A customer says they never agreed to receive your text messages. It might be a complaint to you, a report to a regulator, or a question from your own compliance lead. Your next move depends on one thing: can you produce the consent record, quickly and in full?
Many Australian businesses collect consent but cannot show it. The tick box sat on a form that has since changed. The spreadsheet lost its timestamps. The person who ran the sign-up campaign has left. When that happens, "we had permission" is just a claim.
This guide covers what a usable consent record contains, how to store and export it, how long to keep it, and how to answer when someone asks for proof. It also walks through the Cliniko consent check and CSV audit trail as a concrete example. This is general information, not legal advice, so check your obligations with a qualified adviser.
What Is an SMS Consent Record?
An SMS consent record is a stored, retrievable piece of evidence showing that a specific person agreed to receive specific text messages from your business. It captures who agreed, when they agreed, how they agreed, what they were told at that moment, and where the agreement came from. A good record also tracks what happened afterwards, including any later withdrawal of consent through a STOP reply or another request. The purpose is simple: if anyone asks whether you were allowed to message a number, you can answer with facts rather than recollection. Under the Spam Act 2003, businesses sending commercial electronic messages need consent, a clear sender identity and a working way to opt out. A consent record is the practical proof of the first requirement. It should be specific to the person and the message type, easy to find by phone number, and impossible to quietly edit after the fact. A vague note saying "opted in" with no date or source does very little to protect you when someone challenges it.
Why Consent Records Matter for Australian Businesses
The Spam Act 2003 sets the rules for commercial text messages in Australia, and the regulator, the ACMA, enforces them. Consent is the foundation. If you cannot show where a number came from, you are exposed even when your intentions were good.
There are three practical reasons to care.
- Complaints get resolved faster. When a recipient disputes consent, a clear record lets you reply with the date, the method and the wording they saw. Without it, you are guessing.
- Staff turnover stops being a risk. Records that live in a system, not in someone's memory, survive roles changing hands.
- Your lists stay clean. Reviewing consent data forces you to remove numbers with no provenance, which usually improves campaign quality too.
Consent also differs by message type. A reminder tied to an existing booking is not the same as a promotional campaign. Your records should say which kind of permission you hold, so you do not use a number for a purpose the person never agreed to. For more background on the legal basics, see our guides on the Spam Act and SMS marketing and SMS consent and opt-in in Australia.
What a Complete Consent Record Contains
Think of each record as an answer to five questions. If a field does not help answer one of them, it probably does not belong. If a question has no answer, the record has a gap.
1. Who
Store the mobile number in a consistent format, plus the person's name and any customer ID from your own system. The number is the key you will search by when a complaint arrives, so format it the same way every time.
2. When
Record the exact date and time of consent, with a timezone. A date alone is weak. A timestamp generated by the system at the moment of sign-up is stronger than a date someone typed in later.
3. How
Note the method: web form tick box, paper form, verbal consent at the counter, an inbound text, or a booking system setting. Different methods need different supporting evidence, so be specific.
4. Exact wording
Save the text the person actually saw or heard, such as the sentence beside the tick box or the script used at reception. If your wording changes later, keep a version history so each record points to the version in force on that date.
5. Source
Record where the consent came from: which form, which page, which location, which staff member or which system. The source tells you where to look for supporting material if the record is questioned.
Add two more fields for the full picture: the message type consented to (for example appointment reminders or promotions) and the status (active or withdrawn, with the withdrawal date and how it was received).
Step-by-Step: Build a Consent Record System You Can Defend
Step 1: Decide where records live
Pick one source of truth. It might be your practice management system, your CRM, or a dedicated consent table in your database. Avoid scattering consent across email threads, spreadsheets and sticky notes. One place means one search when you need an answer.
Step 2: Capture at the point of consent
Record consent automatically wherever you can. A web form should write the timestamp, the wording version and the page URL on submit. A booking system should store the patient or customer setting alongside the profile. Manual entry is where gaps appear.
Step 3: Keep the wording versioned
Whenever you change your consent text, save the old version with its start and end dates. This lets you prove what a person saw in March even if the form was rewritten in June.
Step 4: Log withdrawals as carefully as consent
A withdrawal is evidence too. Store the date, the channel and what you did in response. If you can show that a STOP reply led to no further messages, that is as useful as showing the original opt-in.
Step 5: Make export routine
Test that you can pull a full record for one number, and a full list for a date range, in a format like CSV. If exporting takes a developer and a week, it will not happen when you need it. Practise the export before a complaint forces you to.
Step 6: Set a retention rule
Decide how long you keep consent records and write it down. A common approach is to keep a record for as long as you are messaging the person, and for a further period afterwards in case of a dispute. The right length depends on your industry and your legal advice, so confirm it with an adviser instead of copying a number from a blog.
