SMS Marketing Laws in Australia: What You Must Know Before Sending

Stay compliant with the Spam Act and the Sender ID Register · Updated July 2026

SMS marketing works because texts get read, but that power comes with strict rules. Australia's spam laws are enforced with real, large penalties, so getting this right is not optional. Here is what every small business must know before sending a single marketing text.

The three rules of the Spam Act

Australia's Spam Act 2003, regulated by ACMA, requires three things for every marketing message:

• Consent. The person must have agreed to receive marketing texts from you, either expressly (they opted in) or, in limited cases, inferred from an existing relationship. Express consent is always safest.
• Identification. Every message must make clear who is sending it. The recipient should never have to guess which business the text is from.
• Unsubscribe. Every message must offer a simple opt-out, typically "reply STOP", and you must honour it promptly.

Express vs inferred consent, in plain English

This distinction is where most small businesses come unstuck, so it is worth being precise.

Express consent is when someone directly and knowingly agrees to receive marketing texts from you: they ticked a box that said so, they texted a keyword to join your list, they wrote their mobile on a form that clearly stated they would receive SMS offers. It is unambiguous, and it is what you should be collecting.

Inferred consent is narrower than most owners assume. It can arise from an existing business relationship, or where someone has conspicuously published their business contact details without indicating they do not want marketing, and your message is directly relevant to their role. It is not a licence to text anyone who has ever bought from you about anything, and it is never a defence for a list you bought or scraped.

The practical takeaway: if you find yourself constructing an argument for why consent might be inferred, that is exactly the moment to stop and go collect express consent instead. If a complaint is made, you are the one who has to justify it.

The penalties are real

This is not a rule that goes unenforced. ACMA issues significant penalties for spam breaches, running into hundreds of thousands of dollars a day for serious or repeated offences, and it publishes the names of the businesses it penalises. For a small business, a single careless campaign to a non-consented list can be genuinely damaging, financially and reputationally. The cost of compliance is trivial next to the cost of getting it wrong.

The SMS Sender ID Register

Australia has introduced a mandatory SMS Sender ID Register to combat scam texts by verifying legitimate business senders. If you send SMS using a branded alphanumeric sender ID, where your business name appears in place of a phone number, this adds a registration step. The obligations here have been rolling out and tightening, so check the current ACMA guidance before launching an SMS program rather than relying on something you read a year ago. Most reputable SMS platforms handle the registration mechanics for you, but confirm that with your provider rather than assuming.

Keep the records, because the burden is on you

If a complaint is made, you are the one who has to demonstrate that consent existed. "We think they signed up at some point" is not a record. For every contact on your SMS list you should be able to say when they consented, how they consented, and what they were told they were agreeing to.

A simple exported spreadsheet with the mobile number, the date, and the source (web form, in-store sign-up, keyword opt-in) is enough for most small businesses. Keep it for as long as you are texting that person, and for a reasonable period afterwards. Most SMS platforms log this automatically, but check that yours does, and check that you can actually export it if you ever need to.

How to stay on the right side

Keep it simple: only text people who have expressly opted in to SMS specifically, always identify your business clearly, always include "reply STOP", and act on opt-outs immediately. Keep records of when and how each person consented. A reputable SMS platform will build most of this in, but the legal responsibility sits with you, not the tool. When in doubt, get explicit consent and seek professional advice.

This is general information, not legal advice. The rules in this area have been changing, so check ACMA's current guidance or consult a professional before launching an SMS program.

Frequently asked questions