You’ve got a list of 10,000 email addresses. You collected them years ago with a form, a pop-up, or a sign-up sheet. You still think they’re valid. But have you confirmed any of them are still willing to hear from you?

That’s forgotten consent. It’s not about invalid addresses — it’s about outdated permission. If you’re sending emails without recent, active opt-in, you’re risking a breach of the Spam Act 2026, even if you collected those addresses legally at some point.

Consent under the Act isn’t a one-time checkbox. It must be current, specific, and demonstrable at the time of each send. No longer a formality — it’s a continuous obligation.

Key takeaways

  • Forgotten consent occurs when past permission isn't actively verified before sending emails under the Australian Spam Act.
  • Consent must be current, specific, and demonstrable at the time of each message — outdated opt-ins don't count.
  • Failure to verify consent can lead to penalties, including fines up to $2.2 million for serious breaches.

You risk spam complaints, sender reputation damage, and inbox placement failure when you send to Australian email addresses where consent has expired or gone inactive—especially if they haven't engaged in 18 months or more. Even validly collected addresses can harm your deliverability if they’re ignored or marked as spam, which signals to ISPs that your content lacks relevance. Tools like MailTester’s real-time verification can help identify risky or unengaged addresses before they cause problems.

Spam filters and ISPs track complaint rates, not just sender reputation. If a user marks your email as spam—even once—it lowers your sender score, even if the address was technically valid. Inactive subscribers who don’t open or interact with your emails are more likely to report you, which ISPs monitor closely. This risk increases over time; email addresses that haven’t engaged in 18 months are statistically more likely to be flagged, regardless of how they were collected.

Even compliant, properly consented lists can trigger filters if they include stale contacts. ISPs like Gmail, Outlook, and Yahoo apply engagement thresholds and automatically deprioritize or block senders with high complaint-to-engagement ratios. This isn’t about the address being invalid—it’s about relevance. If your list includes old or unused addresses, your deliverability drops, even if every email is legal under the Spam Act.

What happens when reputation is damaged

Once your sender reputation dips, even small increases in spam complaints can cause immediate spikes in inbox filtering. A single large complaint from a disengaged contact can trigger automated responses from ISPs, resulting in hard bounces or delivery to the junk folder. This isn’t theoretical—industry data shows ISPs like Microsoft and Google use behavioral signals (like open rates, click rates, and complaint data) to make real-time delivery decisions.

Let’s be clear: compliance isn’t just about collecting consent. It’s about maintaining it. If you’re still sending to old addresses after 18 months with no open or click, that’s not just risky—it’s a violation of the spirit of the Australian Spam Act. The Australian Communications and Media Authority (ACMA) evaluates sender practices, not just technical compliance.

Use MailTester’s bulk verification to flag inactive or low-engagement addresses before sending. You can also test delivery via inbox placement to see where your emails land in real inboxes—even before a campaign launches. It’s not enough to collect consent. You must verify that it still matters.

“Engagement is the best predictor of deliverability—not just compliance.”

You can identify forgotten consent by systematically reviewing your email list for inactive addresses, invalid domains, and high-risk email types. Use real-time verification to remove non-existent addresses, tag accounts with no engagement in 12–18 months, and flag role-based, disposable, or catch-all emails that rarely respond. This reduces compliance risk under the Australian Spam Act and improves list health.

Run a real-time verification to filter invalid addresses

  • Use a verification API to check every address in your list for syntax, domain validity, and inbox presence before sending.
  • MailTester's real-time verification API checks against live mail servers and flags common invalid patterns.
  • Removing invalid emails reduces bounce rates and protects sender reputation, which affects deliverability under the Spam Act.

Tag and segment non-engaging addresses

  • Flag any address with zero opens, clicks, or link activity over the past 12–18 months. These are likely forgotten consent records.
  • Consider engagement thresholds based on your content frequency; weekly sends justify a 6-month inactivity cutoff.
  • MailTester's bulk verification includes bounce and engagement detection to highlight non-responsive addresses.

Flag high-risk email types

  • Identify and isolate role accounts like info@, admin@, or sales@—these seldom indicate real users and are rarely consented.
  • Filter out disposable email domains (e.g., mailinator.com, tempmail.org) that lack long-term value.
  • Watch for catch-all domains, which accept all incoming messages but often belong to automated or low-engagement accounts.
  • Use MailTester's email checker to validate individual addresses during onboarding or list cleanup.

