The short answer to the question most businesses ask is yes: you can send text messages to your customers, and done properly, SMS is one of the cheapest and most immediate ways to reach them. But commercial texting in Australia is not unregulated. The Spam Act 2003 (Cth) treats an SMS as an electronic message like any other, and it puts three obligations on your business before you press send: you need the recipient's consent, you need to identify yourself accurately, and every message must carry a working unsubscribe option.
These are not abstract rules. The Australian Communications and Media Authority (ACMA) investigates breaches actively, and the penalties scale quickly. In May 2024 Pizza Hut Australia paid $2,502,500 after sending more than 10 million marketing messages in four months to customers who had not consented or had already asked to stop. This article sets out who the Act catches, the three duties in detail, what non-compliance costs, and the checklist your business should work through before its next campaign.
Who has to comply and when the Act bites
There is no size threshold in the Spam Act. A sole trader texting ten customers is caught in exactly the same way as a national chain texting a million, and there is no exemption for small businesses. The obligations apply to any business that sends, or causes someone else to send, a commercial electronic message with an Australian link.
That last phrase matters. Under s 7 of the Spam Act 2003 (Cth), a message has an Australian link if it originates in Australia, if the person who sent or authorised it is in Australia, if it is accessed on a device in Australia, or if the recipient is in Australia. In practice, if you text Australian numbers from an Australian business, you are squarely within the Act, whether you send the messages yourself or through an SMS platform.
Not every text is regulated. Section 6 defines a commercial electronic message by its purpose: the message must have the purpose of offering, advertising or promoting goods, services, land, or a business or investment opportunity. A message with that purpose is caught regardless of how short it is. By contrast, a message consisting purely of factual information is a "designated commercial electronic message", so an order confirmation, a delivery update or an appointment reminder does not need consent or an unsubscribe facility. It still needs accurate sender identification, which we cover below. Messages authorised by government bodies, registered charities and registered political parties about their own goods and services are also exempt from the consent rules.
One common point of confusion: the Do Not Call Register. That register, run under the Do Not Call Register Act 2006 (Cth), covers telemarketing voice calls and marketing faxes. It does not cover SMS. Text messages are regulated instead by the Spam Act, so being on the register does not help you, and being off it does not excuse you.
Duty 1: get consent before you text
Section 16 of the Act is the central rule: you must not send an unsolicited commercial electronic message to a recipient unless they have consented. Consent, defined in Schedule 2 of the Act, can be express or inferred.
Express consent is the safest and the ACMA's preferred approach. A customer gives express consent when they tick an unchecked box on your website, fill in a form, or agree over the phone or in person to receive marketing messages. The ACMA's guidance is blunt about record keeping: it is up to you to prove consent, so you should record who gave it, when, and how. There is a trap here worth naming: you cannot send an SMS or email asking someone whether they would like to receive marketing, because that message is itself a marketing message and needs consent before it goes out.
Inferred consent is narrower than most businesses assume. Schedule 2 of the Act says consent can be reasonably inferred from the recipient's conduct and from their business or other relationship with you. The ACMA's guidance explains that inference is usually only available where the person has knowingly and directly given you their number, there is a provable ongoing relationship such as an account, a membership or a subscription, and the marketing is directly related to that relationship. A bank can tell an existing customer about a better savings account; it cannot use the same inferred consent to sell them insurance.
The boundaries matter. Under the Act, consent cannot be inferred just because someone's number is published, including on your own website. And the ACMA is explicit that buying something once from your business does not amount to inferred consent for later marketing. That last point is the one that catches the most businesses, because a purchase list feels like permission. It is not.
Nor can you buy your way around consent. If you purchase a contact list from another business, no consent transfers with it. You are responsible for proving consent for every number you send to, and the Act separately bans address-harvesting software and lists built from it. In practice, a purchased list is almost always a liability rather than an asset.
Duty 2: identify yourself in every message
Section 17 of the Act requires every commercial electronic message to clearly and accurately identify the individual or organisation that authorised the sending, and to include accurate information about how the recipient can readily contact them. That information must remain valid for at least 30 days after the message is sent.
For most businesses this means using your correct legal name, or your name and Australian Business Number, rather than a friendly trading brand the recipient would not recognise. If you use an SMS platform or an agency to send on your behalf, the message must still identify your business as the one that authorised it. The recipient needs to know who is texting them and how to reach that person, not the platform that carried the message.
