Australian SMS rules

When a text is a commercial message

Section 6(1) of the Spam Act 2003 makes a text commercial when one of its purposes is to offer, advertise or promote goods or services. The test covers the content and presentation of the message and what its links, phone numbers and contact details lead to. ACMA says a message must comply with the spam rules even when the promotion is only one part of the message. The label you give the message does not decide the answer.

Consent is the first rule, and the next section explains the two forms the law accepts.

Consent before the first message

Section 16 of the Spam Act 2003 bans an unsolicited commercial message with an Australian link, unless it is a designated message or the relevant account-holder has consented. ACMA says you must have consent from each person who will receive your marketing messages before you send them. ACMA says you must also prove you hold it.

The Spam Act sets out two forms of consent in Schedule 2. Consent is either express, or it is consent that can reasonably be inferred from the person's conduct and business and other relationships. ACMA says a past purchase alone does not count as inferred consent for marketing messages.

ACMA says a business that has someone else send its marketing messages still needs consent from every recipient, whoever does the sending.

Identification of the sender is the second rule, and it applies to every commercial text.

Identifying who sent it

Section 17 of the Spam Act 2003 requires every commercial message to clearly and accurately identify who authorised it and to say how to contact them. The information must be likely to stay valid for at least 30 days after the message is sent. ACMA says the sender's name and contact details in a marketing message must stay correct for at least 30 days after it was sent.

The third rule is the unsubscribe, which gives the recipient a way to stop the messages.

The unsubscribe

Section 18 of the Spam Act 2003 requires a clear and conspicuous unsubscribe statement in every commercial message that is not a designated message. The unsubscribe address must be able to receive unsubscribe messages for at least 30 days after sending.

ACMA says the unsubscribe must honour a request within 5 working days, must not charge a fee, and must work for at least 30 days after the message was sent. Schedule 2 clause 6 of the Spam Act gives effect to a withdrawal of consent at the end of the 5 business days beginning on the day it was sent as a message. The clock counts business days, not calendar days.

ACMA says an unsubscribe must not require the person to log in, create an account or give extra personal information. ACMA gives "Reply STOP" and an unsubscribe 1800 number as clearly worded examples.

A commercial text that names the sender, gives a contact route and offers the opt out looks like this.

• "Harbour Physio: book your next visit, call the clinic. Reply STOP to opt out." (77 characters, one SMS)

ACMA says automated SMS and email welcome journeys are not exempt from the spam rules and must have proper consent and unsubscribe processes. ACMA found that customers who unsubscribed from automated welcome journeys kept receiving the whole series, because the unsubscribe did not take effect until the automated sequence finished. ACMA says that outcome puts the business in potential breach.

ACMA says each commercial message in an automated welcome journey must let the customer opt out of the rest of the series, and any other commercial message, at any time. This site's guide to automating SMS campaigns covers the practical setup in detail.

Some messages are exempt from the consent and unsubscribe rules, and the next section sets out that exemption and its limit.

Factual messages and their limit

Schedule 1 of the Spam Act 2003 exempts a designated commercial electronic message from the consent rule in section 16 and the unsubscribe rule in section 18. A designated message consists of no more than factual information, plus the sender's name, logo and contact details and similar details. The message must also be one that would not otherwise be commercial. The exemption leaves section 17 in place, so a designated message must still identify who authorised it and how to contact them.

ACMA tells consumers that appointment or payment reminders are generally not spam. The OAIC says it is generally reasonable for a health service provider to imply a patient's consent to a reminder to attend a scheduled longer appointment.

ACMA's Chair said in October 2023 that a factual message which also includes marketing content, or links to marketing content, needs consent. ACMA warns that spam breaches can occur even when a mostly factual message, such as a bill, invoice or other account or service message, also carries promotional or sales content.

Appointment reminder templates that carry only the appointment details, your name and your contact details meet the Schedule 1 definition. The first reminder below meets it, and the second adds marketing content, which ACMA's Chair said needs consent.

• "Harbour Physio: your appointment with Sam is on Tue 14 Oct at 10:30am. Reply R to confirm." (90 characters, one SMS)
• "Harbour Physio: your appointment with Sam is on Tue 14 Oct at 10:30am. Reply R to confirm. Ask about our new supports range." (124 characters, one SMS)

The duty to judge each message against that line stays with your business, and the next section explains why.

You cannot hand the duty to your provider

ACMA says a business cannot outsource its spam-law liability to a third-party provider. The consent, identification and unsubscribe duties in the Spam Act stay with your business, whichever platform sends the messages.

An ACMA investigation report on Commonwealth Bank of Australia, dated 14 August 2024, summarises the exemption: the Spam Act lets businesses send factual-only messages that carry their names, logos and contact details without consent or an unsubscribe.

The name your texts come from carries its own rules, which the next section explains.

Sender IDs and the SMS Sender ID Register

ACMA says that since 1 July 2026, a text sent with a sender ID that is not registered shows "Unverified" in place of the name, and the message is still delivered. ACMA says the legal duty sits with the telco or message provider, and a business registers through each provider it sends with. ACMA says senders using a phone number do not need to do anything.

This site's separate guide covers the SMS Sender ID Register in full.

The Privacy Act adds a second layer of law to marketing texts, which the next section covers.

Privacy and texts sent overseas

The Privacy Act 1988 contains 13 Australian Privacy Principles, and APP 7 deals with direct marketing. For organisations the principles cover, APP 7.8 excludes APP 7 to the extent the Spam Act applies. The exclusion is not absolute: APP 7 can still apply to exempt acts or practices.

Where APP 7 does not apply, the OAIC direct marketing guidance says APP 6, on use and disclosure of personal information, can still bind an APP entity. Not every Australian business is one, so first check whether the principles cover your organisation.

The Spam Act applies to commercial messages with an Australian link. Section 7 gives two examples: a message that originates in Australia, and one sent or authorised by an individual physically in Australia. An overseas recipient does not by itself remove the link.

Before you send a campaign to another country, confirm whether your message carries an Australian link under section 7, then check which destination-country rules apply.