Is lead generation legal in Australia? Rules for buyers and sellers

Published 7 October 2026 · ACMA and OAIC guidance read in full on 6 and 7 October 2026 · By Target Digital · 11 minute read

Finding people who might want your service is legal in Australia, but how you contact them is regulated, and the rules are the same whether a person or an AI does the contacting. Three laws cover most lead generation: the Do Not Call Register Act for calls, the Spam Act for email, SMS and instant messages, and the Privacy Act for direct marketing that the first two do not reach.

This guide is for a business that buys leads, runs ads, or hires someone to generate leads for it. It sets out what each regime requires, where bought leads create risk, and the questions to ask a supplier. It is general information, not legal advice. For the detailed rules on calls and texts, see our AI outbound calling compliance guide and our Spam Act guide.

Is lead generation legal in Australia: the three regimes

The OAIC's direct marketing guidance sets out which law applies to which channel:

Marketing claims also fall under the Australian Consumer Law, covered at the end.

Calls: the Do Not Call Register and the Industry Standard

You cannot make telemarketing calls to a number on the register unless the person has consented or you are an exempt entity such as a registered charity, according to the OAIC. ACMA says the register does not apply to business numbers, because numbers primarily for business use cannot be registered. The register is not the whole story. The OAIC says the Industry Standard applies to any person or business making telemarketing or research calls, whether or not they are exempt, and covers when calls cannot be made, what must be said, when calls must end and caller identification.

One obligation matters for anyone who outsources calling. The OAIC says you must ensure that all agreements for the purpose of making telemarketing calls include an express provision requiring compliance with the Do Not Call Register Act. Check that your agency or provider contract has it. Our guide to calling leads on the Do Not Call Register covers checking lists and consent.

Messages: the Spam Act applies to business contacts too

ACMA's Statement of Expectations on consent says that for e-marketing, consent must be obtained before messages can be sent, including to businesses. In our reading, that means there is no general exemption for business-to-business email or SMS. The same statement says not to send messages based solely on the fact that an email address or phone number has been published, because publication does not mean consent has been given and other conditions must be met. It also says a person visiting a website or emailing a business is unlikely to have consented to inclusion on a marketing list. Consent can be express or, in limited cases, inferred from an existing relationship.

ACMA's guidance on avoiding spam adds two points relevant to lead generation. You cannot use or supply a list created with address-harvesting software, and if you buy or use a marketing list you are still responsible for making sure you have consent for each address. The OAIC notes that a partial exemption applies to certain messages, such as messages of a factual nature only without a commercial element, A plain booking confirmation may fall into that category, but a message with promotional or sales content is commercial, so take advice before relying on an exemption.

The Privacy Act: who it covers, and why lead sellers are caught

The OAIC says APP 7 applies to businesses with annual turnover above $3 million and to some small businesses, including private sector health service providers and businesses that buy or sell personal information. A small lead-generation business that sells contact details is, in our view, likely to be covered even if its turnover is low.

Where APP 7 applies, the OAIC says personal information can be used for direct marketing only if you collected it directly from the person and they would reasonably expect it to be used that way, or they consented, or getting consent is impracticable. You must also provide a simple way to opt out, stop using the information on request, and if asked tell the person where you got their information, generally within 30 days. Sensitive information, including health information, needs consent.

The OAIC also answers a question many lead generators ask. A business can use publicly available information, such as material on the internet, but APP 7 still requires the person's consent or that consent be impracticable, along with an easy opt-out, and the business must consider the Do Not Call Register Act and the Spam Act.

Buying leads: where the risk sits

Buying leads is lawful, but responsibility stays with you. ACMA's statement says businesses are responsible for their consent-related obligations regardless of whether they outsource telemarketing, e-marketing or consent gathering through third-party or affiliate arrangements. It adds that you should not assume third parties keep records of consent, and that you need oversight and assurance processes so those records are kept reliably. If ACMA requires the records, they must be produced.

ACMA also says consent terms should cover what the consent is for, who will use it, including affiliates and partners, how long it will be used and how it can be withdrawn. A consent that was given to one company may not cover you. Its list of practices that will generally not meet its expectations includes pre-checked tick boxes, bundled consent, refer-a-friend arrangements and sending messages solely because an address was published.