Duty 3: make unsubscribing easy, and honour it
Under s 18 of the Act, every commercial electronic message must include a functional unsubscribe facility: a clear and conspicuous statement that the recipient can reply to an address set out in the message to stop receiving messages. For SMS, a "Reply STOP" instruction satisfies this. The address you give must be reasonably likely to be capable of receiving unsubscribe messages at all times for at least 30 days after the message is sent.
There is a practical detail the ACMA flags: if you use an alphanumeric sender ID, such as your business name, as the message header, that header generally cannot receive replies. A customer tapping "STOP" into a thread that goes nowhere has still tried to unsubscribe, and the failure is yours. Use a number or shortcode that genuinely receives replies.
When a customer does unsubscribe, Schedule 2 of the Act gives you five business days to give effect to the withdrawal of consent. In the meantime the unsubscribe must be free, must not cost more than the standard message charge, and must not require the customer to provide extra personal information or log in to an account. Pizza Hut's enforcement action shows why this matters: customers who had already asked to stop receiving messages kept receiving them, which was one of the breaches that produced the $2.5 million outcome.
What happens if you breach the Act
The Spam Act is enforced through civil penalties rather than criminal offences. The ACMA can pursue penalties in the Federal Court under Part 4 of the Act, and the amounts are set by s 25 in penalty units, each currently worth just over $300. For a body corporate with no prior record, the maximum is 100 penalty units per contravention, capped at 2,000 penalty units where the court finds multiple contraventions on a single day. With a prior record, those figures rise to 500 penalty units per contravention and 10,000 penalty units per day. Since every message sent without consent is a separate contravention, a campaign can accumulate exposure very quickly.
The ACMA does not have to go to court. It can issue infringement notices carrying penalties of up to 1,000 penalty units for a body corporate facing 50 or more consent breaches, and it regularly secures enforceable undertakings under which a business commits to a compliance program and pays a negotiated amount. The Pizza Hut case combined an infringement notice with an enforceable undertaking and a public investigation report, so the reputational cost sits alongside the financial one.
Individuals are not sheltered by their company. The Act makes it a civil penalty contravention to aid, abet, counsel or be knowingly concerned in a breach, so a director or marketing manager who drives an unlawful campaign can face personal exposure.
Compliance checklist for SMS marketing
Work through these steps before each campaign, and keep the records each one produces:
- Audit every number on your list and record how and when you obtained it. If you cannot point to a consent record, an active relationship that supports inferred consent, or a clearly opted-in customer, do not send to it.
- Switch to express consent where possible: an unchecked opt-in box, a paper or digital form, or a recorded phone agreement, with the date and channel noted.
- Never send a message asking for permission to send messages.
- Identify every message with your correct legal name or ABN and accurate contact details that will stay valid for at least 30 days.
- Include a working "Reply STOP" in every campaign message, and confirm your sender ID or shortcode actually receives replies.
- Monitor your unsubscribe inbox daily and action requests within five business days, without fees, extra information or login requirements.
- If you use an SMS platform, review the contract so you know who is treated as the sender and whether the platform's tools support consent records and unsubscribes.
- Keep consent and unsubscribe records in one place so they survive staff changes and platform changes.
Where a lawyer can help
The Spam Act duties look simple on paper, but the judgement calls are where businesses get into trouble: whether inferred consent exists for a particular list, whether a message crosses from factual into promotional, and what a compliant consent collection point looks like in your specific checkout or onboarding flow. A commercial lawyer can review your consent capture and records, draft the wording of opt-ins and privacy collection notices, and check your SMS platform agreement so the obligations land on the right party.
If the ACMA has already contacted you, that is the point where legal input becomes urgent. Responding to an investigation, negotiating an infringement notice or an enforceable undertaking, and assessing whether a penalty can be reduced are all matters where early advice materially changes the outcome.
Start with your consent trail
The duty most often missed is not the unsubscribe button, it is the assumption that a one-off purchase or a bought list amounts to consent. That assumption is exactly what produced the largest recent enforcement outcomes, because a list of recent buyers feels like permission and legally is not. Before your next campaign, take the first action that matters most: write down, for each number on your list, how you got it and what the customer agreed to. If you cannot answer, do not send. That one hour of housekeeping is what keeps a channel that should be your cheapest marketing tool from becoming your most expensive regulatory mistake.