Many Australian businesses know the Spam Act 2003 governs commercial text messages. Fewer realise the Privacy Act 1988 also has something to say about how you use customer details for marketing. That second layer is Australian Privacy Principle 7, usually shortened to APP 7.
If you run SMS campaigns, the two laws shape how you collect numbers, what you tell people, and how you handle opt-outs. In this guide you will learn what APP 7 is, how it relates to the Spam Act, and what practical habits keep your SMS marketing on solid ground.
Important: this article is general information, not legal advice. The rules can change, and how they apply depends on your business. Check current guidance from the OAIC and ACMA, and speak to a lawyer for your situation.
What Is APP 7 (Direct Marketing Under the Privacy Act)?
APP 7 is one of the 13 Australian Privacy Principles in the Privacy Act 1988, and it sets out when an organisation may use or disclose personal information for the purpose of direct marketing. Direct marketing means communicating directly with an individual to promote goods or services, which includes marketing by SMS, email, phone or mail. In general terms, APP 7 says an organisation should not use personal information for direct marketing unless an exception applies, such as the person reasonably expecting the use and having an easy way to opt out, or the person having consented. Stricter expectations apply to sensitive information. APP 7 also gives people the ability to ask not to receive direct marketing and to ask where an organisation obtained their details. It applies to organisations covered by the Privacy Act, and the Privacy Act has its own rules about which businesses are covered. It is designed to work alongside the Spam Act, not replace it.
How APP 7 Sits Alongside the Spam Act
It helps to think of the two laws as answering different questions.
- The Spam Act focuses on the message itself. It applies to commercial electronic messages, including SMS, and centres on consent, clear sender identification and a working unsubscribe option.
- APP 7 focuses on the personal information behind the message. It asks whether you are entitled to use someone's details for direct marketing in the first place.
APP 7 contains a carve-out: to the extent that the Spam Act or the Do Not Call Register Act applies to a particular communication, those Acts take the lead for that communication. In practice, for marketing SMS the Spam Act is the main rulebook. APP 7 still matters for the wider handling of your customer data, such as how lists are built, shared and used across channels.
If you want a deeper look at the Spam Act side, read our Spam Act SMS marketing guide. For how this differs from the Do Not Call Register, see Do Not Call Register vs Spam Act for SMS.
Why It Matters for Australian Businesses
Regulators take marketing complaints seriously, and customers notice when a business handles their details carelessly. Even where the Spam Act is the main rule for SMS, your overall privacy practices are part of how people judge your brand.
There are a few reasons to care:
- Your contact lists often start life in other systems, such as a booking tool, an online store or a CRM. How the numbers were collected affects how you can use them.
- The Privacy Act may apply to your business even if you only send small volumes. Coverage depends on factors like turnover and the type of information you handle, so check the OAIC's guidance.
- Privacy law is under ongoing review, and obligations can change. Building good habits now is easier than retrofitting later.
Key Benefits of Getting Consent and Privacy Right
Treating privacy and consent as part of your marketing design, not an afterthought, pays off in practical ways. Most of these benefits show up in day-to-day operations rather than in legal disputes.
The list below covers the main ones for small and mid-sized Australian teams running SMS campaigns, whether through the dashboard or the SMS API.
- Cleaner lists. When every number has a recorded source and consent, your list reflects people who actually want to hear from you.
- Fewer complaints. People who expected your message are far less likely to report it or reply angrily.
- Easier audits. If a customer or regulator asks how you got a number, you can answer quickly.
- Better engagement. Messages sent to opted-in customers tend to be more relevant, which supports better campaign results over time.
- Stronger trust. Clear opt-outs and honest wording show respect for your customers.
A Step-by-Step Approach to Compliant SMS Marketing
These steps are a practical starting point. They are not a substitute for legal advice, and you should adapt them to your own business, industry and the lists you already hold.
Step 1: Map where your numbers come from
List every source: web forms, in-store sign-ups, bookings, imported spreadsheets. For each source, note what the person was told and what they agreed to.
Step 2: Capture clear consent
Ask for permission to send marketing SMS in plain words, at the point of collection. Keep a record of when and how it was given. Our guide to SMS consent and opt-in in Australia explains the options.
Step 3: Identify your business in every message
Recipients should be able to tell who the message is from. Using a registered alphanumeric Sender ID helps, as covered in our Sender ID registration guide.
Step 4: Include a working way to opt out
Every marketing message should make it easy to stop receiving them, and requests should be honoured promptly. Read more in SMS opt-out and unsubscribe rules in Australia.
Step 5: Separate marketing from service messages
Appointment reminders and order updates are different from promotions. Keep them distinct and be careful about mixing promotional content into service messages. See transactional vs marketing SMS.
Step 6: Be careful with sensitive information
If your messages touch on health, finances or other sensitive topics, apply extra caution and keep message content minimal. Get advice if you are unsure.
Step 7: Review regularly
Check your forms, wording and lists every few months. Compare your practice against current OAIC and ACMA guidance, because the rules can change.
How DataFlows Helps
DataFlows Australia Pty Ltd is an ACMA-registered Originating Telco and is listed on the ACMA SMS Sender ID Register. Our messaging is designed around the Spam Act 2003, so the platform gives you tools that support good practice.
- Automatic opt-out handling. STOP and UNSUBSCRIBE-style replies are handled automatically across the platform, and an opted-out number is blocked from future sends.
- Registered Sender IDs. Alphanumeric Sender IDs are registered with ACMA through DataFlows on your behalf, so recipients can see who is messaging them.
- Contact Lists. Organise your audiences in one place so you can keep marketing and service messaging separate.
- SMS Marketing and SMS Campaigns. Plan and send campaigns to your lists with the Bulk SMS and SMS Marketing tools.
- Virtual Numbers. Receive inbound SMS for free, so customers can reply to you.
DataFlows is pay-as-you-go, with no monthly or annual fees. You buy SMS credits and top up when you need to.
To be clear, DataFlows provides the sending platform and compliance-supporting tools. You remain responsible for obtaining valid consent, writing compliant messages and meeting your own legal obligations.
Best Practices
- Collect only what you need. A mobile number and a name are usually enough for SMS marketing. Avoid asking for more than you will use.
- Be upfront at sign-up. Say what kind of messages you will send and roughly how often.
- Keep consent records. Store the date, source and wording for each contact so you can answer questions later.
- Honour opt-outs everywhere. If someone opts out of SMS, make sure that choice is respected across your other lists and tools.
- Do not buy lists. Purchased lists rarely come with the consent you need and create real risk.
- Train your team. Anyone who imports contacts or writes campaigns should know the basics.
- Check the regulators. Review the OAIC's direct marketing guidance and ACMA's Spam Act resources, and get legal advice for edge cases.
Conclusion
APP 7 and the Spam Act work as a pair. The Spam Act is the main rulebook for the SMS itself, while APP 7 and the wider Privacy Act shape how you collect and use the personal information behind your lists. Clear consent, honest identification and easy opt-outs cover most of the ground.
Remember that the rules can change and that this article is general information only. For authoritative answers, go to the OAIC for privacy and ACMA for spam.
Ready to send SMS marketing on a platform built around Australian rules? Sign up at dataflows.com.au and start with a pay-as-you-go account.