What you need to know:

• The ACCC has released a new consultation paper to review instances of unsolicited selling and lead generation practices in the Australian market.
• The paper was triggered by a complaint made by the Consumer Action Law Centre under the ‘designated complaints framework’ introduced to the Competition and Consumer Act 12 months ago alleging unlawful, consumer-harming sales practices occurring in market.
• As well as traditional sales practices such as doorto-door and phone sales, the new review is also looking to gauge the impact and role social media advertising and buy now, pay later services have within the context of unsolicited selling and lead generation today.
• The problem is, there are plenty of overlapping regulatory mechanisms in pay in Australia to deal with such unsolicited sales practices – from the Do Not Call register to Spam Act, Corporations Law and the Privacy Act. Each is maintained by different regulatory bodies, adding complexity to the mix and some grey areas. A notable one is what denotes an ‘invitation’ versus ‘consent’ from a consumer to use their personal information for the purposes of sales and direct marketing.
• For ADMA Regulatory and Advocacy Working Group and Principal of Data Synergies, Peter Leonard, the ACCC’s latest consultation paper is also a signal of the potential impatience regulators feel around the Government’s delay on introducing more transformative changes to Australia’s Privacy Act under the highly anticipated ‘tranche 2’ of reform promised preelection.
• Privacy Commissioner, Carly Kind, signalled her own impatience and eagerness to pursue action through judiciary means while waiting for bigger changes to come to Mi3 recently, something she believed was important to remove ambiguity for the marketing and advertising industry.

Australian regulatory bodies such as the ACCC appear to be losing patience with the speed of Government progress on Privacy Act reform and are stepping up their consumer protection game to fill the gap.

That’s the view of chair of ADMA’s Regulatory and Advocacy Working Group and Principal of Data Synergies, Peter Leonard, who spoke to Mi3 after a new ACCC consultation paper reviewing unsolicited selling and lead generation – including the role of advertising on social channels – went public.

The ACCC’s latest consultation paper was triggered by a complaint by the Consumer Action Law Centre (CALC) under a ‘designated complaints framework’ introduced into Australia’s Competition and Consumer Act 12 months ago. This new mechanism allows select entities to formally lodge a complaint for activities that may amount to a breach of the Consumer Act, or which may indicate significant or systemic issues affecting consumers or small businesses.

In this case, CALC has alleged harmful, unsolicited sales practices are commonplace in Australia, and that individual businesses are often breaching multiple provisions of Australia’s Consumer Law (ACL) using unsolicited sales to market their goods or services.

The challenge is there are already well-established provisions in place to regulate potential unsolicited selling, direct marketing and lead gen using a consumer’s personal information without authorisation. These include the Do Not Call Register, Spam Act, Australian Privacy Law, the Australian Corporations Act and provisions for unfair or misleading practices under Australian Consumer Law.

With so many overlapping provisions in existence in Australia – albeit in the hands of several regulators – Leonard, typically a business-consumer moderate, was perplexed by what the latest consultation paper would achieve in parallel. “It is very hard to work out what their concern is exactly and how it’s a concern, because it’s such a complex area where various bits of legislation bump up against each other,” he said.

“I think some of the other regulators are perhaps starting to lose some patience with the speed of privacy reform and are looking to fill gaps that have been there, or address uncertainties. These are uncertainties that might have been addressed or should have been addressed through privacy reform, by changes to other legislation.”

Privacy Commissioner, Carly Kind, flagged appetite for firmer action in a recent interview with Mi3 around new enforcement and investigative powers gained under ‘tranche 1’ of Privacy Act reform, and where her sights are focused while we wait for more transformative changes expected under ‘tranche 2’. In short, she's planning to test the boundaries of current consumer law rather than wait for further powers to be handed down.

“We are equally resolved now to move ahead with an enforcement agenda independently of those [tranche 2] reforms because there is a lot of uncertainty there about what's going to happen,” Kind told Mi3. “But I've got a pretty clear-eyed vision of how to achieve some of the same ends through quite robust enforcement, and I think that that will hopefully have the same effect to increase the cost of non-compliance, to incentivise investment in privacy, to bring privacy to the attention of the C suite, etc. That's really where we're putting our time and resources currently.”

The redefinition of what constitutes “personal information” expected in Tranche 2 presents fundamental challenges for current practices in marketing, advertising and data trading. And it’s a key area under Kind’s focus – regardless of whether that second set of changes are enacted.

“We can achieve some of those clarifications through judicial interpretation, which we can secure in enforcement proceedings,” Kind said. “What we would be aiming at would be to try to both be enforcing the Privacy Act in appropriate circumstances but also to be getting judges to essentially endorse our interpretation of various terms in the Privacy Act. We’re certainly not sitting around waiting for tranche 2.”

