Subscribe
white caution cone on keyboard

Not Everyone Uses “Primary Purpose”

Lululemon just paid AU$702,900 to Australia’s communications regulator after sending more than 370,000 emails that mixed shipping and order confirmation content with promotional material, without giving recipients any way to opt out.1 The Australian Communications and Media Authority (ACMA) announced the enforcement action on March 10, 2026 (March 11, 2026, in Australia), making this the fifth time in 18 months ACMA has penalized a business for mischaracterizing commercial messages as non-commercial service communications.2

What went wrong? Lululemon’s order confirmations and delivery notifications contained sales material and links to promotions.3 Under Australia’s Spam Act 2003,4 that combination is enough to make the entire message a “commercial electronic message” subject to full consent and unsubscribe requirements. Whether the delivery notification was the primary reason for sending the email is irrelevant. As ACMA authority member Samantha Yorke stated, an electronic message containing any promotional or sales content “is considered commercial regardless of whether the message has any other purpose.”5

That last sentence is the one U.S.-based email marketers who are emailing overseas need to read carefully.

The CAN-SPAM “Primary Purpose” Test Does Not Travel

Under the CAN-SPAM Act, the Federal Trade Commission uses a “primary purpose” test to classify messages.6 A transactional or relationship message with incidental commercial content can generally retain its transactional status, provided the commercial elements are not the predominant purpose of the communication. Many U.S. marketers have built their email programs around this rule, treating order confirmations and shipping updates as categorically exempt from opt-out requirements even when those messages include cross-sells or promotional banners.

The problem is that framework is fairly specific to U.S. law. It does not exist in Australia, Canada, or the European Union.

Australia’s Spam Act asks only whether any commercial purpose is present in the message. Canada’s Anti-Spam Legislation (CASL) similarly defines “commercial electronic message” broadly, requiring consent for messages with any commercial function regardless of a transactional framing.7 The regime governing EU marketing communications centers on having a legal basis for processing information, but does not discuss a “primary purpose” basis for blended messages.

Putting the Penalty in Context

AU$702,900 sits in the mid-range of ACMA’s recent enforcement history. The regulator has issued fines exceeding AU$4 million against Tabcorp8 and approximately AU$3.5 million against Commonwealth Bank,9 both for higher-volume violations involving outright consent failures. The closer comparison is Luxottica, fined AU$1,512,500 in 2024 for a nearly identical misclassification theory involving 45,000 messages.10 Lululemon’s fine covers more than eight times as many messages at roughly half the penalty, a gap that likely reflects that Lululemon’s violations did not include sending messages to people more than 5 days after they had asked to unsubscribe.

Against Lululemon’s roughly US$11 billion in annual global revenue,11 the monetary penalty alone is not a meaningful deterrent. The more consequential outcome is the court-enforceable undertaking requiring an independent compliance audit and mandatory reporting to ACMA on implementation of recommended improvements.

What This Means for Global Email Programs

Companies operating in international markets face a compliance challenge that reliance on CAN-SPAM compliance alone does not adequately address. A single email template that passes U.S. legal review can simultaneously violate rules in other jurisdictions if it blends transactional content with any promotional material.

The ACMA’s guidance, repeated in the Lululemon announcement, recommends keeping transactional or service messages strictly separate from sales content and links.12 That advice is not new. The Spam Act has operated this way since 2003.

Lululemon has now committed to an independent review of its spam rule compliance and will report its remediation progress to the ACMA.13 That court-enforceable undertaking, combined with a $702,900 penalty, is the more significant consequence for an easily avoidable error.

Practical Steps for Compliance Teams

Organizations operating across multiple jurisdictions should audit their transactional email templates for embedded promotional content, including banners, cross-sell modules, links to landing pages with commercial content, and social media links pointing to pages that promote goods or services. Removing that content from service messages, or building separate promotional message streams with proper consent, is the technically correct approach for compliance with Australian, Canadian, and EU law.

Relying on CAN-SPAM’s primary purpose test as a global compliance strategy poses a risk, as the Lululemon matter illustrates. The rest of the world simply does not share that framework.

Disclaimer: This post discusses legal and regulatory developments for informational purposes only and does not constitute legal advice. For guidance specific to your organization’s compliance obligations, consult qualified legal counsel.

Footnotes

  1. Li Yying, News, Lululemon Fined More than $700,000 by ACMA for Spam Email Breaches, Austrailian Broadcasting Company, https://www.abc.net.au/news/2026-03-11/lululemon-fined-acma-over-spam-breaches/106436246 (last visited Mar. 10, 2026). ↩︎
  2. Id. ↩︎
  3. Id. ↩︎
  4. Spam Act 2003 (Office Parliamentary Counsel 2016). ↩︎
  5. Li, supra note 1. ↩︎
  6. 15 U.S.C. § 7702(2)(A). ↩︎
  7. Canadian Radio-television and Telecommunications Commission (CRTC) Government of Canada, Frequently Asked Questions about Canada’s Anti-Spam Legislation, https://crtc.gc.ca/eng/com500/faq500.htm (last visited Mar. 10, 2026) (“What is a commercial electronic message?”: “Is one of the purposes to encourage the recipient to participate in a commercial activity?….For example, the simple inclusion of a logo, a hyperlink or contact information in an email signature does not necessarily make an email a CEM. Conversely, a tagline in a message promoting a product or a service, or encouraging the recipient to purchase a product or service would constitute the message as a CEM.”). ↩︎
  8. Australian Communications and Media Authority, TAB Penalised $4 Million for Spamming VIP Customers (Australian Communications and Media Authority), https://www.acma.gov.au/articles/2025-06/tab-penalised-4-million-spamming-vip-customers (last visited Mar. 10, 2026). ↩︎
  9. Australian Communications and Media Authority, Commonwealth Bank Pays $7.5m for More Spam Breaches (Australian Communications and Media Authority), https://www.acma.gov.au/articles/2024-10/commonwealth-bank-pays-75m-more-spam-breaches (last visited Mar. 10, 2026). ↩︎
  10. Australian Communications and Media Authority, Luxottica Pays $1.5m Penalty for Spam Breaches (Australian Communications and Media Authority), https://www.acma.gov.au/articles/2024-04/luxottica-pays-15m-penalty-spam-breaches (last visited Mar. 10, 2026). ↩︎
  11. Mary Cunningham, News, Is Lululemon Coming Apart at the Seams? Here’s Why the Brand is Losing Its Flex. – CBS News, CBS News, https://www.cbsnews.com/news/lululemon-leggings-see-through-athleisure-losing-momentum/ (last visited Mar. 10, 2026) (“The company reported $11.07 billion in revenue in the 12 months ended Nov. 2, 2025, up nearly 9% from the year prior.”). ↩︎
  12. Li, supra note 1. ↩︎
  13. Id. ↩︎
Picture of Mickey

Mickey

A recognized leader in the fight against online abuse, specializing in email anti-abuse, compliance, deliverability, privacy, and data protection. With over 20 years of experience tackling messaging abuse, I help organizations clean up their networks and maintain a safe, secure environment.