Australian Spam Act Business SMS: The Three Rules

A client asked me last month whether he could text the 4,000 contacts sitting in his CRM under the Australian Spam Act business SMS rules. Most had bought from him at some point. Some had filled in a form back in 2019 and never heard from him again. He wanted to know if he was allowed.

The short version: the rules come down to three obligations. Consent to send. Identify yourself. Give people a working way out. That is it. The rules are simpler than most business owners expect and stricter than most are actually following.

This post covers what each obligation really requires, the traps that catch small businesses, what changes when an AI is sending the messages instead of a person, and how to keep consent records you can produce on demand. I am not a lawyer and this is not legal advice, but I build the systems that have to survive this, so I have read the rules more carefully than most.

Key Takeaways

• Australian Spam Act business SMS rules come down to three obligations: consent to send, clear sender identification, and a working unsubscribe.
• The Act covers SMS, MMS, email and instant messages. Live and AI voice calls sit under the Do Not Call Register Act instead.
• Express consent means someone opted in. Inferred consent relies on an existing business relationship and is far harder to defend to ACMA.
• Unsubscribe requests must be actioned within five working days, and the unsubscribe method has to keep working for at least 30 days.
• ACMA fined Commonwealth Bank $3.55 million in 2023 and Pizza Hut Australia about $2.5 million in 2024 over non-compliant messages.
• The Act applies to any message with an Australian link, so a New Zealand business texting Australian customers is fully covered.
• AI does not change the rules; it changes the volume. A consent gap that used to send 30 bad texts now sends 3,000 before breakfast.
• Store consent as data: source, timestamp, exact wording and channel. If you cannot produce it on request, you do not have it.

Australian Spam Act Business SMS Rules, in Plain English

The Spam Act 2003 is federal law, enforced by the Australian Communications and Media Authority. It governs “commercial electronic messages” that have an Australian link, which means messages sent from Australia or sent to a device or address being accessed in Australia.

That definition catches SMS, MMS, email and instant messaging. It does not catch voice calls. If you are running an AI receptionist or an outbound calling agent, you are under the Do Not Call Register Act 2006 instead, which has its own rules about washing numbers against the register. Different law, different obligations, same need to get it right.

A message is “commercial” if it offers, promotes or advertises goods, services, land, a business or an investment opportunity, or if it promotes a supplier of any of those. Purely factual messages usually sit outside the Act. An appointment reminder, a delivery notification, a “your invoice is attached” message: these are generally fine.

Here is the trap that catches people. The moment you bolt a promotion onto a factual message, the whole message becomes commercial. “Your service is booked for Thursday” is transactional. “Your service is booked for Thursday, and ask us about our winter tyre special” is a commercial electronic message and needs consent, identification and an unsubscribe. Businesses do this constantly without realising they have just crossed a line.

The penalties are not theoretical. ACMA fined Commonwealth Bank $3.55 million in 2023 over marketing emails sent without proper consent or a working unsubscribe. Pizza Hut Australia was penalised around $2.5 million in 2024. DoorDash paid $2 million in 2023. These were not obscure operators; they were businesses with legal teams who assumed their systems were fine. The ACMA guidance for businesses is worth twenty minutes of your time.

Rule One: Consent, and the Records That Prove It

Consent comes in two flavours, and the difference matters enormously.

Express consent is when someone told you directly that they want your messages. A ticked box (not pre-ticked), a phone number typed into a form with clear wording about what they will receive, a reply of “YES” to an opt-in text, a verbal yes captured in a call recording or file note. Express consent is clean. It is what you want.

Inferred consent is weaker. You can infer consent from an existing business relationship where it is reasonable for the person to expect messages from you, or from an address that has been conspicuously published in connection with someone’s work role, where the message is relevant to that role, and there is no statement saying they do not want unsolicited messages.

That second route gets abused. People read “conspicuously published” and start scraping mobile numbers off websites. Be careful. The published-address exception is narrow; it is a poor fit for personal mobile numbers, and the burden of proof sits with you, not with ACMA. If someone complains, you have to show the consent. Practically, I tell clients not to build an SMS list from scraped numbers at all.

Consent under the Act does not carry a hard expiry date, but that is not the comfort it sounds like. ACMA looks at whether the relationship is still live. A form filled in four years ago by someone you have not spoken to since is thin ground. If you would feel awkward explaining the consent to the person receiving the text, you probably cannot defend it.

What you actually need to store, for every contact, is four things: where the consent came from, when it was given, what exact wording they saw or heard, and which channels it covers. Store it as structured data on the contact record, not as a note somebody wrote in a spreadsheet in 2022.

This is why database reactivation and cold texting are completely different activities. One client, a finance broker, had 319 dormant contacts his team had written off as dead. We ran a multi-touch reactivation across SMS and email, and it recovered $49,000 in business. Every one of those people had opted in at some point; the consent was on record, and the first message carried an unsubscribe. That is reactivation. Buying a list and blasting it is not the same thing, and it will not end the same way.

Rule Two and Three: Identify Yourself, and Make Unsubscribe Work

Every commercial message has to clearly identify who sent it and include accurate contact details for that business. Those details have to stay accurate for at least 30 days after the message goes out. Disconnecting the number the day after a campaign is a breach.

