Sending a promotional SMS is easy. Knowing whether you can send it to a particular customer – and whether you have the right consent to do so – is where things get more complicated.
For businesses in Australia, SMS marketing must take into account requirements under the Spam Act 2003, the Privacy Act 1988, and rules around consent and marketing communications.
Whether you are promoting a new product, sending a limited-time offer or re-engaging an existing customer, you need to consider who you are contacting, what you are sending and whether the recipient has consented to receive promotional messages.
The good news is that compliance does not have to mean giving up on SMS marketing. The key is building consent, customer preferences and messaging controls into your SMS workflow from the start.
In this guide, we’ll look at the key Spam Act rules for promotional SMS in Australia, including how consent and unsubscribe requirements work, what counts as marketing, how the Privacy Act applies and how you can run SMS campaigns more responsibly.
What are the Rules for Promotional SMS or Telemarketing Messages in Australia?
Before sending an SMS marketing message in Australia, you need to establish whether the message is actually promotional.
A promotional SMS is generally a message intended to promote or offer goods, services, business opportunities or other commercial activity. This could include:
- “Enjoy 20% off your next purchase.”
- “Upgrade your broadband plan and receive one month of free service.”
- “New season arrivals are now available.”
- “Get A$50 off your next hotel booking.”
- “Refer a friend and receive a reward.”
The distinction matters because not every SMS a business sends to a customer is a marketing message.
Under the Spam Act 2003, these consent and unsubscribe requirements apply specifically to “commercial electronic messages” – not to every SMS a business sends. Messages that are purely factual or service-related, along with those sent for government, political, religious, charitable or educational purposes, generally fall outside the Act’s marketing requirements.
Consider the difference between these two messages:
“Your appointment at ABC Clinic is tomorrow at 10 am.”
and:
“Your appointment is tomorrow. Book another treatment this month and receive 20% off.”
The first is a service reminder. It relates directly to an existing appointment and does not introduce a promotional offer.
The second goes further by promoting another service and offering a discount. That promotional element means you should assess the message under the applicable consent and unsubscribe requirements set out in the Spam Act.
This is why you should look at the purpose and content of the message, rather than assuming that every SMS sent to an existing customer is automatically exempt from marketing rules.
A customer relationship does not, by itself, mean you can send any type of promotional SMS. Before launching a campaign, consider what you are sending, who you are sending it to and whether you have the appropriate consent to contact them for marketing purposes.
What Are the Spam Act and Privacy Act Rules for Promotional SMS in Australia?
When you send promotional SMS in Australia, you may need to consider both the Spam Act 2003 and the Privacy Act 1988. They are related, but they address different aspects of your marketing activity.
It’s worth noting that Australia’s framework works a little differently to Singapore’s. Rather than splitting data protection and telemarketing consent across two separate regimes – a broader privacy law and a separate Do Not Call Registry that covers SMS – Australia relies primarily on one SMS-specific law, the Spam Act 2003, to cover consent, sender identification and unsubscribe requirements together. The Privacy Act 1988 then applies separately, governing the broader collection, use and disclosure of personal information, including phone numbers.
The Spam Act 2003, enforced by the Australian Communications and Media Authority (ACMA), is Australia’s primary law governing commercial electronic messages, including SMS. It requires that you have the recipient’s consent – express or reasonably inferred – before sending a commercial message, that the message clearly identifies the business sending it, and that it includes a functional way to unsubscribe.
The Privacy Act 1988, enforced by the Office of the Australian Information Commissioner (OAIC), governs how organisations collect, use and disclose personal information more broadly, under the Australian Privacy Principles (APPs). It generally requires organisations to collect personal information fairly, to use it only for purposes an individual would reasonably expect, and it gives individuals rights to access and correct their information.
It’s also worth noting that Australia does have a Do Not Call Register, under the Do Not Call Register Act 2006 – but it covers only voice telemarketing calls and marketing faxes sent to Australian numbers. It does not apply to SMS, so there is no separate SMS do-not-call register to check before sending a promotional text message in Australia.
