Consent for SMS Follow-Up Without Killing Response Rates

Most founders I talk to have quietly decided consent for SMS follow-up is a tax on their response rate. They think adding a tick box costs them leads, so they either skip it and hope nobody complains, or they bolt on a paragraph of legal wording that scares people off the form entirely.

Both are wrong. Consent, done properly, is a filter that improves your numbers rather than shrinking them. The people who opt in are the people who wanted to hear from you. The people who don’t were going to reply anyway.

Here is what actually applies in New Zealand and Australia, how to word the ask so people say yes, and what your system needs to record so you can prove it later.

Key Takeaways

• Consent for SMS follow-up is required under the NZ Unsolicited Electronic Messages Act 2007 and the Australian Spam Act 2003, with penalties in the six figures.
• An inbound enquiry gives you inferred consent to reply about that enquiry. It does not give you consent to market to that person for the next two years.
• The tick box does not kill your response rate. Vague, corporate wording does. Say what you will send, how often, and how to stop.
• Every SMS you send needs a working opt-out, and the unsubscribe must be honoured within five working days in both NZ and AU.
• Log the timestamp, the source, the IP address and the exact wording the person agreed to. Without those four fields you have no defence.
• Consent that expires quietly is the biggest risk in most databases. Contacts older than two years need re-permission before you text them again.
• Reactivating a dormant database works far better when you can prove consent, because you can text rather than relying on email alone.

What the Law Actually Says in NZ and Australia

New Zealand runs on the Unsolicited Electronic Messages Act 2007, administered by the Department of Internal Affairs. Australia runs on the Spam Act 2003, administered by ACMA. The two are close enough that if you build for the stricter reading, you are compliant in both.

Three obligations sit at the centre of each. You need consent before you send a commercial message. You need to identify yourself clearly in the message. You need a functioning way for the person to opt out, and you have to action it promptly.

Consent comes in two forms. Express consent is when someone actively agrees: a tick box they ticked themselves, a form they filled in, a verbal yes on a recorded call, a text they sent you first. Inferred consent is when the relationship implies it. Someone who just bought from you, or who published a business number on their website in a context where enquiries are expected, has given you a narrower kind of permission.

The trap is that inferred consent is much thinner than founders assume. Someone filling in your quote request form has given you consent to respond about that quote. They have not given you consent to text them a promotion eight months later. That drift, from responding to marketing, is where most businesses quietly cross the line without noticing.

The penalties are not theoretical. ACMA has issued fines running into the millions for businesses sending to lists they could not prove consent for. In New Zealand, the DIA can pursue up to $200,000 for an organisation. You can read the current rules on the Department of Internal Affairs anti-spam page and check your own wording against them.

Why the Tick Box Is Not What Kills Your Response Rate

Here is the thing founders get backwards. The consent request itself is almost never the reason someone abandons your form. The wording is.

Compare these two. The first: “By submitting this form, you consent to receive electronic communications from our affiliated partners in accordance with our privacy policy.” The second: “Text me updates about my quote. Reply STOP any time.”

The first one reads like a trap. It mentions affiliated partners, which triggers every instinct a person has about their number being sold. It refers to a privacy policy nobody will read. It uses the word “communications,” which means nothing. Of course it suppresses conversions.

The second one tells the person exactly what they get, from whom, and how to make it stop. It is specific, it is short, and it is honest. In practice, the version that names the benefit clears higher opt-in rates than the version that hides behind legal boilerplate, because people are agreeing to something they can actually picture.

There are three rules I apply to every consent line I write.

Name the message, not the category. “Updates about your booking” beats “electronic communications.” People consent to things they can visualise.

Set the frequency. “A couple of texts about your quote” tells someone this is not a firehose. Silence on frequency makes them assume the worst.

Put the exit next to the entrance. “Reply STOP any time” in the consent line itself. Counterintuitive, but it raises opt-in rates, because the perceived risk of saying yes drops to near zero.

Keep the tick box unticked by default. Pre-ticked boxes are not valid consent under either the NZ or Australian rules, and a regulator will treat a pre-ticked box as evidence you knew the answer would otherwise be no.

The Four Fields Your System Has to Log

Consent you cannot prove is consent you do not have. If someone complains and the regulator asks, “show me,” a note in your CRM saying “opted in” is worth nothing.