In an SMS, that identification is usually just your trading name plus a way to reach you. You do not need to fit your full address into 160 characters. A business name and either a phone number, a replyable number, or a short link to a page that identifies you will generally do the job.

Now the part that quietly breaks compliance for a lot of small businesses: alphanumeric sender IDs. Sending from a branded sender name looks professional, but those sender IDs cannot receive replies. So “Reply STOP to opt out” is a lie. The customer texts STOP into a void, keeps getting messages, and complains. If you use an alphanumeric sender, you must supply a different unsubscribe mechanism, usually a link, and it has to work.

The unsubscribe itself has four requirements worth memorising:

1. It must be presented clearly in the message.
2. It must be free or low cost. You cannot make someone ring a premium line or log into an account to get out.
3. The mechanism has to keep functioning for at least 30 days after you send.
4. You have to action the request within five working days.

Five working days is the legal ceiling, not the target. Any decent system suppresses instantly.

The most common real-world failure is not the unsubscribe link; it is the plumbing behind it. Someone opts out of SMS and keeps getting emails because the two live in different tools. Or they opt out, then a fresh CSV import from a trade show overwrites their status and they land right back on the list. Your suppression list has to be one central record that every channel checks before it sends anything, and it has to survive imports.

What Australian Spam Act Business SMS Rules Mean for AI Outreach

AI does not change a single word of the Spam Act. What it changes is scale, and scale is exactly what turns a small compliance gap into a large one. A person sending texts by hand sends thirty before they get bored. An AI workforce sends three thousand before you have finished your coffee. Whatever flaw exists in your consent logic gets multiplied by the same factor.

There are three things I build into any automated outreach system before it sends a single message.

Machine-readable consent. The sending step checks the consent field on the contact record and refuses to send if it is missing or covers the wrong channel. Not a rule someone remembers to follow, a gate the system cannot pass.

A reply handler that understands plain English. This is where AI genuinely earns its place. Keyword matching on “STOP” catches maybe half of real opt-outs. People type “take me off this”, “not interested mate”, “who is this, remove me”, “unsubscribe pls”. A language model reads intent and suppresses the contact correctly. I have seen keyword-only systems keep messaging someone who had asked to be removed four separate times in four different ways.

A log you can hand over. Every message sent, the timestamp, the consent record that authorised it, and the contact’s opt-out state at the moment of sending. When a complaint arrives, you either have this, or you have an argument you cannot win. This is the same discipline I cover in building an audit trail into your AI systems, and it applies to every automated outbound channel.

One nuance worth calling out for inbound lead response. Someone who fills in your enquiry form has given express consent for you to respond to that enquiry. Texting them back in 90 seconds is entirely appropriate, and 78% of deals go to whoever responds first, so speed pays. But that consent covers the reply to their enquiry. It does not silently enrol them in your monthly promotions list. Two different consents, two different fields on the record.

If you are scoping automated outreach with a supplier, get this written down. My checklist for AI automation contracts covers who owns the consent data and who carries the liability when a campaign goes wrong, which is a conversation better had before the build than after the complaint.

Sending Across the Tasman: The New Zealand Rules

Plenty of the operators I work with sell on both sides of the Tasman, so this matters. New Zealand has its own law, the Unsolicited Electronic Messages Act 2007, enforced by the Department of Internal Affairs rather than ACMA.

The structure is close to identical: you need consent, you must identify the sender accurately, and you must provide a functional unsubscribe that is actioned promptly. New Zealand also allows express, inferred and deemed consent, and also puts the burden of proof on the sender.

The Australian Act reaches any message with an Australian link, which includes a message sent from Auckland to a mobile in Melbourne. So a New Zealand business texting Australian customers is answering to ACMA, not just to the DIA.

The practical answer is not to run two systems. Build to the stricter reading of both, use express consent everywhere, put identification and an unsubscribe on every commercial message regardless of destination, and keep one suppression list. Nobody has ever been penalised for being too clear about who they are and how to make you stop. If you are working out how this fits a broader automation plan, AI automation for Australian businesses covers the wider setup.

Also worth remembering: the Spam Act governs the messages, the Privacy Act 1988 in Australia and the Privacy Act 2020 in New Zealand govern the data itself. Compliant sending on top of data you collected badly is still a problem.

The Real Point

Compliance is not the reason to care about consent. It is the floor, not the goal. Every business I have seen get into trouble with ACMA had the same underlying issue: nobody could say where the contacts came from, because the answer lived across three tools, a spreadsheet and someone’s memory.

Fix that and compliance stops being a worry, because the record exists. Fix that and your reactivation campaigns perform better too, because you are messaging people who actually said yes rather than people who happened to be in a file.

That is the pattern under most of this. The Australian Spam Act business SMS rules are not hard. The problem is that the information needed to follow them is scattered, and the founder is the only one who knows roughly where it all sits. Once your business has a proper brain, a place where consent, history and context live as data instead of as tribal knowledge, the AI workforce sitting on top of it can send at volume without ever putting you at risk.

If you are sitting on a database you have not touched in a year, and you are not sure what you are allowed to do with it, that is worth a conversation. Book a 30-minute Discovery Call, and I will tell you straight whether it is workable, and what a compliant reactivation would look like for your setup. No pitch, no deck.

Frequently Asked Questions

About Octavius