Step 7: Rehearse the proof request
Pick a random number from your list and time how long it takes to produce its consent record, its message history and any withdrawal. Do this a few times a year. The gaps you find are cheap to fix now and expensive to find during a complaint.
How to Prove Consent If Someone Asks
When a person or regulator asks for proof, a good response is organised and short. Put together a single pack for that number.
- The consent record: who, when, how, wording and source.
- Supporting evidence: a copy of the form version, a screenshot or an export from the originating system.
- The message history: every message sent to the number, with dates, and any replies received.
- The withdrawal trail: if the person opted out, the date it was received and confirmation that nothing was sent afterwards.
A two-sided log, showing both what you sent and what the person replied, is especially persuasive because it shows the complete conversation rather than half of it. Respond promptly, stay factual, and avoid editing records once a complaint is open.
A Concrete Example: Cliniko Consent Check and CSV Audit Trail
Clinics using Cliniko give a useful worked example, because appointment reminders sit right next to patient records. The DataFlows-Cliniko integration is native: DataFlows polls the Cliniko API directly, using a Cliniko API key, so there is no third-party automation tool in the middle.
Here is how it handles consent and evidence:
- Consent check before sending. The integration respects each patient's Cliniko-recorded reminder and follow-up SMS consent setting before a message goes out. It does not use the separate marketing opt-in field for this check, so clinics should be clear about which field means what.
- Timestamped notes in Cliniko. Confirmations and consent can optionally be logged onto the Cliniko appointment as a timestamped note, so the evidence sits next to the patient record.
- Two-sided CSV audit trail. You can export a full CSV of messages sent and replies received. If a patient later asks what they were sent and when, the clinic can produce it.
- Reply logging. Every reply to a reminder is logged with its intent, confidence score and the action taken.
- Recall opt-out notice. Recall messages, which are treated as marketing under the Spam Act, include a required opt-out notice.
None of this replaces your own consent process at intake. It means that once consent is recorded in Cliniko, sending respects it and the trail is exportable. For the detail, read our guides on Cliniko SMS consent workflows and the complete Cliniko SMS feature guide, or see the Cliniko integration page.
How DataFlows Helps
DataFlows is an Australian SMS platform built around the Spam Act 2003. It is an ACMA-registered Originating Telco and is listed on the ACMA SMS Sender ID Register, and alphanumeric Sender IDs are registered with ACMA through DataFlows on your behalf.
On the withdrawal side, STOP and UNSUBSCRIBE-style replies are handled automatically across the whole platform. Once someone opts out, that number is blocked from future sends. You do not need to remember to scrub a list by hand, and the opt-out is applied the same way for every campaign.
For two-way messaging, a DataFlows Virtual Number gives you free inbound SMS, so replies such as STOP and YES reach you without per-message receiving costs. DataFlows is pay-as-you-go with no monthly or annual fees: you buy SMS credits and top up when you need to.
Keep in mind what DataFlows does and does not do. Your original consent evidence, such as the form wording and sign-up timestamp, should live in your own system of record. DataFlows then respects opt-outs, and for Cliniko clinics it checks the recorded consent setting and exports the message trail.
If you build your own sending through the SMS API, store the consent fields next to the contact in your database and check them before each send. Head to the Developer section in your DataFlows dashboard to get your API Token.
Best Practices for SMS Consent Records
- Record at the moment of consent. Capture the timestamp and wording automatically instead of reconstructing them later.
- Use plain, specific wording. Say what messages the person will get and from whom. Specific consent is easier to prove than broad consent.
- Separate message types. Keep reminders and marketing consent as different fields so one never stands in for the other.
- Version your consent text. Keep every past version with its dates.
- Treat opt-outs as records. Log the date, the channel and the outcome of each withdrawal.
- Test your exports. Pull a full record and a date-range file regularly, and confirm they open and make sense.
- Limit who can edit. Restrict changes to consent fields and keep a change log.
- Do not buy lists. A purchased list has no consent trail you can produce, whatever the seller claims.
- Write down your retention rule. Agree it with your adviser and apply it consistently.
Conclusion
Consent only protects you if you can show it. A good record answers who, when, how, what wording and which source. It records withdrawals just as carefully, and it can be exported in minutes instead of days. Build that discipline now, while nobody is asking.
DataFlows gives Australian businesses a compliant sending layer: platform-wide STOP handling, ACMA-registered Sender IDs and, for Cliniko clinics, a consent-aware workflow with a CSV audit trail. Sign up at dataflows.com.au to get started, and buy only the SMS credits you need. This article is general information and not legal advice.