ACMA handed out $2.7 million in Spam Act penalties in a single year. Not to multinationals. To Australian businesses that thought they were doing the right thing. If you're sending SMS to customers without understanding exactly what ACMA requires, you're carrying more risk than you probably realise.

This guide covers everything you need to know about ACMA SMS compliance: what the rules actually say, how enforcement works, the most common violations that trigger investigations, and how to make your SMS program compliant without burying it in legal process.

What Is ACMA and Why Does It Matter for SMS?

The Australian Communications and Media Authority is the government regulator responsible for enforcing the Spam Act 2003. If your business sends commercial electronic messages, including SMS, email, and MMS, ACMA has authority over how you do it.

ACMA's enforcement powers are not theoretical. The regulator actively investigates complaints, issues formal warnings, sends infringement notices, and pursues civil penalties through the courts. In recent years, ACMA has become noticeably more active in the SMS space as the channel has grown.

The key piece of legislation is the Spam Act 2003, which covers all commercial electronic messages sent to Australian recipients. It does not matter where your business is based. If you're messaging Australians, the Act applies to you.

A companion piece of legislation, the Do Not Call Register Act 2006, covers voice calls and faxes. That is a separate register and not covered here, but worth knowing about if your business uses outbound calling.

The Three Core Requirements Every SMS Sender Must Meet

The Spam Act 2003 sets out three non-negotiable requirements for commercial SMS messages. Miss any one of them and you're in breach.

1. Consent

You must have consent from the recipient before sending a commercial SMS. The Act recognises two types:

• Express consent: The contact has explicitly agreed to receive SMS messages from you. A tick-box at checkout, an opt-in form, a sign-up confirmation. Written records are strongly preferable.
• Inferred consent: The contact has an existing business relationship with you, their contact details are publicly listed in connection with their business role, and the message is relevant to that role. This is narrower than most businesses assume.

Inferred consent is frequently misunderstood. Buying a contact list, scraping numbers from a directory, or assuming that because someone gave you their number for one purpose you can use it for SMS marketing, none of those qualify. ACMA investigations regularly turn up this exact mistake.

Consent must also be current. If someone has not interacted with your business for several years and you have no recent opt-in, that older inferred consent may have lapsed.

2. Identify

Every commercial SMS must clearly identify who sent it. Vague sender names, generic brand handles that obscure the actual business, or messages that leave the recipient guessing who is contacting them all create compliance risk.

Practically, this means:

• Your Sender ID should reflect your business name
• The message body should make clear who the sender is if there is any ambiguity
• Replies or unsubscribes must route back to a real point of contact

If you're operating under multiple trading names, each one needs to be clearly attributed in messages sent under that name.

3. Unsubscribe

Every commercial SMS must include a simple, functional unsubscribe mechanism. The wording "STOP to opt out" or similar must actually work. When someone sends STOP, they must be removed promptly and not messaged again.

ACMA considers the following to be non-compliant:

• Unsubscribe links that are broken or expire
• Requests that route to a form requiring account login
• Delays of more than five business days in processing opt-outs
• Sending a final "you've been unsubscribed" marketing message after someone opts out

Unsubscribe compliance sounds simple but it is one of the most common sources of consumer complaints. If the opt-out does not work, every subsequent message is a fresh violation.

ACMA Enforcement: What Actually Happens

ACMA enforces the Spam Act through a tiered system. Understanding how it works helps you understand the real risk.

Complaints and Investigations

Most ACMA investigations start with consumer complaints filed through the Spam SMS/MMS complaint form or through the e-security website. ACMA aggregates complaints by sender. A pattern of similar complaints from different recipients triggers a formal investigation.

You may not receive any notice that an investigation has started. ACMA can conduct preliminary inquiries, gather evidence, and assess your practices before making first contact.

Formal Warnings

For first-time or low-severity breaches, ACMA often issues a formal warning. This requires you to acknowledge the breach and confirm corrective action. Warnings are not financial penalties, but they are on record and treated as an aggravating factor if a future breach occurs.

Infringement Notices

Infringement notices carry financial penalties. For a body corporate, an infringement notice under the Spam Act starts at around $4,400 per notice and can apply to each separate contravening message. If you sent 10,000 non-compliant messages, ACMA has the option to issue notices for each batch or campaign.

Infringement notices can be paid or contested. Contesting one means court proceedings.

Civil Penalties

For serious or repeated breaches, ACMA pursues civil penalties through the Federal Court. The maximum penalty for a body corporate is 10,000 penalty units per day of contravening conduct. At the current penalty unit rate, that is over $3 million per day in theoretical maximum exposure.

Real-world civil penalties have been substantial. ACMA has secured outcomes in the hundreds of thousands of dollars against businesses across retail, telecommunications, and financial services. The regulator publishes enforcement outcomes publicly, which means your business name appears in a press release.

Enforceable Undertakings

ACMA can also accept an enforceable undertaking in lieu of or alongside financial penalties. These require a business to commit to specific compliance programs, audits, and remediation steps. Breach of an undertaking carries its own penalties.

The Most Common ACMA Violations in SMS Marketing

ACMA's published enforcement actions and guidance identify a consistent set of issues. These are the problems that actually get businesses into trouble.

Purchased or Rented Contact Lists

Buying a list of phone numbers and messaging them is one of the fastest paths to an ACMA investigation. The people on that list have not consented to receive messages from you specifically. No amount of fine print in the list seller's terms transfers consent from them to you.

This applies to industry lists, lead databases, scraped directories, and "opt-in" lists sold by third parties. The consent must be direct and specifically authorise contact by your business.

Soft Opt-Ins Treated as Consent

Collecting a phone number at point-of-sale and then using it for unrelated marketing campaigns is not covered by inferred consent. The original purpose of the collection matters. If someone gave you their number to receive a receipt or to be contacted about their order, that does not extend to promotional SMS campaigns.