These hygiene steps aren't just technical—they're compliance-focused. The Australian Spam Act requires that consent is ongoing and can be withdrawn at any time. If you can’t verify consent, it’s safer to assume it’s gone. Regular list cleaning reduces the risk of being flagged for spam complaints or listed on blocklists like Spamhaus.

Start by exporting your current email list from your platform. Use MailTester’s bulk verification API to check every address in real time. Filter out invalid, catch-all, risky, and role-based emails. Then, remove any valid addresses with no engagement in the past 18 months. These are likely forgotten consents under Australian Spam Act rules. Keep only those who still interact with your emails.

Preparation: Pull and clean your data

  1. Export your full list from your current email platform—Mailchimp, HubSpot, Klaviyo, or SendGrid. Include all subscriber data: email address, last interaction date, and signup source.
  2. Use MailTester’s bulk verification API to test every address. The API validates syntax, checks MX records, and confirms inbox existence in under 200ms per email. It’s designed for high-throughput, accurate validation without delays. Test your list with the full API for consistent results.
  3. Exclude high-risk verdicts: Discard any address marked as ‘invalid’, ‘catch-all’, ‘risky’, or ‘role’ (like admin@, marketing@). These pose delivery, compliance, or reputation risks.
  1. Review valid addresses with no engagement. Sort your remaining list by last open or click date. Focus on those with zero activity in the last 18 months. This period aligns with industry best practices for reconfirming consent.
  2. Remove or suppress inactive subscribers. These are your forgotten consents. Removing them reduces bounce rates, improves sender reputation, and keeps you compliant with the Australian Spam Act’s requirement for ongoing consent.
  3. Consider re-verification if needed. If you still want to contact these users, send a re-engagement campaign. Use MailTester’s email checker to validate before sending. Only proceed if you receive a positive response.

Let’s be clear: the Australian Spam Act requires consent to be current and active. Forgotten consent isn't consent at all. A review of ACCC guidance confirms that inactive or unresponsive users must be removed from active lists. You're not losing subscribers—you're reducing risk.

“Email hygiene isn’t just about delivery—it’s about legal compliance.”

Before re-engaging dormant contacts under the Australian Spam Act, verify each email address in real time using MailTester’s API. Only send to addresses marked 'valid'—those with high likelihood of being active and consented. Reject 'risky' or 'catch-all' results to avoid sending to unverified or non-existent addresses, which could breach consent requirements. This step reduces risk, improves deliverability, and keeps your sender reputation intact.

When re-engaging old contacts, you’re not just guessing—your reputation and compliance depend on accuracy. Use MailTester’s real-time verification API to check each address before a campaign. The API returns clear verdicts: 'valid' means the address is likely active and likely opted in. 'Catch-all' means the domain accepts mail but doesn’t confirm if the specific user exists—treat this as high risk. 'Risky' indicates possible spam traps, inactive accounts, or temporary addresses—exclusion is advised.

Let’s say you’re refreshing a 3-year-old list. Even if someone still has their old email, their consent may have lapsed. Sending without confirmation can lead to complaints, blocklists, and penalties under the Spam Act. Real-time verification filters out these risks early. You’re not just sending to fewer people—you’re sending to the right ones.

Automate with your existing tools

You don’t need to add manual steps. Integrate MailTester directly with platforms like HubSpot, Klaviyo, or SendGrid. The integration runs automatically—each time an address enters your funnel, it gets checked in real time. If it returns ‘valid’, proceed. If it’s ‘risky’ or ‘catch-all’, flag it for review or suppress it. This keeps your list clean without interrupting your workflow.

Spam filters and ISPs track sender reputation closely. One bad send can trigger filters. By verifying at scale, you avoid sending to invalid or suspicious addresses. This aligns with industry standards like those defined in RFC 3464—which outlines how systems should handle undeliverable messages. It’s not just about compliance—it’s about staying seen.

Start with 100 free verifications at MailTester’s bulk verification tool, then scale with the API for continuous validation. Keep your list healthy, your campaigns legal, and your inbox placement reliable.