The complaint that triggered it

The latest ACCC consultation paper on unsolicited selling and lead gen was made possible under a new designated complaints function formalised last year. ACCC Chair Gina Cass-Gottlieb said the intention was to reinforce the importance of tackling key and emerging issues impacting consumers and small businesses.

“A number of our successful compliance and enforcement outcomes have come about from referrals to us by consumer or small business advocacy groups, so we welcome this proposed measure that will provide an official avenue for this information,” Cass-Gottlieb said at time of launch. “We consider it will reinforce public confidence in the responsiveness of the ACCC to the competition, consumer and fair-trading issues significantly impacting the community.”

It also comes after the ACCC gained the ability to impose substantial penalties of up to $50m for contravening certain competition and consumer laws recognised under the Competition and Consumer Act in November 2023. In October 2024, the ACCC then scored an extra $30 million over three-and-a-half years to bolster its investigations and enforcement activities specifically in the supermarket and retail sectors, money it is now putting to use.

In this latest ACCC paper, CALC has alleged harmful, unsolicited sales practices are commonplace in Australia, and that individual businesses are often breaching multiple provisions of Australia’s Consumer Law using unsolicited sales to market their goods or services. In addition, the complaint alleges some businesses are circumventing the requirements for unsolicited consumer agreements by using lead generation tactics to obtain an invitation from consumers to come to their home, or to obtain consent to be contacted over the phone.

CALC is one of three potential complainants eligible to make a complaint in this context – the others are CHOICE and the Council of Small Business Organisations Australia.

Social media selling

What’s interesting is the ACCC’s resulting consultation paper also brings social media into its scope and “the role of advertising on social media channels”.

“This scope means that sales occurring from leads initially generated online, for example through a consumer responding to a social media post, may not clearly fall under the unsolicited consumer agreement provisions. As a result, the dealer obligations and consumer protections within these provisions may not always apply to such sales,” the paper states.

In addition, the ACCC outlines other substantial changes to consumer markets since the ACL was introduced in 2011, necessitating a broader review of unsolicited selling and lead generation activities. On the list besides the rise of social media platforms and decline in the use of landline phones are: Changes in the types of consumer goods and services sold through unsolicited sales, including consumer products related to the transition to renewable energy; new types of finance, including the emergence of buy now, pay later (BNPL); and legislative reform to the unsolicited consumer agreement provisions in the ACL.

“Businesses often seek leads online by creating content (or using third parties to create content) designed to engage potential customers. Such online content might be delivered through a social media post or email campaign. This content sometimes links to a landing webpage prompting the potential customer to take action, such as signing up to a newsletter, request a free sample or enter a competition,” the paper states. “In some of these cases, a lead may have more clearly shown an interest in a particular business or good or service by providing information such as contact details to obtain further information about the business or good or service. In other cases, it may be less clear or unclear to a person that their details are being collected for lead generation.”

Current overlapping provisions

Like Leonard, Clayton Utz competition partner, Adrian Kuti, pointed out unsolicited selling and lead generation has always been regulated under Australian Consumer Law – both under specific provisions but also through the more general provisions of the ACL prohibiting misleading and deceptive conduct and other unfair practices such as unfair contracts and unconscionable conduct.

“The issues that the ACCC has identified for further investigation and public consultation certainly raise parallel issues under the Privacy Act, Spam Act and Do Not Call register and the ACCC acknowledges this expressly in its paper,” Kuti said.

“The ACCC has previously taken numerous actions under these provisions against retailers across a range of sectors – energy, telco, health / pharma, and general retail. However, this review will take a broader brush look at these practices, rather than specific conduct of specific businesses and consider whether the current consumer protection provisions in the ACL and the specific unsolicited consumer agreement provisions remain fit for purpose or whether new practices and the proliferation of new technologies – in particular, social media – may warrant further regulatory reform in this space.”

Other statutory provisions playing a role in regulating consumer protections for unsolicited selling and lead generation are the Do Not Call Act Register Act 2006, administered by the Australian Communications and Media Authority (ACMA), plus the SPAM Act 2003 (ACMA again), which prohibits sending commercial electronic (email or SMS) messages to telephone numbers on the Do Not Call Register, unless prior consent has been received. The third mechanism is sector specific laws regulating unsolicited offers of particular products and services such as the Corporations Act 2001 (administered by ASIC), which prohibits ‘hawking’ or unsolicited offers or the sale of financial products to retail clients.

