CBA Hit with $7.5M Fine for Sending Over 170 Million Spam Messages

Commonwealth Bank has faced a significant regulatory setback, incurring a $7.5 million fine for violating Australian anti-spam laws by sending over 170 million marketing messages without providing recipients the option to unsubscribe. This marks the bank's second fine in as many years related to spam-related offenses, following a $3.55 million penalty imposed last year for similar breaches. The previous infraction involved marketing emails dispatched between November 2021 and November 2022, while the latest violations occurred between November 2022 and April 2024.

According to the Australian Communications and Media Authority (ACMA), out of the more than 170 million marketing messages sent by Commonwealth Bank during this 18-month period, approximately 34.8 million were directed to individuals who either had not given consent or had explicitly withdrawn their consent to receive such communications. ACMA chair Nerida O’Loughlin emphasized that the "vast scale of CBA’s non-compliance was unacceptable," highlighting the seriousness of the infractions.

The ACMA's investigation revealed that the Commonwealth Bank incorrectly classified millions of these messages as non-commercial. This classification allowed the bank to send these communications without the need for consent or an unsubscribe option. However, this classification only applies to what are deemed "service messages." O’Loughlin clarified that, according to regulatory guidelines, any message that includes marketing content or direct links to marketing content must be classified as a commercial message, thus necessitating an unsubscribe option for recipients.

The regulator has warned other companies to be vigilant in their classification practices, stating that several organizations have made similar errors in differentiating between commercial and non-commercial messages. In addition to the financial penalty, Commonwealth Bank is now subject to an "expanded" three-year court-enforceable undertaking. This undertaking requires the bank to address the recent issues identified by the ACMA comprehensively.

As part of this commitment, Commonwealth Bank must conduct an independent review of its messaging practices and implement necessary improvements. The undertaking also mandates that the bank allocate appropriate resources and establish governance structures to ensure ongoing compliance with spam regulations. This situation underscores the increasing scrutiny that financial institutions face regarding their marketing practices, as regulators become more proactive in enforcing compliance with consumer protection laws. The fines and regulatory measures reflect a broader commitment to maintaining the integrity of communication practices within the financial services sector and protecting consumers from unsolicited marketing.