How MailTester’s 98.9% accuracy supports compliance with the Spam Act

You can’t prove consent if you’re sending to invalid or inactive addresses. MailTester’s 98.9% accuracy ensures your list cleaning isn’t based on guesswork. By filtering out invalid, catch-all, disposable, and role-based emails, you reduce the risk of sending to spam traps—directly supporting your obligations under Australia’s Spam Act. A clean list lowers sender reputation risk and makes your consent verification defensible.

Real data, not assumptions

Most email validation tools give you a yes/no guess. MailTester goes further: it uses real-time SMTP checks and pattern recognition to distinguish between addresses that are temporarily down and those that are permanently invalid. This precision means you’re not removing active users by mistake or keeping dead addresses that hurt deliverability. A clean list isn’t just better for delivery—it’s part of building a legitimate consent record.

Reducing spam trap exposure

Role accounts (like admin@ or sales@) and disposable domains (like tempmail.org) are red flags under the Spam Act because they’re not tied to real individuals. MailTester tags and flags these, so you can remove them before sending. Catch-all domains accept any email, making them prime spam trap territory. Sending to them, even inadvertently, harms your sender reputation and can trigger enforcement action. By identifying and filtering these domains, MailTester helps you avoid accidental exposure.

You don’t need to maintain 100% clean data forever—but you do need to prove your process was sound when the ACCC audits you. MailTester’s verification API lets you validate emails in real time, so you catch invalid addresses before they get into your campaign. This is especially useful for sign-up forms or dynamic list updates where real-time validation protects your compliance posture.

For teams managing large lists, bulk verification ensures you’re not relying on outdated data. MailTester’s bulk list verification tool checks thousands of addresses quickly and returns clear, actionable results—valid, invalid, catch-all, or risky. You’re not guessing; you’re acting based on verifiable criteria. This consistency supports compliance, not just deliverability.

Naturally, your sender reputation is a key factor in Australian spam laws. The Spam Act doesn’t define a “reputation” metric—but a history of hard bounces, high complaint rates, or frequent spam traps leads to enforcement. By removing poor-quality addresses upfront, MailTester helps maintain a clean sending profile. It’s not just about preventing bounces; it’s about proving you’re acting responsibly.

What to do with addresses that failed verification or show no engagement

If you find email addresses that failed verification or haven’t engaged in over 12 months, stop sending to them immediately. Suppress these addresses in your email platform to prevent future bounces or spam complaints. Keep a record for audit or legal compliance—don’t delete them. If you suspect consent might still be valid, use a double opt-in campaign to re-verify. Only resume sending after a confirmed, renewed opt-in. This aligns with the Australian Spam Act’s requirement for ongoing consent.

Immediate actions when addresses fail verification

  • Stop all sending to addresses that return as invalid, catch-all, or role-based. These are high-risk for bounces and damage sender reputation.
  • Use your ESP’s suppression list feature to block these addresses from future campaigns. Most platforms like Mailchimp, Klaviyo, or SendGrid offer built-in suppression tools.
  • Verify these addresses using a trusted tool like MailTester’s bulk verification to confirm their status before acting. This ensures you don’t suppress a valid address by mistake.

Handling inactive or non-engaging addresses

  • Do not delete non-engaging addresses. The Australian Communications and Media Authority (ACMA) requires that organizations retain records of consent for up to 12 months after the last interaction.
  • If you believe consent may still exist, send a re-verification email using a double opt-in process. Include a clear message confirming the purpose of the email and the option to unsubscribe.
  • Only consider addresses active again after they complete the double opt-in. Do not assume continued consent based on past behavior.
  • Track engagement metrics—open rates, click rates, and bounce history—that signal whether consent is still valid. Low engagement over time, especially after 9–12 months, is a red flag.
You must not rely on past consent if there’s no recent engagement. Silence doesn’t mean ongoing permission.

When in doubt, treat the address as inactive. Use tools like MailTester’s inbox placement tester to simulate how your re-verification message might appear in real inboxes. This helps avoid deliverability issues during re-verification campaigns.

Remember: Australian Spam Act compliance isn’t just about opt-in—it’s about ongoing, demonstrable consent. Letting non-engaging or invalid addresses linger risks penalties, reputational harm, and delivery issues. Stay proactive, stay compliant.

