In this guide · 7 sections
Short answer
The Spam Control Act applies to unsolicited commercial messages sent in bulk (over 100 similar messages in 24 hours, 1,000 in 30 days or 10,000 in a year). Those messages need an <ADV> subject label, an unsubscribe facility honoured within 10 business days, and honest headers.
What the Spam Control Act covers
The Spam Control Act 2007 controls "unsolicited commercial communications sent in bulk". Four tests decide whether a message is caught, all defined in the Act itself.
| Test | What the Act says | Section |
|---|---|---|
| Electronic message | Sent to an email address, a mobile number or an instant messaging account. Voice calls are excluded. | s 2, s 4 |
| Commercial | Its primary purpose is to offer, advertise or promote goods, services, land, a supplier, or a business or investment opportunity. | s 3 |
| Unsolicited | The recipient did not request or consent to it. Publishing an address is not consent. | s 5 |
| In bulk | More than 100 similar messages in 24 hours, 1,000 in 30 days or 10,000 in one year. | s 6 |
The Act also needs a Singapore link: for example, the message is sent from Singapore, the sender has a place of business here, or the recipient is in Singapore when they open it (section 7). A Singapore business emailing overseas customers is still covered.
If all four tests are met, section 11 says the sender must comply with the Second Schedule. Section 9 separately bans sending to addresses obtained through a dictionary attack or address-harvesting software, whether the message is commercial or not.
The rules for unsolicited bulk messages
The Second Schedule sets out what each unsolicited commercial message sent in bulk must contain. In plain English:
Second Schedule requirements
Two details trip people up. First, for email, a web unsubscribe link alone does not meet paragraph 2(2), which requires an email address the recipient can use. Second, the <ADV> label and header rules in paragraph 3 do not apply to messages sent to instant messaging accounts, but the unsubscribe rules still do.
Who enforces it, and what happens if you break it
The Spam Control Act works mainly through civil action. Under section 13, anyone who suffers loss or damage from a breach of section 9 or 11 can sue the sender, and anyone who aided or knowingly took part in the breach (section 12).
Under section 14, the court can grant an injunction, actual damages or statutory damages of up to S$25 per message, capped at S$1 million in total unless the claimant proves a larger actual loss. The court can also order the sender to pay legal costs (section 15). A business that knowingly lets someone else promote its products by spam can be treated as having authorised it (section 3(4)).
Separate PDPA enforcement by the PDPC applies where the PDPA is also breached, for example sending marketing to Singapore phone numbers without a DNC check or consent.
Spam Control Act vs PDPA Do Not Call rules
The two regimes overlap for SMS and messaging apps but work differently. The Spam Control Act is about bulk unsolicited messages and their format. The PDPA's Do Not Call (DNC) rules are about marketing messages to Singapore telephone numbers, even one at a time.
| Spam Control Act | PDPA DNC rules | |
|---|---|---|
| Channels | Email, SMS, MMS, instant messaging | Voice calls, SMS, fax and messages to Singapore phone numbers |
| Triggered by | Unsolicited and sent in bulk | Any marketing message to a Singapore number |
| Key duty | Label, unsubscribe facility, honest headers | Check the DNC Registry or hold clear consent |
| Email newsletters | Yes, if unsolicited and bulk | No, DNC covers phone numbers, not email |
| Enforced by | Civil claims in court | PDPC financial penalties |
For SMS and WhatsApp marketing, read our guides on the DNC Registry check and WhatsApp marketing rules. For email, the PDPA consent obligations still apply when you collect and use addresses, even if the Spam Control Act does not.
Practical set-up in Mailchimp, Brevo or similar tools
The simplest way to comply is to only email people who opted in. Opted-in subscribers have requested your messages, so the unsolicited rules do not apply. Good habits still matter because Gmail and Microsoft apply their own bulk sender rules.
Collect consent with a clear sign-up form
Say what you will send and how often. Store the date, time and source of each sign-up; most newsletter tools do this automatically.
Use double opt-in for website forms
A confirmation email proves the address owner asked to join and keeps typo and fake addresses off the list.
Keep a working unsubscribe link and reply address
Use the tool's built-in unsubscribe link and a monitored reply-to address so people can also unsubscribe by email.
Process manual unsubscribes quickly
When someone replies "stop" or emails you directly, remove them in the tool the same week. The legal limit is 10 business days.
Authenticate your sending domain
Set SPF, DKIM and DMARC for the newsletter tool so headers are accurate and mail reaches the inbox.
If you send any cold bulk email, add <ADV>
For any campaign to people who did not opt in, add <ADV> and a space at the start of the subject and check every Second Schedule item.
Our email newsletter set-up checklist covers domain authentication, one-click unsubscribe headers and warming up a new list.
Do it yourself or get help?
A small business that only emails opted-in customers through a mainstream newsletter tool can usually handle this itself: tidy the sign-up form, keep consent records, and process unsubscribes promptly. Cold outreach in bulk is where the Spam Control Act bites, and where most deliverability damage happens.
If your newsletters land in spam or the domain is not authenticated, Emails Land in Spam: Fix (S$249) sets up SPF, DKIM and DMARC and checks the first sends. The PDPA Compliance Pack (S$690) prepares consent wording for your forms, a privacy policy and a written process for marketing opt-outs and DNC checks.
Frequently asked questions
Only if the newsletter is unsolicited and sent in bulk. If every recipient signed up or otherwise consented, the messages are not unsolicited and the Second Schedule rules do not apply. You still need PDPA consent for the email addresses, and Gmail and Microsoft expect an easy unsubscribe for bulk mail. This is general information, not legal advice.
It is the label the Spam Control Act requires on unsolicited commercial messages sent in bulk. The Second Schedule says the letters must appear with a space before the subject line, or at the start of the message if there is no subject. It tells the recipient the message is an advertisement. It is not required on messages to opted-in subscribers.
Under the Spam Control Act, no further unsolicited commercial messages may be sent after 10 business days from the day the unsubscribe request was made. Business days exclude Saturdays, Sundays and public holidays. Newsletter tools usually remove people instantly through their link; the risk is manual requests sent by reply email.
Yes. It covers messages sent to mobile numbers and instant messaging accounts, if they are commercial, unsolicited and sent in bulk. Messages to instant messaging accounts are exempt from the labelling and header rules but not the unsubscribe rules. Marketing to Singapore phone numbers also falls under the PDPA Do Not Call rules, which require a DNC check or consent.
The Act works through civil claims. A person who suffers loss from a breach can sue the sender and anyone who knowingly took part. The court can award an injunction, actual damages, or statutory damages of up to S$25 per message, capped at S$1 million unless a bigger loss is proven, plus legal costs.