So, when you are planning an SMS marketing campaign, it is important not to treat Spam Act compliance and Privacy Act compliance as the same thing.
A simple way to think about the distinction is:
- Spam Act: Do you have the recipient’s consent – express or inferred – proper sender identification, and a working unsubscribe mechanism for this SMS?
- Privacy Act: How are you collecting, using and managing the customer’s personal information more broadly?
Depending on your campaign and how you obtained and use customer data, both frameworks may be relevant. This is why having a customer’s phone number does not automatically mean you can send them promotional SMS.
Before you send a campaign, you should consider the source of the number, the consent obtained, the purpose of the message, and whether the message meets the Spam Act’s consent, identification and unsubscribe requirements.
How Does the Spam Act Apply to Promotional SMS Marketing in Australia?
The Spam Act 2003 requires valid consent before you send a commercial electronic message, including SMS, to an Australian number. For businesses, the practical question is simple: is the SMS you are sending a commercial message under the Spam Act, and do you have valid consent – express or inferred – to send it?
When does a business need consent under the Spam Act?
The first step is to look at what the message is actually trying to achieve.
For example:
Promotional SMS:
“Weekend sale! Enjoy 20% off all shoes. Shop now: [link]”
Service message:
“Your order #12345 has been dispatched and will arrive tomorrow.”
The first message promotes a commercial offering and should be assessed under the Spam Act’s consent requirements. The second relates directly to an existing transaction and is not automatically treated as a commercial message simply because it is sent to a customer’s mobile number.
The distinction becomes less clear when you combine service information with a promotion:
“Your order is arriving tomorrow. While you’re waiting, enjoy 20% off your next purchase.”
The first sentence is operational. The second introduces a promotional purpose.
Adding promotional content to a transactional notification does not automatically make the communication transactional. If the message is partly intended to promote a product, service or commercial opportunity, you should assess the message based on its overall purpose and content under the Spam Act.
This is particularly important when designing automated SMS workflows. A message that starts as a legitimate service notification can take on a marketing purpose if promotional content is added later in the workflow.
Does the Spam Act apply to every type of SMS in Australia?
The Spam Act’s consent requirements apply specifically to commercial electronic messages, not every SMS a business sends.
Certain types of messages generally fall outside the Act’s marketing requirements, including factual or service-related messages, and those sent for government, political, religious, charitable, educational or employment-related purposes. Messages relating to products or services a customer has already purchased, such as warranty, recall, safety or delivery information, may also fall outside the definition of a commercial message.
This distinction matters when your business uses SMS for different parts of the customer journey. A single messaging programme might include:
- Transaction confirmations
- Delivery updates
- Appointment reminders
- Account notifications
- Authentication messages
- Promotional campaigns
These messages may serve very different purposes, so you should not apply a blanket rule to every SMS in your database. Each use case should be assessed based on what the message is intended to achieve and whether it falls within the scope of the Spam Act’s marketing requirements.
Unlike Singapore’s Do Not Call Registry, there is no separate SMS opt-out register to check in Australia, and no periodic validity window to track for a registry result. Instead, your compliance process should focus on maintaining valid, up-to-date consent – express or inferred – and a working unsubscribe mechanism for every recipient on an ongoing basis, and on promptly removing anyone who unsubscribes.
How Does the Privacy Act Apply to SMS Marketing in Australia?
The Privacy Act 1988 and the Australian Privacy Principles (APPs) set out Australia’s general framework for how organisations collect, use and disclose personal information. For SMS marketing, this matters because a customer’s mobile number can be personal information when it can be associated with an identifiable individual.
The Privacy Act generally requires you to collect personal information fairly, let customers know why you are collecting, using or disclosing their data, and avoid using it for purposes they would not reasonably expect.