Opt-Out Not Processed

This is the simplest possible breach and still happens regularly. Someone replies STOP. The message is received. But the system does not process it, the database is not updated, and that recipient gets another campaign message three weeks later.

Each post-opt-out message is a separate contravention.

Missing or Misleading Identification

Sender IDs that obscure the business name, messages that don't make clear who sent them, or campaigns run under a brand that has no obvious connection to the registered business entity are all identification failures.

Messages Sent Outside Permitted Hours

The Spam Act does not set specific permitted hours for SMS (unlike some interpretations suggest), but the Do Not Call Register and ACMA guidance both indicate that sending commercial messages during unreasonable hours can form part of a broader harassment or conduct complaint. Practically, sending at 2 AM or before 8 AM is a customer service failure that generates complaints, which is what triggers investigations.

For guidance on when to send, the SMS campaign timing data for Australian businesses covers optimal windows in detail.

What ACMA Expects from Compliant Businesses

Beyond the three core requirements, ACMA's guidance and enforcement actions point to a broader standard of conduct that compliant businesses should meet.

Documented Consent Records

You need to be able to prove consent if challenged. This means keeping records of when consent was obtained, what the opt-in mechanism was, and what information the contact was shown at the time. "We assume they consented" is not a defence.

Record-keeping requirements under the Privacy Act 1988 reinforce this. You should retain consent records for at least five years, and ideally for the life of the customer relationship.

Functioning Unsubscribe Systems

ACMA expects your unsubscribe mechanism to work reliably and promptly. This means:

• STOP replies processed automatically, not manually
• Opt-outs applied within five business days (sooner is better practice)
• Opt-outs honoured across all channels that use the same contact record
• Suppression lists maintained and updated before every send

Clear Marketing Intent Disclosed at Collection

When you collect a phone number, the use of that number for marketing SMS must be disclosed at the point of collection. Buried in a privacy policy does not cut it. A clear disclosure at checkout, in the sign-up form, or at the point of list capture is the standard.

Transactional vs. Commercial Messages

Not all SMS messages are commercial messages under the Act. Transactional messages, including order confirmations, shipping notifications, appointment reminders, and account alerts, generally fall outside the definition of commercial electronic messages, as long as they don't contain promotional content.

The moment you add a promotional offer, upsell, or marketing content to a transactional message, it becomes commercial and the full Spam Act obligations apply.

Industry-Specific Risk Areas

Some industries carry higher ACMA risk than others, either because of higher message volumes, more complex consent chains, or the nature of the audience.

Real Estate

Real estate agents frequently contact potential vendors and buyers who have not explicitly opted in to SMS. Cold outreach to people who listed a property years ago, contacts obtained from public databases, or numbers collected at open homes without clear marketing consent all carry risk. The SMS opt-in requirements guide covers the specific consent standards that apply.

Retail and Ecommerce

Abandonment recovery campaigns, win-back sequences, and promotional sends to purchased lists are common sources of Spam Act complaints in retail. The checkout opt-in needs to be explicit, not pre-ticked, and the purpose needs to be clearly stated.

Financial Services

Financial services businesses face dual obligations: Spam Act compliance plus Australian Financial Services licensing requirements around how products are promoted. SMS campaigns in this sector need legal review of both.

Lead Generation and Aggregation

If you're buying leads from aggregators, the consent chain needs scrutiny. The aggregator's opt-in form needs to specifically name your business or your category in a way that would lead a reasonable person to expect your SMS. Generic consent to "third-party partners" has been found insufficient in enforcement actions.

What to Avoid

A few things that hurt more than they help:

• Treating inferred consent as a blanket licence: Inferred consent is narrow. It applies to existing business relationships where the contact's number is connected to their professional role and the message is professionally relevant. It does not cover promotional campaigns to former customers or business contacts you've never actually engaged.
• Sending to unverified opt-in lists from third parties: If you can't trace the consent back to a specific opt-in action that included your business name, don't send. No list vendor warranty changes your liability under the Spam Act.
• Manual opt-out processing: Relying on a person to manually update a spreadsheet after a STOP reply is a compliance disaster waiting to happen. Automation is not optional for any business sending at scale.
• Adding promos to transactional messages: Shipping notifications with a discount code at the bottom, or appointment reminders with a product upsell, become commercial messages. Run them through the same consent and identification checks as your marketing sends.
• Assuming small volume means low risk: ACMA investigates based on complaint patterns, not send volumes. A small business sending 500 messages to a purchased list can attract an investigation just as easily as a large retailer.
• Not having a written compliance policy: If ACMA investigates and you can't produce documented consent processes, opt-out procedures, and staff training records, that absence of process is itself a problem. Document what you do before you need to show someone.

How Monster SMS Keeps You Compliant by Default

Building compliance into your SMS platform removes the manual risk. Monster SMS is designed around Australian regulatory requirements, not retrofitted to them.

Every account includes:

• Automatic STOP processing: replies are captured and suppression applied immediately
• Suppression list management built into every campaign send
• Sender ID management with business name verification
• Consent capture tools for opt-in forms and checkout integrations
• AI auto-reply agents that handle two-way conversations compliantly

The platform does not let you import a list and send to it without going through a consent verification step. That is a deliberate friction, not a bug.

If you're currently on a platform that does not make compliance this straightforward, the Australian SMS compliance guide walks through what to look for when evaluating providers. And if you want to understand whether your current practices are generating ACMA risk, the starting point is the SMS legal requirements breakdown which covers the most common grey areas.

Pricing starts at $50 per month for 1,000 messages. The full pricing page has the details, including the free tier with 100 messages to test everything before committing.