Spam Act basics: what to check before you email or text customers

A customer gives you an email address for a receipt or a phone number for a booking. Before either becomes a marketing contact, somebody needs to check what the customer agreed to receive.

For ordinary promotional email and SMS, the Australian Communications and Media Authority’s spam guidance comes down to three requirements: consent, accurate sender information and a working way to unsubscribe. Putting a campaign through familiar software does not settle any of them.

This guide covers everyday business marketing. The Spam Act 2003 applies to commercial electronic messages with an Australian link, which can arise through the sender or recipient. Special exemptions and contractual arrangements need their own assessment; they are not assumed here. This is general information, not legal advice.

Start with the whole message

A sale announcement is easy to recognise as marketing. The less obvious cases are the messages a business calls operational.

In its 2026 compliance guidance, ACMA warns that an invoice, shipping update or account confirmation can be commercial when it also promotes products or services. The same applies to a customer follow-up offering something extra. The message’s main purpose does not cancel out the promotional content.

Check the links as well as the text. ACMA says material directly available through links, phone numbers or contact details can make a message commercial. A logo or branding in an otherwise entirely factual message is not generally enough on its own, but a link to a promotion changes the question.

ACMA’s practical recommendation is to keep factual service messages separate from promotions. For an office manager, that means checking the automated templates as well as the newsletter: order confirmations, receipts, welcome sequences and follow-ups can all contain sales material.

Consent needs a reason you can show

There are two routes: express consent and consent that can reasonably be inferred from conduct and relationships.

Express consent is the clearer option. ACMA describes a person knowingly agreeing to marketing, whether through a form, a website checkbox, a phone conversation or in person. Keep a record of who agreed, when and how. You cannot send a marketing email or text simply to ask for marketing consent.

Inferred consent is narrower than having someone’s details. ACMA’s common-mistakes guidance warns against automatically adding people after a one-off purchase or email enquiry. A paperless receipt should not quietly become a newsletter subscription. An ongoing relationship and marketing directly relevant to that relationship can support an inference, but the circumstances matter.

Our recommendation is to record the basis for each audience before importing it into a sending platform. If staff cannot explain where the permission came from, leave those contacts out of the campaign while the position is checked.

A public business address is not blanket permission

The Act says publication alone does not establish consent. Its limited conspicuous-publication provision has conditions, including the recipient’s role, publication that can reasonably be assumed to have occurred with the relevant person’s or organisation’s agreement, no statement rejecting unsolicited commercial messages, and relevance to that role’s work.

That is not a general business-to-business exemption. Our recommendation is to have anyone proposing cold outreach document the actual consent basis, rather than treating a website address or directory listing as an automatic opt-in.

Make the responsible business clear

Section 17 of the Act requires the message to clearly and accurately identify the individual or organisation that authorised it, with accurate information about how to contact them. The information must be reasonably likely to remain valid for at least 30 days after sending.

If an agency sends the message, the business authorising it still needs to be identified. A useful check is to read a test message as a stranger would: can you tell which business it came from and how to reach that business? Check SMS templates separately from email footers.

Unsubscribing must actually work

For ordinary marketing, build the unsubscribe process to meet ACMA’s standard requirements:

• Give clear instructions for stopping further marketing.
• Honour the request within five working days.
• Keep the unsubscribe facility functional for at least 30 days after sending.
• Do not charge an unsubscribe fee or require a premium-rate service. The usual cost of sending a reply SMS can apply.
• Do not require extra personal information, an account login or a newly created account to unsubscribe.

The Spam Regulations 2021 allow the electronic address that received the message to be requested; that does not justify asking for a date of birth or other unrelated details. The standard rules are the sensible design target. Do not invent an exception because your software’s default unsubscribe screen is inconvenient.

Branded SMS needs particular care. ACMA warns that recipients generally cannot reply to an alphanumeric sender ID. A message saying “Reply STOP” is not a working unsubscribe method if replies cannot reach you. Have the messaging provider demonstrate the method customers can actually use. Our SMS Sender ID Register explainer covers the separate registration process for business-name texts.

Check what happens after someone opts out

The visible unsubscribe link is only one part of the job. ACMA warns that outsourced marketing does not transfer the business’s responsibilities, and a purchased list still needs an adequate consent basis. It also flags attempts to send promotional resubscription messages to people who have withdrawn consent.

Our recommendation is to give one person ownership of opt-outs across the systems you use. Ask an agency how it receives updates, and check that a later spreadsheet import cannot put an unsubscribed contact back into the same marketing campaign. Use a test contact to follow the process from the message through to the sending list.

Keep the evidence somewhere the next person managing campaigns can find it. A handover should explain the source of the list, the consent records, the unsubscribe process and who handles requests. That is more useful than assuming the platform took care of it.

Checklist

• Review each promotional audience before sending. Record the consent basis and exclude contacts whose permission has not been established.
• Save consent records with your marketing process. Record who agreed, when and how so the next campaign owner can check them.
• Inspect automated email and SMS templates. Check service messages and their links for promotional material before treating them as purely factual.
• Check the sender details in a test message. Identify the authorising business and include contact information expected to remain valid for at least 30 days.
• Test each unsubscribe method with your provider. Confirm it works without extra personal details or a login and stays functional for at least 30 days after sending.
• Assign an owner for opt-out requests. Ensure they are honoured within five working days across the relevant marketing systems and agency lists.
• Check later imports against previous opt-outs. Have the campaign owner verify that the same marketing list does not re-add people who unsubscribed.