For SMS marketing in Australia, it helps to think about the entire customer data journey:
Collection → Notification → Consent → Marketing use → Opt-out → Suppression
For example, a retailer might ask for a customer’s mobile number when they create an account. Having the number does not automatically mean you can use it for every future marketing purpose.
You need to consider what the customer was told when their number was collected, what consent they provided under the Spam Act and whether that consent covers the promotional communications you intend to send.
The same principle applies when you collect customer data through purchases, registrations, events or other touchpoints. Your SMS marketing workflow should reflect the permission the customer actually gave you – not simply the data you happen to have.
And when a customer withdraws their consent or opts out, your processes should ensure that they are no longer included in future marketing communications.
This makes consent management more than a one-time checkbox. It is an ongoing part of how you collect, use and manage customer data throughout the marketing journey.
It’s also worth noting that Australia’s privacy framework is evolving. The Privacy and Other Legislation Amendment Act 2024, which received royal assent on 10 December 2024, introduced a new statutory tort for serious invasions of privacy, higher penalties for breaches, and expanded enforcement powers for the OAIC. Businesses running SMS marketing campaigns should expect privacy compliance expectations in Australia to keep tightening.
What does the Privacy Act mean for an Australian business sending promotional SMS?
If you are sending promotional SMS, you should be able to answer a few basic questions about every customer you contact:
- Where did you get the customer’s mobile number?
- Why was the number collected?
- What was the customer told the number would be used for?
- Did the customer consent to receiving marketing communications under the Spam Act?
- What channels does that consent cover, such as SMS or voice calls?
- How can the customer withdraw their consent?
- How do you record and apply withdrawal requests to future campaigns?
These questions become particularly important when your SMS campaigns are connected to a CRM, marketing automation platform or customer database.
You may have the same customer’s mobile number stored across several systems. If that customer opts out of marketing, removing the number from just one campaign list may not be enough. Your opt-out and suppression processes need to work across the relevant systems to prevent the customer from being included in future promotional campaigns.
What Consent and Opt-Out Conditions Are Required for Promotional SMS in Australia?
For promotional SMS in Australia, businesses should make sure recipients have either clear consent – express or reasonably inferred – to receive the relevant marketing messages, or that an applicable Spam Act exemption applies.
Where clear consent has been obtained, organisations can send the relevant commercial messages provided they also meet the Spam Act’s sender identification and unsubscribe requirements. However, the consent should be properly documented so the business can demonstrate what the individual agreed to receive and when that consent was obtained.
In practice, consent should make the marketing purpose clear. For example, a sign-up form stating:
“I agree to receive promotional offers and updates from ABC by SMS.”
is more explicit than simply collecting a customer’s mobile number during checkout.
The distinction matters because having a customer’s mobile number is not the same as having consent to use it for marketing. Businesses should retain appropriate records showing when and how consent was obtained, what the individual was told, and what types of communications they agreed to receive.
Consent is also not necessarily permanent. Individuals can withdraw their consent or unsubscribe at any time, and your business will need to provide a functioning unsubscribe mechanism and act on withdrawal requests promptly, as required under the Spam Act.
For businesses running ongoing campaigns, keeping consent and communication preferences up to date is just as important as obtaining consent in the first place. Using 8×8 CPaaS’s services to manage SMS campaigns can help centralise campaign operations and reporting, making it easier for your teams to monitor messaging activity and manage customer communication workflows.
How Do the Spam Act and Privacy Act Work Together?
The easiest way to understand the two frameworks is to treat them as related but separate considerations.
| Spam Act | Privacy Act | Consent | |
| What does it address? | Commercial electronic messages, including SMS | Broader personal information protection | Whether an individual has agreed to a specified marketing use |
| Does it apply only to SMS? | No – also covers email and other commercial electronic messages | No | No |
| Relevant to SMS marketing? | Yes | Yes | Yes |
| Does a Do Not Call Register check apply? | No – the Do Not Call Register Act 2006 covers only voice calls and faxes, not SMS | Not applicable | Depends on what consent was withdrawn |
The practical takeaway is that businesses should not treat “Spam Act compliant”, “Privacy Act compliant” and “customer opted in” as interchangeable statements.
