedIn, spaces actions through the day and stays inside LinkedIn's daily limits; each sequence has a send window with its own hours, days and timezone, so a Perth list can run on Perth hours. Plans are US$49, US$79 and US$149 a month after a free week; see pricing.

Parts of Bingle were built for Australian sellers in particular:

• Your LinkedIn signs in from Australia. When you connect your account, Bingle pins its connection to the country you connected from, so LinkedIn doesn't see your login suddenly coming from the US or Europe, a common cause of security checks.
• Your leads and messages are held in Sydney. The app and its database both run there; some services, the AI providers included, may process data outside Australia.
• It reads Australian business news. When your ideal customer is in Australia, company news comes from Google News' Australian edition, so the reasons it gives you to write are local ones.
• Australian government contract wins count as a buying signal. Bingle reads AusTender's award notices, from A$500k up, and finds the people at the supplier who now have funded work to deliver.
• It knows Australian places. "Greater Sydney Area", "NSW" or "Queensland" on a profile reads as Australia, New South Wales isn't mistaken for Wales, and "ANZ", "Australasia" or "APAC" in your ideal customer covers the right countries.
• LinkedIn voices to watch are ranked by how close they are to your market: people based in Australia first, then the rest of ANZ.

Where Bingle is the weaker pick: it is LinkedIn only, with no email sequences, no contact database and no phone numbers. Profile visits, likes and blank invites run without a review step. And LinkedIn's User Agreement says it doesn't permit third-party software that automates activity on its site, so any tool that sends for you carries account risk. If that worries you, switch off automatic sending in Bingle and each step lands in a Today's sends list for you to send by hand.

Invitation numbers: LinkedIn's connection request limit.

Questions

Sources

1. Federal Register of Legislation, Spam Act 2003 (compilation 10 Mar 2016). read 24 Oct 2026
2. Federal Register of Legislation, Privacy Act 1988 (compilation 4 Jun 2026). read 24 Oct 2026
3. Federal Register of Legislation, Acts Interpretation Act 1901, s2B (compilation 28 Mar 2026). read 24 Oct 2026
4. ASIC, Fines and penalties. read 24 Oct 2026
5. King & Wood Mallesons, Spam Act fine for social media links. published 1 Nov 2023; read 24 Oct 2026
6. Attorney-General's Department, Privacy reform consultation. read 24 Oct 2026
7. Office of the Privacy Commissioner of Canada, Joint statement on data scraping. published 24 Aug 2023; read 24 Oct 2026
8. LinkedIn Help, Prohibited software and extensions. read 24 Oct 2026
9. LinkedIn Help, Types of restrictions for sending invitations. read 24 Oct 2026
10. DataReportal, Digital 2026: Australia. published 5 Nov 2025; read 24 Oct 2026
11. Forbes Australia, 15 million and counting: inside the rise of LinkedIn in Australia. published 19 Sep 2024; read 24 Oct 2026
12. ContentGrip, report on Green Hat's 2025 APAC B2B buyer journey study. published 25 Oct 2025; read 24 Oct 2026
13. NSW Government, Daylight saving. read 24 Oct 2026
14. NSW Government, Public holidays. read 24 Oct 2026
15. Queensland Government, Public holidays. read 24 Oct 2026
16. Victorian Government, School term dates and holidays. read 24 Oct 2026
17. NSW Department of Education, Future and past term dates. read 24 Oct 2026

More from the blog

• Is LinkedIn outreach legal in New Zealand? What the spam law and IPP 3A mean for your messages
• Is LinkedIn outreach legal in Singapore? The Spam Control Act, the PDPA and Do Not Call explained
• How to choose a LinkedIn outreach tool in Australia (prices in A$)
• How many LinkedIn connection requests can you send a week in 2026?
• What to message a prospect who viewed your LinkedIn profile
• How to score LinkedIn leads by fit and intent (with a worked formula)

All posts