SMS Marketing & Compliance guide

• Express consent: The recipient has to have clearly agreed to receive marketing messages. This could be through a sign-up form, a checked consent box, a verbal agreement, or another explicit opt-in method. The terms of consent must be clear and available to the recipient when they give their permission.
• Inferred consent: This means you can reasonably assume someone is okay with receiving marketing messages because they already have an ongoing relationship with your business. For example, they recently made a purchase or shared their contact details in a context where marketing messages would be expected. However, this type of consent isn't permanent. As the relationship becomes inactive over time, you can no longer assume the person expects to hear from you. What doesn't count as consent: a pre-ticked checkbox, a purchased or scraped contact list, or consent buried inside unrelated terms and conditions.

1. Consent: Obtained before the message is sent and documented (date, method, and what the recipient agreed to).
2. Sender identification: The message must clearly identify the business sending it, with accurate contact information for that business.
3. Unsubscribe: Every message needs a free, functional way to opt out, described clearly in the text.

If you miss any one of these three, the message is non-compliant, regardless of how the other two are handled.

• The unsubscribe mechanism must stay functional for at least 30 days after the message is sent.
• Opt-out requests must be actioned within 5 business days.
• Opting out cannot require a login, extra personal information, or payment.
• Every marketing message must include a clear and easy way to unsubscribe. "Reply STOP to opt out" is the standard approach recognized by ACMA. When someone replies STOP, the opt-out must work immediately, and they shouldn't receive any future marketing messages from that sender.

• Established under the Telecommunications (SMS Sender ID Register) Industry Standard 2025, as part of the government's Fighting Scams initiative.
• Any business using an alphanumeric sender ID (a brand name instead of a number, like "ZEPIC" or "MyClinic") must register that sender ID with ACMA.
• As of 1 July 2026, any unregistered alphanumeric sender ID is automatically over-stamped as "Unverified" by the carrier before it reaches the recipient.
• Registration has to go through one of three pathways: Australian entities with an ABN, international entities without an ABN, and wholesale or reseller partners sending on behalf of a brand.
• Numeric sender IDs are not affected. This requirement is specific to branded, alphanumeric sender names.

The Spam Act defines a commercial electronic message broadly: any message that offers, advertises, or promotes goods, services, or a business or investment opportunity.

• Purely factual or transactional messages (delivery updates, appointment reminders, one-time passcodes) generally fall outside the Act's marketing rules, as long as they don't include promotional content. Adding a discount or upsell to a transactional text turns it into a commercial message subject to the full consent and unsubscribe requirements.
• Designated commercial electronic messages, including those from government bodies, registered political parties, registered charities, and educational institutions messaging current or former students, have relaxed requirements. They still need to identify the sender, but they aren't required to include an unsubscribe facility.