The role of sender reputation in avoiding Spam Act penalties

Sender reputation isn’t just about inbox placement—it’s a key defense against Spam Act penalties. If your list includes unconsented or forgotten contacts, high bounce rates and complaint spikes can harm your reputation, triggering ISP filters and increasing the risk of enforcement action. Maintaining good reputation through list hygiene directly supports compliance with Australia’s Spam Act requirements.

How poor list hygiene damages reputation

When you send to addresses that haven’t consented—especially due to forgotten opt-ins—your bounce rate increases and spam complaints follow. Most ISPs track these signals, and spikes in either can flag your domain or IP as suspicious. This reduces your chances of landing in inboxes and can lead to blacklisting. Even a small number of invalid or unengaged addresses can degrade sender reputation over time.

Complaints are particularly sensitive. Under the Spam Act, each complaint counts toward compliance risk. If your complaint rate exceeds acceptable thresholds—often around 0.1% of total sends, as seen in industry benchmarks—it’s a red flag. ISPs like Gmail and Outlook use complaint history to decide whether your messages belong in the inbox, the clutter folder, or are blocked entirely.

Deliverability testing and ongoing monitoring

Let’s be clear: you can’t rely on guesswork. Regular inbox placement testing gives you a real-world measure of how likely your email is to be delivered and seen. Tools like MailTester’s inbox placement tester simulate real inboxes across major providers, showing whether your messages land in the primary inbox, spam, or are blocked.

Before you send—especially to large lists—run a bulk verification to weed out invalid, catch-all, or disposable addresses. Our system identifies non-deliverable addresses with 98.9% accuracy and flags risky or role-based addresses (like info@ or sales@) that could harm reputation. This isn’t just about reducing bounces—it’s about ensuring only engaged, legitimate recipients get your message.

Using MailTester’s real-time verification API in your signup or update workflow ensures you’re only adding verified, consented addresses to your database. This proactive step reduces future risk at scale. Maintaining a clean, consent-aligned list isn’t optional—it’s fundamental to protecting your sender reputation and meeting Australian Spam Act compliance standards.

As the Spamhaus Project notes, sender reputation is one of the strongest signals ISPs use for email filtering. A good reputation doesn’t just improve delivery—it builds trust, which is essential for long-term compliance.

Integrating list hygiene into your ongoing email strategy

You can’t rely on consent alone—if you’ve forgotten to verify your list, you’re not compliant. Australian Spam Act rules require active, ongoing consent management. Treat your email list like a living system: audit it regularly, verify every address before sending, and automate checks at every touchpoint. Let’s build that into your workflow.

Run scheduled list audits with automation

  • Schedule biannual list audits using email verification tools like MailTester’s bulk verification to catch invalid, catch-all, or dormant addresses.
  • Use the results to clean out addresses that no longer respond, reducing bounce rates and protecting sender reputation.
  • Automated tools can identify patterns of unengaged users, helping you stay ahead of compliance risks.

Verify every address before every send

  • Add email verification as a non-negotiable step before every campaign, especially re-engagement efforts that depend on valid, responsive addresses.
  • Use MailTester’s instant email checker to validate individual addresses in real time, catching syntax errors, invalid domains, or role accounts.
  • For larger campaigns, integrate the MailTester API to embed checks directly into your workflow—no manual work, full automation.

Integrate verification into your marketing stack

  • Connect MailTester directly with platforms like Mailchimp, SendGrid, HubSpot, or Klaviyo through native integrations, so every new subscriber or upload is validated before it enters your campaign queue.
  • This prevents invalid or risky addresses from ever making it into your sends, reducing deliverability risks and spam complaints.
  • Automation at the upload stage ensures consistency across teams and prevents accidental spamming of inactive or forgotten addresses.

Flag inactive addresses automatically

  • Monitor engagement trends to identify users who haven’t opened or clicked in nine months—longer than most industry standards consider active.
  • Set up triggers to flag such addresses, then either re-engage them (if you have consent to do so) or remove them from your list altogether.
  • Most email platforms use this window as a benchmark for inactivity—aligning with Australian spam laws means treating this seriously.
Consent under the Australian Spam Act isn’t a one-time checkbox. It’s an ongoing obligation tied to actual engagement and valid data.

