SMS marketing laws in Australia: What the rules mean in practice

July 28, 2026

Yes, SMS marketing is legal in Australia. You follow the Spam Act 2003, and that law sorts your messages into two buckets: Commercial and factual. Get a commercial message wrong and the ACMA can fine you.

I support SMS APIs and messaging applications at Sinch, and I also wrote SimpleTexting’s US SMS compliance guide. So I spend a lot of time in the gap between how the two countries (and many others) handle this. Australia’s rules are simpler than the American version, but the assumptions US teams carry across are often wrong.

Let me walk through what the Australian law actually requires, in the order you’d tackle it. Then I’ll cover the US-style rules that aren’t law in Australia – but are still worth following like best practices.

Here’s the short version:

• SMS marketing is legal in Australia when you have consent, identify yourself, and offer a working opt-out.
• Since July 1, 2026, branded sender IDs must be registered or they show as “Unverified.”
• The Do Not Call Register doesn’t cover marketing texts – the Spam Act does.
• The ACMA fines real businesses real AUD, so these rules are worth building in early.

Before the rules, work out which messages they apply to. The Spam Act 2003 governs commercial electronic messages sent to Australian addresses, across SMS, MMS, email, and instant messages.

A message is commercial if it has any promotional or sales content. That holds even when the message is mostly factual. It also applies when the only marketing is a link or phone number inside it, according to the ACMA. Commercial messages need consent, sender identification, and an opt-out.

Purely factual messages are treated differently. A bill, a delivery update, an appointment reminder, or a one-time passcode carries no marketing, so it doesn’t need consent or an unsubscribe option. You must still identify yourself as the sender.

Some senders are exempt from the consent rule. Registered charities, government bodies, and registered political parties can market without prior consent, as can educational institutions messaging their students. They must still identify themselves and include contact details, per the ACMA.

Political message laws go further. An SMS that seeks to influence your vote or opinion is rarely covered by the Spam Act. It needs neither consent nor an unsubscribe option, because electoral law governs it instead.

With that settled, here’s the workflow.

Identification changed in a big way this year. Since July 1, 2026, businesses that send branded text messages must register their sender ID with the SMS Sender ID Register. A sender ID is the name at the top of a text, like “AusPost” or “myGov,” that shows who a message is from.

The register exists because sender IDs used to be easy to fake. Australians lost more than $13.8 million to text message scams in the first nine months of 2025, according to the ACMA. Much of that came from scammers impersonating trusted brands.

If your sender ID isn’t registered now, your messages show to recipients as “Unverified” and get grouped with suspected scams.

Registering is its own process, so I’ve written a separate walkthrough on how to register your SMS sender ID with ACMA. If you want the branded-name option itself, that’s an alphanumeric sender ID.

Consent is the rule businesses get wrong most often. Under the Spam Act, there are two kinds: Express and inferred.

Express consent is when a person knowingly agrees to receive your marketing. The ACMA treats this as best practice. Someone can give it by filling in a form, ticking a box on your website, agreeing over the phone, or opting in face to face.

One catch trips people up: You can’t send a text to ask for consent, because that text is itself marketing. Consent has to come first, through another channel.

Inferred consent is weaker and narrower. You may infer it when someone has a genuine, ongoing relationship with your business and the marketing relates directly to it. The ACMA’s example is a savings bank telling an existing customer about a higher-interest account – but not selling them insurance. It also doesn’t cover someone who simply bought something once.

Two more things follow from consent. Keep a record of who agreed, when, and how, because the burden of proof sits with you. And if you buy or rent a marketing list, you’re still responsible for having consent for every number on it. A good SMS provider will have features that help you with this.

Every marketing text must accurately identify you and include current contact details. If a provider sends on your behalf, the message must still name the business that authorised it. Use your correct legal name, or your name and Australian Business Number.

That information has to stay accurate for at least 30 days after you send. This is the rule your registered sender ID helps you meet. A verified name is the clearest way to show recipients the message is really from you.

Every marketing text needs a working way to opt out, and “Reply STOP” is the standard for SMS. The ACMA’s unsubscribe rules are specific.

Your opt-out must:

• Present clear unsubscribe instructions in the message.
• Honour any opt-out request within five working days.
• Cost the recipient no more than a standard message.
• Stay functional for at least 30 days after you send.
• Work without making the person log in or hand over extra details.

