Automated SMS is one of the highest-response channels in business communication, open rates consistently above 90%, most messages read within three minutes. That reach comes with a compliance framework that matters. Understanding the rules up front saves you from enforcement action and, more importantly, from damaging the trust of customers who didn't agree to hear from you.
This page covers the law as it applies to Australian businesses using automated SMS for lead follow-up, missed-call text-back, appointment reminders, and reactivation campaigns.
The primary legislation: Spam Act 2003 (Cth)
The Spam Act 2003 is the main federal law governing commercial electronic messages in Australia. It applies to email and SMS. The Act is administered by the Australian Communications and Media Authority (ACMA).
Three requirements apply to every commercial SMS your business sends:
- Consent, the recipient must have agreed to receive messages from you, either expressly or under the implied consent provisions described below.
- Identification, each message must clearly identify who sent it and provide a way to contact the sender.
- Unsubscribe, every commercial message must include a functional opt-out mechanism, and opt-out requests must be honoured promptly (within five business days under the Act).
Penalties for serious or repeated breaches can reach millions of dollars. ACMA publishes enforcement actions on its website; the most common causes are sending without consent and failing to honour opt-out requests.
Express consent vs implied consent
Express consent is clear and unambiguous, for example, a tick-box on a booking form saying "I agree to receive SMS updates from [Business Name]." It is the safest form of consent and the one Clearline AI uses as the default for all new contact flows.
Implied consent is more nuanced. Under the Spam Act, implied consent can exist where:
- The recipient has a current or recent business relationship with the sender, and the message is directly related to that relationship; or
- The recipient has conspicuously published their contact details (for example, on a public website or directory) without any statement that they do not want commercial messages, and the message is relevant to their business or professional role.
For missed-call text-back specifically, ACMA has indicated that a person calling a business number gives a reasonable basis for implied consent to receive a single response SMS related to that call. The message must be directly connected to the call, for example, acknowledging the missed call and offering to help, not a general marketing message.
Implied consent is not indefinite. It applies for as long as the business relationship is active and can expire. Best practice is to collect express consent at the first appropriate opportunity.
The Do Not Call Register
The Do Not Call Register Act 2006 applies to telemarketing calls and some fax communications. It does not directly regulate SMS under the Spam Act framework. However, a number registered on the DNCR is a strong signal that the person does not want unsolicited contact. If your business uses outbound calling as well as SMS, you must check the register before making marketing calls.
What this means in practice for common SMS use cases
Missed-call text-back: A caller contacts your business and the call is not answered. An automated SMS fires within seconds acknowledging the missed call. This sits within implied consent under the Spam Act, the caller initiated contact, and the SMS is directly related to that call. The message must identify your business and include opt-out language.
Appointment reminders: Sent to customers who have already booked an appointment. The booking itself constitutes implied (and often express) consent for communications related to that appointment. These are among the lowest-risk SMS messages from a compliance standpoint.
Lead nurture sequences: Follow-up messages sent to prospects who made an enquiry but have not yet booked. Implied consent applies while the enquiry is active and the messages are directly related to it. After a reasonable period, or if the prospect opts out, messages must stop.
Reactivation campaigns: Messages sent to past customers who have not engaged for some time. These require care. If the customer expressly agreed to marketing communications, reactivation is straightforward. If you are relying on implied consent from a past business relationship, the time elapsed and the nature of the message matter. A warm, relevant message ("It's been a while. We're running a priority booking period this month") is different from a cold promotional blast. Clearline builds all reactivation flows with this distinction in mind and captures opt-in at the start of each campaign.
Practical compliance checklist
- Collect and record consent at the point of contact, booking forms, enquiry forms, and call recordings are all valid records.
- Every SMS identifies the business by name in the message body or sender ID.
- Every commercial SMS includes opt-out instructions, for example, "Reply STOP to unsubscribe."
- Opt-out requests are actioned promptly and recorded in the CRM, the contact is suppressed from future sends.
- Missed-call text-back messages are scoped to the call context, not repurposed as general marketing.
- Reactivation lists are screened for prior opt-outs before sending.
- Message timing respects reasonable hours, avoid sends before 8am or after 9pm local time.
ACMA enforcement and the current regulatory environment
ACMA takes a graduated approach to enforcement: investigation, formal warning, infringement notice, and civil penalty proceedings. Most first-time issues that arise from genuine misunderstanding are resolved at the warning stage, provided the business cooperates and corrects the conduct quickly. Repeat or large-scale breaches, particularly mass spam campaigns or persistent failure to honour opt-outs, attract the larger penalties.
The regulatory environment has tightened over the past five years, with ACMA publishing more enforcement actions and making use of expanded powers under the 2021 amendment to the Spam Act. The direction of travel is toward stricter enforcement, not lighter.