Finally, there’s direct marketing using personal information, which to an extent is covered by the Australian Privacy Principles, currently the subject of Government review. APP 7 of the Privacy Act 1988 (this time administered by the Officer of the Australian Information Commissioner) broadly states an organisation must not use or disclose personal information that it holds about an individual for the purposes of direct marketing, with some exceptions.

The catch here, however, is small businesses with under $3 million per annum in revenue are exempt from APP 7 under the current stature of the Privacy Act – something the Government could axe under the more disruptive, substantive ‘tranche 2’ of its Privacy Act Overhaul. The first tranche of changes, ratified last December, included heftier legal consequences for the malicious release of personal data online – known as ‘doxxing’, more protection for children online, a new statutory tort to pursue serious invasions of privacy, and new transparency rules for automated decision making.

Leonard pointed to another problem: Inconsistency in language used across these various regulatory mechanisms, such as a consumer’s ‘consent’ versus ‘invitation’ to deal with an organisation.

“I do think it’s unfortunate you then get into difficult arguments about if an invitation from a consumer is different to consumer consent, and is consent for APP7 different from consent for the SPAM Act and Do Not Call Register Act,” he said. “It’s pretty clear as it stands at the moment that consent in APP7 is different to these two other acts. But the difference between consent from a consumer or invitation from a consumer? There’s no case law on it. You look at the words and can’t reconcile and give one interpretation that would apply across all statutes. It’s messy.”

Marketing’s provisions knowledge gap

Leonard and industry associations such have ADMA have already identified several problems that arise because marketing activities are regulated under a variety of statutes. One is the way APP7 is interpreted and how it should be applied – which may come in tranche 2 of Privacy Act reform.

“Meanwhile, you've got concerns arising in other areas which are not currently regulated by the Privacy Act or regulated applying different definitions of consent or invitation. Because the Privacy Act isn't applying, people are saying, well, hang on, there's a loophole,” he said. “Well, yes, in the sense that the Privacy Act doesn't regulate it. But of course, it doesn't regulate it because we've got a small to medium business enterprise exception. Is that a loophole in the other act, or is it a deficiency in the Privacy Act? It depends on what your view is about the small to medium business exception.”

The other question Leonard raises here is: Where is the best place to deal with this kind of unsolicited sales engagement?

“What this discussion paper is saying is that this consumer group has raised a concern that lead generation is being used by some entities to make offers to consumers that otherwise would be regulation by these provisions. What I gather is their [complainant’s] concern is that those entities are able to offer the consumer something as the concern has invited them to make an offer, and therefore it is not regulated as an unsolicited offer,” Leonard said. “Either that, or the consumer has been targeted presumably through the use of personal information in a lead generation way, through these contacts, and that it’s not regulated under these provisions. I’m not sure how that could be the case for, unless it is from one of those many entities not regulated by the APPs.”

B2B implications

Both Leonard and  specialist B2B agency Green Hat MD, Stuart Jaffray, have been on the receiving end unsolicited sales calls even though they’re individually listed on the Do Not Call Register.

“I stopped and did think to myself, well hang on a minute: It’s not grey. There appears to be within the B2B space, a sense that the [customer contact] number is in the public domain and [therefore] I can use it for marketing purposes. But legislation is quite clear on this,” Jaffray said, speaking about the ACCC consultation paper from a B2B perspective. “We certainly wouldn’t be advocating for our client base to do this, but it’s certainly going on in our industry.”

Jaffray’s point is that while legislation commonly uses the term ‘consumer’, it’s still clear unsolicited lead gen and selling practices in the B2B space are covered.

“In the world of B2B as well, a lot of smaller organisations list their mobile numbers on their websites and listings… it may be a number they use for the business as well as personal, and you could argue they’ve made that publicly available… But you’re still covered by the SPAM Act.”

A broader input for Jaffray is the changing nature of B2B buyer behaviours. Green Hat’s research shows B2B buyers now only reach out when three-quarters of the way through the journey. The buyer is also reaching out eight out of 10 times so the seller only instigates two out of 10 sales.  

From this, Jaffray’s view is ultimately legislation targets out-dated and inefficient ‘lead gen’. “That’s a good thing. It’s removing ‘nuisance’ and will push more B2B brands to rethink their strategies in line with the modern and sustainable practices that we promote to our clients,” he said. “I read this week that Apple's upcoming iOS 26 update will include a new call screening feature that will answer calls from unknown numbers, prompt the caller to state their name and reason for calling, and then provide a live transcript of their response on the user's screen. Again, good!”

The ACCC’s consultation paper on unsolicited selling and lead gen is open for submission until 31 July.