Four fields, on every contact, every time:

Timestamp. The exact date and time consent was given, not the date the record was created.

Source. Which form, which landing page, which call, which import. Down to the specific asset, not just “website.”

IP address or call recording reference. The technical evidence that ties the action to a person.

The exact consent wording shown at the time. This is the one everybody misses. If you change your form copy in March, you need to know that a contact who signed up in January agreed to the January wording. Store the string, not a link to the current version of the page.

Most businesses I audit have none of these. They have a CRM full of numbers and a vague memory of where they came from. That is not a compliance problem you can fix after the fact. It is a compliance problem you fix by making the capture automatic, so every new contact arrives with all four fields already attached.

This is the part where automation earns its place. A human filling in a consent log will forget. A system that writes the timestamp, source, IP and wording into the contact record the instant the form submits will never forget, and it costs nothing per record once it is built. If you want the broader version of this argument, I have written about building an audit trail into your AI systems and why it matters more than most founders think.

Speed, Consent and the 90-Second Window

Now the commercial part. Consent and response speed are connected in a way most people miss.

Roughly 78% of deals go to whoever responds first. Most businesses take four hours or more to make first contact with a new enquiry. If your follow-up sequence sits behind a manual consent check, someone in your team eyeballing whether the box was ticked before they text, you have just built a four-hour delay into your highest-value moment.

The fix is to make consent a field the system reads, not a judgement a person makes. Contact fills in the form, ticks the box, and the automation checks the field and fires within 90 seconds. No tick, no SMS, and the lead routes to email or a phone call instead. The rule is enforced in code, which means it is enforced every single time, including at 11pm on a Sunday.

That is also how you keep both channels honest. A lead who declines SMS is not lost. They just get a different sequence. I have seen far more revenue lost to businesses treating a missing tick as a dead lead than to any compliance issue.

The same logic runs through speed-to-lead automation generally. The value is not that a machine sends the message. It is that the machine applies your rules identically to lead 1 and lead 1,000, while a tired human at 5 pm on a Friday does not.

Reactivating an Old Database Without Breaking the Rules

This is the question I get most. “I have 3,000 contacts I haven’t touched in two years. Can I text them?”

Usually, no. Not directly. Consent does not have a hard expiry date written into either Act, but it has a practical one. A contact who enquired about your service in 2023 and heard nothing since will not remember you, and “they gave us their number once” is a weak position if they complain.

The path that works is a permission reset. Email first, because email consent rules are more forgiving and you almost certainly have an existing relationship to point to. The email does one job: re-establish the relationship and get a fresh, dated opt-in for SMS. Once they click, you have a new timestamp, a new source, and a clean record.

Then the SMS sequence runs against the re-permissioned segment only. Smaller list, dramatically better numbers, zero exposure.

This works. One of the first things I automate for a client is their dormant database, and the numbers hold up. James, a finance broker, had 319 dormant contacts his team had written off entirely. Multi-touch reactivation across email and SMS, run against properly permissioned contacts, recovered $49,000. That was not clever copy. It was a system contacting people who had already raised their hand, in a way that could be defended if anyone asked.

The businesses that get burned on database reactivation are the ones that skip the reset and blast the whole list. The complaints come from the contacts who forgot who you are, which is exactly the segment the reset would have filtered out anyway. You lose nothing by asking first except the contacts who were never going to buy.

Conclusion

Consent for SMS follow-up is not the thing suppressing your response rate. Bad wording, slow follow-up and manual processes are. The tick box asks a question. If your answer to “what will you send me?” is specific and useful, most people say yes.

The deeper issue is that consent, logging, speed and sequencing are four different rules that all have to fire correctly on every single lead, forever. No founder can hold that in their head while also running the business. This is exactly what an AI brain and AI workforce handle well: the rules live in the system, they run identically every time, and the record exists whether or not anyone remembered to write it down.

Get the wording right, log the four fields, respond in 90 seconds, and reset old contacts before you touch them. That is the whole thing.

If you want a look at where your current follow-up is leaking, whether that is consent gaps, slow response, or a database nobody has worked in two years, book a 30-minute Discovery Call. No pitch. I will tell you what I would fix first.

Frequently Asked Questions

About Octavius