The Commonwealth Bank of Australia (CBA) has been handed a $7.5 million fine by the Australian Communications and Media Authority (ACMA) for reportedly sending over 170 million marketing emails that failed to comply with Australia's spam laws.

The emails did not include an unsubscribe option, with 34.8 million of the messages sent to individuals who had not consented or had withdrawn their consent to receive such messages.

It's the second major breach of spam laws by CBA after the bank received a $3.55 million penalty in May 2023 for sending 65 million emails without working unsubscribe arrangements. The ACMA found that CBA's messages either promoted products and services (including insurance, credit and loan offerings) or promoted CBA itself.

"The ACMA took action against CBA just last year for not delivering on their customers' rights to unsubscribe from marketing messages. We have now had to take further action after this new investigation found that CBA had incorrectly classified millions of messages as non-commercial," said ACMA Chair, Nerida O'Loughlin.

In addition to the financial penalty, the ACMA has accepted an expanded three-year court-enforceable undertaking from CBA to address the most recent issues. This undertaking commits CBA to a comprehensive independent review and implementation of improvements, as well as providing appropriate resources and governance to ensure its compliance.

"Australians are sick and tired of this kind of spam intruding on their privacy and it's clear CBA did not have its systems in order," O'Loughlin said. "The rules are clear, if a message includes marketing content or direct links to marketing content, it is a commercial message and must give people the option to unsubscribe."

The maximum penalty a court can give to companies not complying with spam rules is $626,000 per day where a company doesn't have a prior record. Maximum court penalties rise to $3,130,000 per day for companies with a prior record. Over the last 18 months, businesses have paid over $20 million in spam penalties.

"We will continue to closely monitor compliance with its commitments and with the spam laws," O'Loughlin said.