Sending a marketing text to a customer who never agreed to receive one is one of the fastest ways an Australian business can end up on the wrong side of the Spam Act 2003. A text message lands directly on a personal device, so recipients notice unwanted marketing SMS quickly, and so does the Australian Communications and Media Authority (ACMA).
This guide explains what the Spam Act 2003 actually requires for SMS marketing, why the rules matter more for text messages than for other channels, and how to build campaigns that stay compliant without adding friction to your workflow.
What Is the Spam Act 2003
The Spam Act 2003 is Australian federal legislation that regulates the sending of commercial electronic messages, including SMS, MMS, email, and instant messages, to Australian recipients. Enforced by the Australian Communications and Media Authority (ACMA), the Act requires that businesses obtain consent before sending marketing messages, clearly identify who is sending the message, and provide a functional way for recipients to unsubscribe. Consent can be express, meaning the recipient explicitly agreed to receive messages, or inferred, based on an existing business relationship such as a recent purchase or enquiry. The Act applies to any commercial message with an Australian link, regardless of whether the sender is based in Australia or overseas. Breaches can result in real penalties, with ACMA able to issue infringement notices, accept enforceable undertakings, or pursue civil penalties through the Federal Court for serious or repeated non-compliance.
Why the Spam Act Matters for Australian SMS Marketing
Email spam filters quietly absorb a lot of non-compliant marketing before a recipient ever sees it. SMS has no equivalent filter. Every message that leaves your Sender ID lands directly in a customer's messages app, next to texts from friends and family. That visibility is exactly why SMS marketing performs well, and exactly why non-compliant SMS marketing generates complaints faster than almost any other channel.
Mobile carriers also monitor complaint volumes against sending numbers. A pattern of unsolicited messages can lead to a number being blocked or throttled, and that damage does not stay contained to marketing. If a shared sending number loses reputation, delivery can suffer for transactional messages too, including appointment reminders and OTP Verification codes. For Australian businesses, Spam Act compliance is not only a legal requirement. It protects the deliverability of every message type you send, marketing or otherwise.
The Three Pillars: Consent, Identify, Unsubscribe
Most of the Spam Act's practical requirements for SMS marketing come down to three things, and it helps to treat each one as a separate checkpoint rather than a single compliance task.
Consent is the foundation. Express consent is the clearest form: a customer ticks a box, fills in a signup form, or replies to a keyword campaign asking to receive offers. Inferred consent is narrower than many businesses assume. It generally applies only where there is a recent, relevant business relationship, such as a completed purchase, and it does not last indefinitely. A customer who bought something two years ago and has had no contact since is a weak basis for inferred consent today.
Identification means the recipient should not have to guess who is texting them. A message from an unrecognised long number with no business name attached is far more likely to be reported as spam, even if the recipient technically opted in at some point. A registered Sender ID or a business name in the first line of the message solves this cleanly.
Unsubscribe means a working, low-friction way to stop future messages, present in the message itself rather than buried in a website footer. For SMS, that is almost always a reply keyword such as STOP, and the opt-out needs to be processed promptly, not just acknowledged.
What Happens If You Do Not Comply
Non-compliance with the Spam Act does not usually start with a court case. It starts with recipient complaints, which carriers and ACMA both track. A business that generates a pattern of complaints can face a formal warning, an infringement notice, or be asked to give an enforceable undertaking that commits it to specific changes in how it sends marketing messages.
For serious or repeated breaches, ACMA can pursue civil penalties through the Federal Court, and penalties scale with the severity and duration of the conduct. Separately from any regulatory action, carriers can throttle or block a sending number that attracts a high complaint rate, which affects every message sent from that number going forward, including messages that had nothing to do with the original complaint.
Key Benefits of Getting SMS Compliance Right
- Stronger sender reputation: Carriers and gateways favour senders with low complaint rates, which keeps delivery high across both marketing and transactional SMS.
- Fewer opt-outs and complaints: Recipients who gave genuine consent are far less likely to report a message as spam.
- Lower regulatory risk: Clear records of consent and opt-out handling reduce exposure to ACMA infringement notices and enforcement action.
- Better campaign performance: Contact Lists built on real consent produce a more engaged audience than lists assembled from purchased or scraped numbers.
- Long-term customer trust: Businesses that message respectfully build a reputation that supports every future campaign, not just the current one.
A Step-by-Step Compliance Checklist for SMS Campaigns
Use this checklist before you send your next SMS Campaign, and revisit it whenever you add a new list or use case.
- 1. Confirm consent before adding a contact: Only add a number to a marketing Contact List once you have express consent or a clear, recent business relationship that supports inferred consent.
- 2. Identify your business in the message: State your business name in the message body, or send from a registered Sender ID so the recipient knows exactly who is texting them.
- 3. Include a clear opt-out instruction: Every marketing message needs a working unsubscribe method, such as "Reply STOP to opt out", included in the text itself.
- 4. Action opt-outs immediately: Once a contact opts out, remove them from future marketing sends straight away, not at the end of the week or the next campaign cycle.
- 5. Keep consent records: Note how and when consent was captured for each contact, whether that was a signup form, a checkout flow, or a verbal agreement logged in your CRM.
- 6. Separate transactional from marketing sends: Order confirmations, appointment reminders, and OTP Verification codes are transactional and are treated differently under the Act than promotional content, so keep the two workflows distinct.
- 7. Register a branded Sender ID: A registered Sender ID on the ACMA Sender ID Register makes your business instantly recognisable and supports the identification requirement under the Act.
None of these steps need to slow down your sending cadence once they are built into your process. The point is to make consent and opt-out handling part of how your Contact Lists work by default, rather than something you check manually before each SMS Campaign.
How DataFlows Helps You Stay Compliant
DataFlows is built around the practical requirements of the Spam Act, not just bulk sending speed. Contact Lists let you tag and segment contacts by consent status, so marketing sends only ever reach people who opted in. SMS Campaigns support built-in opt-out handling, so a STOP reply is processed automatically and the contact is suppressed from future marketing messages without manual list editing.
Sender IDs let you send under a registered, branded name instead of a generic long number, which makes identification clear to every recipient and aligns with the ACMA Sender ID Register requirements. For businesses that want to automate consent updates, unsubscribe processing, or list segmentation across other systems, SMS Automation and the SMS API can handle that logic programmatically. If you are building against the API, you can generate your API Token from the Developer section of the DataFlows dashboard.
Sign up at dataflows.com.au to set up compliant Contact Lists and Sender IDs before your next campaign.
Best Practices for Ongoing Compliance
- Audit your Contact Lists regularly: Remove stale numbers and re-confirm consent for contacts you have not engaged in a long time.
- Never buy or scrape number lists: Purchased and scraped lists cannot demonstrate consent and are one of the fastest ways to trigger complaints and regulatory scrutiny.
- Keep marketing and transactional sends separate: Use distinct Contact Lists and sending flows so a compliance issue in one never affects the other.
- Test your opt-out flow: Send a test message to a number you control and confirm that replying STOP actually removes it from future sends.
- Review your Sender ID registration: Check that your registered Sender ID details are current, especially after a rebrand or change of business name.
Conclusion
The Spam Act 2003 is not a reason to avoid SMS marketing. It is a framework for doing it well: message people who want to hear from you, identify yourself clearly, and make leaving easy. Businesses that follow those three principles tend to see better engagement, not less.
Sign up at dataflows.com.au to build compliant Contact Lists, register a branded Sender ID, and run SMS Campaigns that respect the Spam Act from day one.