By embedding verification, monitoring engagement, and acting on it, you’re not just avoiding fines—you’re building a sender reputation based on real consent. No more guesswork. No more wasted sends.

Under Australia’s Spam Act, consent isn’t a one-time event—it must be active and ongoing. Just because someone signed up a year ago doesn’t mean they still want your emails. Sending to inactive or forgotten subscribers violates the law, increases spam complaints, and can lead to enforcement actions. Proactive verification of consent is not optional—it’s a legal requirement.

Many teams assume old signups stay valid. But the Spam Act demands that consent remains current. If a person doesn’t engage with your emails for six months, they may no longer want them. Relying on past opt-ins without verification puts you at risk of sending to people who’ve effectively withdrawn their consent.

Without confirmation, you’re guessing. A single unverified address can trigger a complaint, and multiple complaints damage your sender reputation. The Australian Communications and Media Authority (ACMA) treats complaint volume as a key indicator of spam behavior, and even one complaint can prompt investigation.

Verification isn't just about deliverability—it’s compliance

Validating email addresses isn’t just about preventing bounces. It’s a compliance control. If you can prove you only send to confirmed, active subscribers, you’re protected under the Spam Act’s safe harbor provisions. The law doesn’t require perfect lists—it requires reasonable steps to maintain consent, and automated verification is one of them.

Tools like bulk email verification help you scrub outdated or invalid addresses, including those from inactive accounts. You can check whether an address still exists, is a catch-all, or belongs to a disposable domain—all without sending a message. This gives you a real-time view of your list health.

Integrating checks before every campaign ensures you're not sending to people who have opted out, forgotten, or whose emails are no longer valid. You’re not just improving deliverability—you’re maintaining compliance with Australia’s legal framework.

As the ACMA has made clear, sender responsibility includes ensuring ongoing consent. Proactive hygiene isn’t just good practice—it’s the foundation of legal compliance under the Spam Act.

Summary: Clean your list to stay compliant under the Australian Spam Act

Forgotten consent is a growing risk. Inactive or invalid emails weaken your sender reputation and increase exposure to enforcement under the Spam Act.

Real-time verification removes invalid, role-based, and non-responsive addresses before they cause bounces or complaints. This keeps your list accurate and your compliance posture strong.

Automate and maintain

Integrate MailTester with your ESP to validate new and existing contacts automatically. This eliminates manual work and ensures ongoing list hygiene.

A clean, engaged list improves inbox placement and protects your sender reputation. It’s the most effective way to stay legally safe and deliver messages reliably.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is the Spam Act 2026 in Australia?

The Spam Act 2026 regulates electronic messages, requiring sender consent, clear unsubscribe options, and accurate sender identification. It applies to all commercial emails sent to or from Australia.

How often should I clean my email list under the Spam Act?

At least every 6–12 months, or before any major campaign. Include verification for engagement status and address validity.

Only if you have a documented, active consent record. Otherwise, sending risks a breach under the Spam Act.

What does 'valid' mean in MailTester's verification verdict?

A 'valid' address is confirmed to be active, technically correct, and not a role, disposable, or catch-all domain.

How does catch-all verification affect compliance?

Catch-all domains receive all emails sent to them. They can’t be used to confirm consent, and are high-risk for spam traps and complaints.

Yes. Double opt-in forces a renewed, documented confirmation of interest, satisfying the Spam Act’s active consent requirement.

No. MailTester verifies address validity and risk level. It does not verify consent status but helps reduce risk from outdated or invalid addresses.

How do disposable email addresses affect compliance?

They are often used by non-humans or short-term users. Sending to them increases complaint rates and can trigger spam filters.

You risk spam complaints, blacklisting, fines up to $2.2 million, and damage to sender reputation over time.

Can I use MailTester for bulk list verification?

Yes. MailTester supports bulk verification with up to 100 free checks monthly. Purchased credits never expire.

Is email verification mandatory under the Australian Spam Act?

No, but it’s a best practice for compliance. Verification reduces bounce rates, spam traps, and helps maintain sender reputation.

How does Inbox Placement Testing help with compliance?

It confirms whether your emails reach the inbox—avoiding spam folders where complaints and feedback are harder to track.