Skip to main content
zatersio

SMS Compliance in Australia: 4 Checks to Run Before 1 July 2026

SMS Compliance in Australia: 4 Checks to Run Before 1 July 2026

Decorative SMS compliance title card illustration

Get express consent before you send a single marketing text, name your business clearly in the message, and give people a working, free way to opt out. If you use a branded sender ID, register it with your telco so it isn’t flagged as unverified. Keep proof of consent on file and act on unsubscribe requests fast.

TL;DR:

  • Businesses must obtain express consent and keep proof of it to avoid compliance issues, especially when sending promotional texts.
  • All commercial SMS should clearly identify the sender and include a working, easy-to-use opt-out method, with testing before campaigns launch.
  • From July 2026, all branded sender IDs in Australia must be registered, or messages will display an “Unverified” label that can harm trust.
  • Automate the logging of consent and unsubscribe requests, and regularly review sender ID registration status to stay compliant.
  • Sending too many messages or not segmenting audiences appropriately can lead to customer complaints and regulation enforcement action.
Zatersio
Automate Your SMS Compliance Workflows
Zatersio builds bespoke software and AI driven automation to reduce repetitive administration and help teams manage operational tasks efficiently.

Table of Contents

The Spam Act 2003 is the law that governs commercial electronic messages in Australia, and SMS falls squarely inside it. A “commercial message” isn’t limited to obvious sales blasts. It’s any text that promotes, advertises or otherwise markets goods, services or a business, even when it’s dressed up as a reminder or a welcome note.

Consent comes in two flavors, and the difference matters:

  • Express consent is when someone actively opts in, ticking a box, replying “yes” to a keyword, or signing up through a form that clearly says they’ll get marketing texts.
  • Inferred consent applies in narrower cases, such as an existing customer relationship where a reasonable person would expect to hear from you, but the burden of proving that inference sits with you, not the customer.

A welcome message that mixes in a discount code or a product plug stops being purely transactional. Once promotional content sneaks in, the same consent and opt-out rules apply as they would to a full marketing campaign.

Get the message content right: identify yourself, offer a real opt-out

Every commercial SMS needs two things baked in, and getting either wrong is one of the fastest ways to attract a complaint.

  1. Identify your business. Use your registered trading name and, where relevant, your ABN, so a recipient can tell exactly who is texting them without guesswork.
  2. Include a working unsubscribe. The opt-out must be clear, free or low cost, and require no login. You then have five business days to action any unsubscribe request.
  3. Test the reply path before you launch. Alphanumeric sender IDs (the ones that show a business name instead of a number) usually can’t receive SMS replies at all, so a “reply STOP” instruction is useless unless you provide a short URL or a separate number that actually works.

Run that unsubscribe flow yourself, on a real phone, before your first campaign goes out. It’s the single cheapest test that prevents the most common compliance failure.

The Sender ID Register and what branded texts require now

Australia’s SMS Sender ID Register exists to stop scammers impersonating trusted brands in text messages. From 1 July 2026, any business sending branded text messages needs to register its sender IDs there, and any sender ID that isn’t registered will carry an “Unverified” label in the recipient’s inbox.

Businesses with an ABN register directly and must match the sender ID to their registered business name or trademark. Entities without an ABN need to go through a certified telco to complete registration on their behalf.

  • Confirm which telcos and SMS gateways you actually send through, since you may need to repeat registration for each one.
  • Watch for ACMA-related emails from your provider asking you to confirm sender ID details before the deadline.
  • Register every branded ID you use, including ones tied to older campaigns you’d forgotten about.

Pro Tip: Start the registration conversation with your telco now rather than in June 2026, since providers with large client lists are likely to face a backlog closer to the deadline.

Consent that you can’t prove is functionally the same as no consent at all if ACMA ever asks. Every signup should generate an immutable record with:

  • The exact consent text the person saw and agreed to.
  • A timestamp, the source (form, keyword, in-store signup) and, where available, an IP address or device confirmation.
  • Whether it was a single or double opt-in.

Link each of these records to a unique identifier for the mobile number, not just a customer account, so the trail survives even if someone changes their name or email later. Australian telcos have reported blocking more than 1.1 billion scam text messages since July 2022, which is part of why regulators are paying closer attention to how legitimate businesses manage their own sending practices.