Instead, your SMS marketing workflow should consider both frameworks where relevant – from how the customer’s number was collected, to whether they agreed to receive marketing, to whether the intended message meets the Spam Act’s consent, identification and unsubscribe requirements.
What Should Businesses Check Before Sending Promotional SMS in Australia?
A practical compliance checklist can help your team catch potential issues before a campaign reaches customers.
1. Identify the message type
Start by determining what the SMS is actually intended to do. Is it:
- Promotional or telemarketing
- Transactional
- A service notification
- An appointment or delivery reminder
- A customer service communication
Do not assume that adding a promotional offer to an otherwise operational message makes the entire SMS transactional. Look at the purpose and content of the message as a whole.
2. Check the consent status
Determine whether the recipient has provided clear consent – express or reasonably inferred – to receive the relevant marketing communication under the Spam Act.
Keep appropriate records showing when and how consent was obtained, what the customer was told and what they agreed to receive.
3. Confirm Spam Act compliance
Confirm that the message meets the Spam Act’s requirements: valid consent, clear identification of your business, and a working unsubscribe mechanism. There is no separate SMS do-not-call register to check in Australia – the Do Not Call Register Act 2006 covers only voice calls and faxes – so compliance rests on these Spam Act requirements rather than a registry lookup.
For recurring campaigns, also make sure consent remains current and that your unsubscribe mechanism is tested and working, rather than assuming an earlier check remains valid indefinitely.
4. Review the message
Before sending, check that the SMS meets the Spam Act’s requirements for identifying the organisation and providing the required contact or unsubscribe information.
This is also a good opportunity to review the message itself. Make sure any promotional content is clear about what is being offered and does not conflict with the customer’s communication preferences.
5. Apply opt-outs
If a customer withdraws consent or otherwise requests not to receive marketing communications, make sure their preference is applied across the relevant campaign and customer lists.
An opt-out should not simply remove someone from one campaign if their number remains active in another marketing workflow.
6. Keep records
Maintain appropriate records of consent, Spam Act compliance checks, campaign lists and withdrawal requests.
This gives your organisation an auditable process and makes it easier to investigate a customer complaint, review a campaign or demonstrate how your messaging decisions were made.
How Can 8×8 CPaaS Support Effective & Compliant Promotional SMS Marketing in Australia?
For promotional SMS campaigns in Australia, having the right infrastructure is only part of the equation. Your campaigns also need to fit into your processes for consent, Spam Act compliance, Sender ID registration and campaign management.
8×8 CPaaS can help you put the right SMS infrastructure and processes in place, from Sender ID support and campaign management to reporting, integrations and dedicated support, so your team has greater visibility and control over how promotional messages are sent.
The 8×8 Connect platform is an intuitive, all-in-one multi-channel communications management portal that brings SMS, voice and messaging apps together in a single dashboard.
- Support for Sender ID requirements: Use a custom Sender ID for your business communications, with support for Australia’s Sender ID requirements under ACMA’s SMS Sender ID Register.
- Large-scale messaging: Send millions of messages through a single platform, making it suitable for businesses running high-volume customer communications and marketing campaigns.
- Real-time analytics and reporting: Monitor campaign activity and messaging outcomes through real-time reports, giving marketing teams data they can use to evaluate and optimise campaigns.
- Multi-channel communication: Extend campaigns beyond SMS by connecting with voice and supported messaging apps, helping businesses maintain more consistent customer communications across channels.
- SMS API integration: For businesses that need communications embedded into their own systems, 8×8 CPaaS provides SMS APIs, reporting APIs and integration resources.
Talk to our experts to learn how 8×8 CPaaS can help you build a more controlled, scalable and compliant approach to promotional SMS marketing in Australia.