Questions to ask a lead supplier

1. How did each person consent, and what exactly did they agree to? Ask to see the form and the wording.
2. Does the consent name my business or a defined group of buyers, or is it a general permission?
3. When was it given? ACMA's statement gives telemarketing consent older than three months as an example of stale consent, unless the person agreed to a longer period.
4. Can you give me the record for each lead: the method, the terms, the date and the time?
5. Are the leads exclusive, or sold to several buyers?
6. What happens when a person opts out, and how do I hear about it?
7. Does our contract require compliance with the Do Not Call Register Act and the Spam Act, and who pays if a lead has no valid consent?

Cold outreach and AI

None of these rules has an AI exception. ACMA's statement says commercial calls that use pre-recorded or AI voices are all telemarketing calls. In our view, an AI sending texts must follow the Spam Act as a person would. Automation raises the stakes because one error repeats at scale. See our guides to whether AI lead generation works and to AI caller disclosure.

Claims about your leads and results

The Australian Consumer Law bans misleading or deceptive conduct. The ACCC notes that "It makes no difference whether a business intends to mislead or not." If you sell leads or promise results, every figure you publish has to be accurate. If you buy leads on the strength of a supplier's claims, ask for the definition of a lead and the evidence for the numbers, as our guide to lead generation pricing explains.

What enforcement looks like

ACMA publishes its penalties. In July 2026 it announced that TAB paid more than $2.7 million for telemarketing and spam breaches. In March 2026 it said Lululemon paid $702,900 for sending more than 370,000 emails with no unsubscribe option. Those are large businesses, but the pattern holds for any size: a missing consent check, a missing unsubscribe or a mislabelled message, repeated across a list.

A compliant lead-generation process

1. Collect leads through forms that carry a specific, unticked consent box covering the channels you will use. Our guide to consent to call from a lead form shows how.
2. Store the consent record with each lead: wording, method, date and time.
3. Check numbers against the Do Not Call Register where consent does not cover calls.
4. Keep calls inside permitted hours and say who is calling and why.
5. Put your name, contact details and an unsubscribe in every commercial message.
6. Honour opt-outs quickly and across every channel.
7. Put compliance clauses in every agency, supplier and provider contract.
8. Review the process regularly. ACMA says compliance arrangements should be reviewed regularly.

Where we fit

Our AI Outbound Call Engine sends an instant text and an AI call after a form submission. Our AI Lead Gen Engine, as our site describes it, finds and captures prospects, then qualifies them and books sales calls. Whichever provider you use, including us, ask the supplier questions above and ask where contacts come from and how consent is recorded. We would expect you to.

Is lead generation legal: common questions

Is buying leads legal in Australia?

Yes, but you remain responsible for consent. ACMA says businesses are responsible for their consent obligations even when they outsource consent gathering to third parties or affiliates, and that you should not assume a supplier holds the records.

Can I cold call businesses?

Numbers used primarily for business cannot be registered, but ACMA says a phone used for both business and personal calls can be registered if personal use is more than 50 percent of the total, so a sole trader's mobile may be on the register. The Industry Standard on call hours, identification and ending the call applies to telemarketing calls, and APP 7 may apply. Check the list and take advice before relying on this for a campaign.

Can I email or text business contacts without consent?

Generally no. ACMA says consent must be obtained before e-marketing messages are sent, including to businesses. That means express consent or, in limited cases, inferred consent from an existing, relevant relationship. ACMA says not to send solely because an address has been published.

Is it legal to scrape contacts from the internet?

ACMA says you cannot use or supply a list created with address-harvesting software. The OAIC says publicly available personal information can be used for marketing, but APP 7 still needs consent or impracticability and an opt-out, and the Spam Act and Do Not Call Register Act still apply.

What is the penalty for getting it wrong?

It depends on the law and the conduct. Our compliance guide sets out the Do Not Call Register Act penalty units and the current unit value, and ACMA publishes each penalty it announces.

Next step

If you buy leads, run ads, or use an agency, a 30-minute call is enough to walk through your consent wording, your records and your supplier contracts. We will tell you what we would change. This is general information, not legal advice.

Book a 30-minute intro callUse the calculator