13 September 202612 min read

SMS Opt-Out & Unsubscribe Requirements in Australia

Australian businesses must give every SMS recipient a working way to opt out, and honour that request quickly. Here's what the Spam Act 2003 requires and how to automate compliant opt-out handling with DataFlows.

An SMS marketing campaign can build strong customer relationships, or it can quietly turn into a compliance problem. The difference often comes down to one thing: how a business handles the word "STOP."

Under Australian law, every commercial SMS needs a working, easy-to-use way for the recipient to opt out, and that opt-out request has to be honoured quickly. Businesses that get this wrong risk complaints, damaged sender reputation, and enforcement action from the Australian Communications and Media Authority (ACMA). Businesses that get it right build trust with their audience and keep their contact lists healthy.

This guide explains what SMS opt-out and unsubscribe compliance actually requires in Australia, why it matters beyond just avoiding fines, and how to set up a workflow that handles opt-outs automatically using DataFlows.

Whether you send a handful of appointment reminders a week or run large-scale SMS Campaigns to a national customer base, the same underlying rule applies: once someone asks to stop, your systems need to make that happen reliably, every time, without relying on a person remembering to update a spreadsheet.

What Is SMS Opt-Out

SMS opt-out is the legally required process that lets a recipient stop receiving commercial text messages from a business by replying with a keyword such as STOP, UNSUBSCRIBE, or CANCEL. Under the Spam Act 2003, every commercial electronic message, including SMS, must include a functional unsubscribe facility that works for at least 30 days after the message is sent. When a recipient uses that facility, the sender is legally required to action the request within 5 business days and must not send further marketing messages to that number afterwards. Opt-out is different from consent: consent governs whether a business can message someone in the first place, while opt-out governs what happens after a message has already gone out and the recipient decides they no longer want it. A compliant SMS program needs both working reliably at the same time.

Ignoring or delaying an opt-out request is one of the most common ways Australian businesses fall foul of the Spam Act, even when their original consent to send that first message was entirely valid. This is why most opt-out failures are process failures rather than deliberate non-compliance.

Why It Matters for Australian Businesses

ACMA actively investigates spam complaints, and SMS marketing is one of the channels it monitors most closely because messages land directly on a customer's phone. A business that fails to honour opt-out requests can face formal warnings, enforceable undertakings, and financial penalties, regardless of company size.

Beyond the legal risk, ignoring opt-outs damages the relationship with the exact customers who took the time to tell you they no longer want to hear from you. Continuing to message them after a STOP request increases complaint rates, harms sender reputation with mobile carriers, and can lead to messages being filtered or blocked entirely, which affects delivery for every customer, not just the ones who opted out.

Getting opt-out right is also good business practice. A contact list that only contains people who genuinely want to receive messages produces better click-through rates, better response rates, and a healthier long-term relationship with your audience.

There is also a practical operational reason to take this seriously. Mobile carriers and aggregators watch complaint and unsubscribe patterns at the sender level, not just the campaign level. A business with a track record of slow or inconsistent opt-out handling can see broader deliverability issues across its entire messaging program, including transactional messages like appointment reminders and one-time passcodes that customers actually want to receive. Treating opt-out compliance as a technical foundation, rather than an afterthought, protects the messages that matter most to your business.

Key Benefits of Getting Opt-Out Right

Reduced compliance risk: honouring opt-outs promptly keeps your SMS program aligned with the Spam Act 2003 and reduces exposure to ACMA complaints and penalties.
Stronger sender reputation: carriers and filtering systems track complaint rates, and a low complaint rate helps keep your messages landing in the inbox rather than being blocked.
Cleaner, more accurate contact lists: automatically removing opted-out numbers means your Contact Lists only contain people who actually want to hear from you.
Better campaign performance: a list built on genuine interest produces higher open and response rates than one padded with unwilling recipients.
Lower cost per campaign: sending fewer messages to people who will never convert reduces wasted spend on every SMS Campaign you run.