On the automation side, three checks matter most: confirm whether your SMS API’s alphanumeric header can receive replies, run your unsubscribe flow end to end on a live number, and verify your telco has actually completed sender ID registration rather than assuming it happened automatically.

Three SMS compliance checks before launch

When and how often you should actually text customers

Frequency causes more complaints than almost anything else in SMS marketing. A pragmatic rule of thumb is to send during standard business hours and cap promotional texts to a level your list has explicitly agreed to, rather than testing how much they’ll tolerate.

  • Avoid stacking a transactional message (a booking confirmation, a delivery update) with unrelated promotional content in the same text.
  • Refresh consent periodically for dormant contacts instead of continuing to message people who haven’t engaged in months.
  • Segment your list so people who only expect service updates never receive campaign blasts.

Small trade businesses in particular tend to over-message during busy seasons, and that’s a pattern worth watching if you run a tradie-style booking business.

What happens if something goes wrong: reporting and enforcement

Consumers who receive spam SMS can forward the message directly to 0429 999 888, which routes the report to ACMA, and can lodge a broader scam report through Scamwatch. Victims of impersonation scams can also contact IDCARE on 1800 595 160 for support.

ACMA doesn’t only issue warnings. It has used enforceable undertakings against companies that sent commercial messages without proper consent or a functional unsubscribe, with Telstra one example of a business that agreed to remediation steps after falling short.

If you suspect your sender ID has been spoofed or impersonated:

  • Suspend the affected sender ID with your telco immediately.
  • Pull your sending logs to establish what was actually sent by you versus a scammer.
  • Notify ACMA and Scamwatch so the impersonation gets flagged on their end too.

A same-day compliance checklist worth running

You can audit most of this in an afternoon if you work through it in order.

  1. Pull a sample of your last ten marketing texts and check each one names your business and includes a working opt-out link or number.
  2. Test the unsubscribe path yourself on a phone, then confirm the request gets actioned inside five business days.
  3. Check every telco or gateway you send through for sender ID registration status ahead of the 1 July 2026 deadline.
  4. Review your consent database for gaps, meaning any active number with no timestamped signup record attached.

Where this gets tedious fast is the consent database and unsubscribe automation, since most small teams are tracking it in spreadsheets that don’t scale. Fixed-price automations can capture consent at the point of signup, log it immutably, and route unsubscribe requests automatically, with options for data residency in Australia for teams needing onshore consent record storage.

Why compliance is a trust problem, not a paperwork problem

Businesses tend to treat SMS compliance as a box to tick before a campaign, but it’s really a reputation shield. One badly worded text with no working opt-out can undo months of goodwill with a customer list, and an unregistered sender ID showing up as “Unverified” from 1 July 2026 will quietly cost you replies and trust before anyone even reads your offer. Register your sender IDs early and test your unsubscribe flow like a customer would, not like a developer who already knows it works.

— Lakitha

Where to check the current rules yourself

For definitive, current guidance, go straight to the source: ACMA’s Sender ID Register page, its spam guidance, the Scamwatch reporting page, and the Spam Act 2003 itself. Rules and deadlines can shift, so these pages are worth bookmarking rather than relying on secondhand summaries.

Sources

FAQ

What is the difference between SMS and MSG?

“SMS” refers to a standard text message sent over a mobile network, while “MSG” is simply shorthand often used inside marketing platforms or carrier billing to mean the same thing. There is no separate legal category for MSG under Australian spam rules. Both fall under the same Spam Act requirements once the content is commercial.

How can I report SMS spam in Australia?

Forward the suspicious text to 0429 999 888, which reports it to ACMA for investigation. You can also lodge a report with Scamwatch, and if you believe you’ve been scammed rather than just spammed, IDCARE (1800 595 160) offers additional support.

What are the regulations for SMS marketing?

Australian SMS marketing rules require express consent before sending a commercial message, clear identification of the sending business, and a free or low-cost unsubscribe option that gets honored within five business days. These requirements sit under the Spam Act 2003, enforced by ACMA.

What are unverified text messages in Australia?

An unverified text message is one sent from a branded sender ID that hasn’t been registered on the SMS Sender ID Register. From 1 July 2026, any business sending branded texts without registering will have those messages labeled “Unverified” in the recipient’s inbox, which can reduce trust and response rates.