Compliance
SMS Compliance in Australia: What Service Businesses Need to Know
The Spam Act 2003, ACMA consent rules, and what they mean when you automate missed-call text-back and follow-up campaigns.
Last updated: July 2026
If you automate SMS, whether that's a missed-call text-back, a follow-up sequence, or a reactivation campaign. You're operating under Australian law that has real teeth. The Spam Act 2003 and the Australian Communications and Media Authority (ACMA) set out clear requirements for consent, identification, and unsubscribe mechanisms. Penalties for serious breaches can reach millions of dollars.
This guide explains what the law actually requires, what's commonly misunderstood, and how Clearline AI builds compliant SMS flows.
The Spam Act 2003: the basics
The Spam Act 2003 prohibits sending "commercial electronic messages", including SMS, without the recipient's consent. A commercial message is one that offers, promotes, or advertises goods or services. If you're texting a missed caller about your plumbing service, that's a commercial message.
To send a commercial SMS legally in Australia, you need to satisfy three requirements:
- Consent, the recipient must have consented to receiving messages from you
- Identification, your message must clearly identify who sent it
- Unsubscribe, the message must provide a way to opt out, and that opt-out must be honoured within five business days
The two types of consent
Express consent
The clearest form. The customer has actively agreed to receive commercial messages from you, through a tick-box on a booking form, a verbal agreement that's been recorded, or a written acknowledgement. Express consent is unambiguous and should be your target for any reactivation or marketing campaign.
Inferred consent
This is where missed-call text-back sits. Under the Spam Act, consent can be inferred from an existing business relationship or from the fact that someone has published or given you their contact number in a context where receiving messages would be expected. When someone calls your business number, their number is provided in a context where a return message is reasonably expected, particularly if the message is directly related to the call.
ACMA's guidance confirms that inferred consent applies where there is an existing relationship or where the contact number has been provided voluntarily. A missed call, someone actively dialling your number, is a reasonable basis for inferred consent to receive a single, relevant reply message.
Important: Inferred consent is not a blank cheque. It covers a relevant, timely response to that specific interaction. It does not cover ongoing marketing messages or reactivation campaigns, those require express consent.
What this means for missed-call text-back
A missed-call text-back, an automated SMS sent to someone who called your business number but didn't get through, sits comfortably within inferred consent if:
- The message is sent promptly (within minutes, not days)
- The message is relevant to the call (acknowledging the missed call, offering to help with the enquiry)
- The message clearly identifies your business
- The message includes an opt-out mechanism
Clearline AI builds all missed-call text-back flows to meet these requirements by default.
What this means for reactivation campaigns
Reactivation campaigns, messages to past customers who haven't booked in a while, require express consent. If a customer gave you their number through a booking or service interaction, that establishes a prior business relationship, but it does not automatically mean they consented to receive future marketing messages. You need a clear record of consent.
Clearline builds reactivation campaigns using contact lists where consent has been properly captured. If you don't have that record for existing customers, the right approach is a consent-gathering campaign before any promotional messaging. How that works in practice is set out on the database reactivation page.
Consent: the practical compliance table
| Use case | Consent type required | Clearline approach |
|---|---|---|
| Missed-call text-back | Inferred (from the call) | Sent immediately, relevant to the call, includes opt-out |
| Lead follow-up sequence | Inferred (from initial enquiry) | Directly related to the enquiry, time-limited, includes opt-out |
| Reactivation to past customers | Express consent required | Only sent to contacts with documented consent |
| Promotional campaign | Express consent required | Requires consent capture before deployment |
The opt-out requirement
Every commercial SMS must include a functional unsubscribe mechanism. The most common approach is "Reply STOP to unsubscribe." Once someone opts out, you must not send them further commercial messages. ACMA requires this to be actioned within five business days, in practice, it should be immediate.
Clearline AI's SMS flows include opt-out instructions in every message and automatically suppress opted-out numbers from all future sends.
Identification: who sent this message?
Every SMS must make clear who it's from. This means your business name should appear in the message, either in the sender ID or in the message body itself. "Hi, it's Sarah from Metro Plumbing" satisfies this. An anonymous message with no business identification does not.
Your compliance checklist
- You have documented consent (express or inferred) for every number you're messaging
- Every SMS includes your business name or a clear sender ID
- Every SMS includes an opt-out instruction
- Opt-outs are actioned immediately and suppressed from all future sends
- Missed-call text-backs are sent promptly and are relevant to the call
- Reactivation campaigns are limited to contacts with express consent on record
- You're not sending commercial messages to numbers on the Do Not Call Register for voice calls, note this is a separate register to SMS opt-outs
Penalties and enforcement
ACMA actively enforces the Spam Act. Pecuniary penalties for serious or repeated breaches can be substantial, in 2023, ACMA issued an infringement notice to a company for over $2 million for Spam Act breaches. For small businesses, even a first breach can result in a formal warning and a compliance agreement that places you under scrutiny.
The risk isn't theoretical. Automated SMS at volume means a compliance problem becomes a compliance problem at volume. Getting the consent and opt-out mechanics right from the start is far cheaper than fixing a breach after the fact.
Frequently asked questions
Is it legal to text someone who called and hung up?
Yes, provided the message is directly related to the call, sent promptly, identifies your business, and includes an opt-out. This falls within inferred consent under the Spam Act. Clearline builds all missed-call flows to meet these requirements.
Do I need to register with ACMA?
There is no registration requirement for businesses sending commercial SMS. You simply need to comply with the Spam Act's consent, identification, and opt-out requirements.
What is the Do Not Call Register?
The Do Not Call Register applies to voice calls and some fax messages. It does not directly apply to SMS. However, ACMA has indicated that the spirit of the register should be considered. If someone has registered specifically to avoid unsolicited contact, treating their number with care is the right approach.
What counts as an existing business relationship for inferred consent?
ACMA's guidance points to scenarios where a person has made an enquiry, placed an order, entered into a contract, or provided their contact details in a context where communications would reasonably be expected. A missed call to your business number is a reasonable trigger for a single, relevant reply.