Step-by-Step: Building a Compliant Opt-Out Workflow

Recognise opt-out keywords automatically: your platform needs to detect STOP, UNSUBSCRIBE, CANCEL, and common variants the moment a reply arrives, not rely on someone reading every inbound message.
Action the request within 5 business days: the Spam Act sets this as the maximum, but the safest approach is to remove the number immediately so there is no risk of a message going out in the gap.
Suppress the number across every list: an opt-out should apply to all future marketing sends from your business, not just the campaign the STOP reply was sent to.
Keep the unsubscribe instruction visible: every marketing SMS should include a short, clear line such as "Reply STOP to unsubscribe" so recipients always know how to opt out.
Separate transactional from marketing sends: opt-outs apply to marketing messages, not essential transactional messages like OTP codes or appointment confirmations, so your system needs to tell the two apart. See our guide on transactional vs marketing SMS for the distinction.
Log every opt-out request: keep a timestamped record of when a number opted out and how, so you can demonstrate compliance if a complaint is ever raised.
Apply the same rule across every channel you use to reach that contact: if a number opts out of SMS Marketing, it should not resurface through a different SMS Campaign, a re-import from a spreadsheet, or a manually triggered send from an integration such as Shopify or WordPress/WooCommerce.
Review new contact sources before sending: lists imported from events, forms, or third-party tools should be checked against your suppression list before the first campaign goes out, not after complaints arrive.

How DataFlows Helps

DataFlows builds opt-out handling directly into the platform so compliance does not depend on manual review. When a contact replies STOP, UNSUBSCRIBE, or a recognised variant to any message sent through SMS Marketing or SMS Campaigns, DataFlows automatically suppresses that number across your Contact Lists, so it will not receive future marketing sends from any campaign.

SMS Automation can be configured to send an immediate confirmation reply once a number opts out, giving the recipient certainty that their request was received, without any manual step on your end.

For teams sending SMS programmatically through the SMS API, opt-out status can be checked before a send is triggered, so custom applications and internal tools respect the same suppression list as marketing campaigns. To get started, go to the Developer section of your DataFlows dashboard to generate an API Token.

Because suppression is applied centrally across Contact Lists rather than per campaign, there is no risk of a number that opted out of one campaign accidentally receiving a different one later.

This matters most for businesses running multiple SMS Campaigns at once, such as a retail brand sending both a loyalty promotion and a restock alert, or a clinic sending appointment reminders alongside a patient newsletter. Without centralised suppression, it is easy for a customer to opt out of one message stream and still receive another from the same business, which is exactly the kind of inconsistency that generates complaints. With DataFlows, one opt-out protects the customer across every list and every campaign connected to your account, including sends triggered through integrations like Zapier, Shopify, and WordPress/WooCommerce.

If your business also uses Contact Lists to segment customers by interest or purchase history, suppressed numbers are automatically excluded from every segment, so there is no manual step to remember when you build a new audience for your next campaign.

Best Practices for SMS Opt-Out Compliance

Most opt-out problems come from gaps between systems rather than a single bad decision. A campaign tool that does not talk to the customer database, a manual export that goes stale, or an integration that re-adds a contact from an external source are all common ways a business ends up messaging someone who already opted out. The practices below focus on closing those gaps.

Honour opt-outs immediately, not just within the legal window: removing a number the moment it opts out avoids any risk of an overlapping send.
Include a clear opt-out instruction in every marketing message: recipients should never have to search for how to unsubscribe.
Never resubscribe a number without fresh, explicit consent: an old opt-out cannot be undone by adding the contact back to a list manually.
Keep transactional and marketing sending logically separate: this avoids accidentally suppressing appointment reminders or OTP codes when a customer only opted out of marketing.
Review your opt-out and consent records periodically: an occasional audit of your Contact Lists confirms suppression is working as expected across all campaigns.

Conclusion

Compliant SMS opt-out handling is not just a legal checkbox, it is part of running an SMS program that customers trust. Businesses that action STOP requests quickly and keep their lists clean see better engagement and fewer complaints, while avoiding the risk that comes with the Spam Act 2003.

DataFlows automates opt-out detection and suppression across SMS Marketing, SMS Campaigns, and the SMS API, so your team can focus on writing good campaigns instead of manually tracking unsubscribe requests. Sign up at dataflows.com.au to set up a compliant SMS workflow in minutes.