One point of genuine confusion is worth clearing up. The Do Not Call Register does not cover marketing SMS. It applies to telemarketing phone calls and marketing faxes.

Your business texts in Australia fall under the Spam Act instead, so consent – not the Do Not Call Register – is what makes them lawful.

The Spam Act governs how you send, not what you sell. Content rules live in other laws, and Australia has no single list like the US “SHAFT” categories. Instead, several regimes apply depending on what you promote.

• All marketing: Claims must be accurate and not misleading or deceptive under the Australian Consumer Law, which the ACCC enforces.
• Gambling and wagering: Promotion is restricted under the Interactive Gambling Act, with rules the ACMA enforces.
• Tobacco and vaping: Advertising is banned under the Public Health (Tobacco and Other Products) Act 2023, and vaping goods fall under the Therapeutic Goods Act.
• Health products: Therapeutic goods advertising is regulated by the TGA and its advertising code.
• Alcohol: Marketing follows the industry ABAC self-regulatory code rather than a single statute.

If you market in one of these categories, check the specific rules before you send. They apply on top of the Spam Act, not instead of it.

If you’ve run US campaigns, this part is a relief. American SMS marketing rules vary state by state on top of federal law, so a compliant program in one state can trip over another’s requirements.

Australia doesn’t work that way. The Spam Act is federal, and it applies the same everywhere from Perth to Brisbane. There are no state or territory SMS marketing laws to reconcile on top of it.

The stakes are not theoretical. The ACMA publishes its spam enforcement outcomes, and the penalties for consent, identification, and unsubscribe failures are large.

• Commonwealth Bank of Australia paid $7,502,610 in October 2024 for marketing emails and SMS sent without consent and without a working unsubscribe facility.
• Tabcorp (TAB) paid $4,003,270 in June 2025 over marketing SMS and WhatsApp messages sent without adequate sender information, opt-out, or consent.
• Latitude Finance Australia paid $3,960,000 in April 2026 for marketing SMS without proper sender contact details and without a functional unsubscribe.
• Telstra paid $626,000 in March 2025 for marketing SMS sent without consent and without a working opt-out.
• Outdoor Supacentre paid $302,500 in January 2024 for marketing SMS sent without consent.

The pattern is consistent. The businesses fined weren’t running scams. They were sending ordinary marketing to people who hadn’t properly consented, or without a clean opt-out.

Because I work across both markets in the US and Australia, this is the question I’ve heard from US teams: Which of our rules cross the Pacific? Legally, none of the ones below do. Australia’s law stops at consent, identification, and opt-out. But every one of these is a habit I’d keep, because it protects your opt-out rate and deliverability even when the law is silent. My US compliance guide covers how they work as law in the States.

• Opt-in confirmation messages. US carrier rules expect a confirmation text when someone subscribes. Australia doesn’t require one, but a clear “you’re subscribed” message sets expectations and cuts complaints.
• Opt-out confirmation messages. The US mandates a final “you’ve been unsubscribed” text. Australia doesn’t, and there’s a trap here. Once someone replies STOP, they’ve withdrawn consent. A purely factual confirmation is fine to send. But add any promotion – a win-back offer or a discount – and it becomes an unlawful marketing message.
• Quiet hours. US law restricts sending to roughly 8am–9pm local time. Australia sets no time-of-day limit on marketing SMS, but sending at sensible local hours still protects your reputation.
• Frequency limits. US carriers and some states cap message volume. Australia caps nothing, so consent and an easy opt-out are your only guardrails – over-messaging just drives people to reply STOP.

Treat these as the difference between the legal minimum and a program people actually stay subscribed to.

SMS marketing compliance is easier when the platform does the heavy lifting. Sinch Engage, formerly MessageMedia, is on the ACMA’s approved list of providers. That means you can register your sender ID through the messaging platform you already use.

The rules themselves still sit with you. Consent, identification, and opt-out are your responsibility on every send. But collecting opt-ins, adding a compliant “Reply STOP,” and keeping consent records are all things the right tools should make routine.

This is general information, not legal advice. Check with your own compliance or legal advisers for your situation.

Compliance is easier when it’s built into how you send. Talk to our team or explore Sinch Engage to see how it works.