SMS Marketing Laws in Australia: What the Spam Act Requires, in Plain English

SMS is the channel businesses hesitate over most. Email feels routine and a phone call feels normal, but a marketing text lands in the same place as messages from family, so owners worry that sending one is somehow prohibited. It is not. Australia has clear, workable rules for SMS marketing, and most genuine businesses can meet all of them.

Here is how the law actually works, requirement by requirement.

What does the Spam Act 2003 require for marketing texts?

Commercial SMS in Australia is governed by the Spam Act 2003 (Cth). The Act covers “commercial electronic messages”, which includes marketing texts, emails and instant messages with an Australian link. It imposes three requirements:

• Consent. You may only send a commercial electronic message with the recipient's consent. The Act recognises two kinds: express consent and inferred consent. Section 16 of the Act is the prohibition on unsolicited messages; Schedule 2 defines what consent means.
• Identify the sender. The message must clearly and accurately identify the business that authorised it and how the recipient can contact you. For SMS, that means your business name in the message itself. This sits in section 17 of the Act.
• Functional unsubscribe. Every message must contain a working way to opt out, and opt-outs must be honoured. This is section 18 of the Act. ACMA's guidance requires the unsubscribe facility to remain functional for at least 30 days after the message is sent, and opt-out requests to be actioned within five business days.

Miss any one of the three and the message is unlawful, regardless of how good the offer is. Meet all three and SMS marketing is legal.

What counts as consent for SMS marketing?

Consent is where most of the practical questions live, so it is worth being precise.

Express consent is the clean case: the person ticked a box, filled in a form or told you directly that you may send them marketing. If you collect mobile numbers today, collecting express marketing consent at the same time is the single best thing you can do for every future campaign.

Inferred consent is the one owners do not realise exists. Schedule 2 of the Act says consent may be reasonably inferred from the conduct of the person and the business and other relationships between you. A customer who hired you, paid you and gave you their mobile so you could coordinate the work has exactly the kind of relationship the Act contemplates, for messages they would reasonably expect from you.

What consent does and does not cover:

• It does cover messages the customer would reasonably expect: a service reminder, a relevant offer on the thing they bought, a check-in about the work you did.
• It does not cover messages about an unrelated business you also run, or a number collected for one purpose being used for another the person would not expect.
• It does not transfer. Consent belongs to the relationship. A purchased, scraped or swapped list carries no consent, and the Act separately prohibits address-harvesting software and lists built with it. A phone number being publicly visible does not by itself amount to consent either.

What must the SMS itself contain?

The three requirements apply to email and SMS alike, but SMS changes how you meet them:

• Identification has to live in the message body. An email carries a sender name and address; a text from an unfamiliar number carries nothing. Put your business name in the message every time. “Hi, it's Sarah from Acme Plumbing” satisfies the requirement and reads like a human.
• The unsubscribe is usually reply STOP. It must actually work: a person or a properly configured system has to be monitoring the replies, applying the opt-out and making sure that number never gets messaged again. An unmonitored sending number with STOP printed on it is not a functional unsubscribe.
• Timing and volume matter in practice. The Act does not prescribe sending windows, but a message at 6am reads very differently from one mid-morning, and carriers and recipients treat high-volume identical blasts as spam signals. Small, staged sends are both better marketing and a smaller compliance surface.
• Purely factual messages are treated differently under the Act: an appointment reminder or delivery update with no promotional content sits outside the commercial rules. The exemption is narrow. The moment a message promotes your goods or services, it is commercial, and all three requirements apply.

What about texting past customers or a dormant list?

The rules above apply to any marketing SMS. Texting a dormant list of past customers has its own considerations on top, because inferred consent is not permanent: it weakens as a relationship lapses, and the practical question becomes whether the person would still recognise your business and consider the contact expected.

Think of the plumber who fixed your hot water. If he texted to ask how it is holding up, you would not feel spammed, you would feel looked after. Send nothing that fails that test.

That question deserves its own answer, and it has one: the dedicated guide on whether you can legally text your old customers covers the lapsed-relationship question in depth, including the exact test Gibson applies to its own list before sending anything. And if your question is less about the law and more about what to say, the companion guide on how to win back lost customers covers segmentation, sequencing and message templates.

Who enforces the Spam Act and what are the penalties?

The Australian Communications and Media Authority (ACMA) enforces the Spam Act. It investigates complaints, issues formal warnings and infringement notices, accepts enforceable undertakings and takes the serious cases to the Federal Court. It also publishes every enforcement action, which makes its priorities easy to read.

The Act carries significant civil penalties, and exposure scales with message volume and repeat conduct. ACMA's recent enforcement against major Australian brands has run into the millions of dollars. The recurring patterns in those actions are messages sent after customers unsubscribed, unsubscribe facilities that did not work or required a login, and messages that failed to identify the sender.

Read that list again and notice what is not on it: businesses texting their own genuine customers, with their name on the message and a working opt-out. The enforcement risk concentrates almost entirely on bought lists and broken unsubscribe handling. Get provenance and opt-outs right and you have avoided the failure modes ACMA actually acts on.

How do you run a compliant SMS campaign? The practical checklist

Before any message leaves, work through this in order:

• Write down where every number came from. If nobody can explain how a record entered the database, it does not get messaged.
• Remove the exclusions first. Known opt-outs, complaints, invalid numbers, sensitive cases and anyone the business has agreed not to contact come out before anything else happens.
• Confirm the consent basis for each group. Express consent, or a genuine relationship that reasonably supports the message you are about to send.
• Name your business in the message. Sender identification is a legal requirement, and it is also what stops a legitimate text reading like a scam.
• Include a working unsubscribe. Reply STOP, monitored by a person or a properly configured system, honoured within five business days and recorded permanently.
• Send in small staged batches. Watch replies and opt-out rates as you go, and stop and reassess if opt-outs spike.
• Keep records. The consent basis for the list, the approved message, who it went to and every opt-out. If a question ever comes, the record is the answer.

A note on the wider legal picture: the Spam Act is the main gate for marketing texts, but the Privacy Act 1988 and its Australian Privacy Principles govern how you hold and use the customer data underneath, and industry rules can add obligations in regulated sectors. When the list is unusual or the sector is sensitive, get proper legal advice.

Where does a done-for-you service fit?

Everything above is doable by hand. It is also exactly the kind of careful, sequenced work that busy owners start and never finish.

Gibson's Demand Reactivation service runs SMS and email campaigns to dormant customer databases compliantly as a done-for-you engagement: the database review, the exclusions, the grouping, message approval, staged sending, reply ownership and reporting, with the business approving every message and keeping the final legal decision. Gibson's reactivation evidence, including its own documented pilot, lives on that service page rather than being repeated here.

One neighbouring situation is worth separating: if someone called you and you missed it, texting them back promptly is a different and easier consent picture. That path is covered by Demand Recovery.

The bottom line

SMS marketing is legal in Australia when consent genuinely holds, your business is clearly identified and the unsubscribe genuinely works. The Spam Act 2003 sets the three requirements, ACMA enforces them, and the enforcement record shows the risk sits with bought lists and broken opt-outs, not with honest businesses messaging people who know them.

This article is general information for Australian business owners, not legal advice. For a specific list, a regulated industry or anything unusual, confirm the position with a lawyer before sending.

Frequently asked questions