Australian retailers sending marketing email or SMS work under the Spam Act 2003. It is shorter and more readable than most marketers assume, and it comes down to three obligations plus one habit: get consent, say who you are, let people leave, and keep records that prove the first one.
The Spam Act applies to commercial electronic messages with an Australian link. In practice that means email, SMS and MMS, and instant messages, sent to or from Australia, where the purpose is to market, advertise or promote goods, services, land or a business.
Two consequences catch retailers out. First, SMS is not a lesser channel: the same rules apply to a text message as to an email. Second, purely transactional messages such as an order confirmation or a shipping notice sit differently to marketing, but the moment you bolt a promotion onto them the character of the message can change. Keep your promotional content in messages people have consented to receive.
You need consent before you send. The Act recognises two kinds.
Someone has clearly told you they want your marketing. A ticked opt-in box at checkout that is not pre-ticked, a newsletter sign-up form, a competition entry that plainly states entrants will receive marketing, a keyword opt-in to your SMS number. The strongest version is unmistakable, specific about the channel, and recorded.
Consent can sometimes be reasonably inferred from the conduct, and the business or other relationship, between you and the recipient. It can also be inferred where a work-related electronic address has been conspicuously published without a statement that the person does not want unsolicited marketing, and your message is directly relevant to that person's role. Inferred consent is narrower than most people hope. It is not a licence to email everyone who has ever emailed you, and relationships go stale.
Things that are not consent: a purchased or rented list, addresses harvested from websites, addresses supplied by a third party who "confirms" they have opt-in, a pre-ticked box, or consent to something else entirely (an account login, a warranty registration) reused for marketing.
If you are relying on consent someone else obtained, remember that the obligation stays with the sender. You are the one who has to be able to explain where it came from.
Every commercial message must clearly and accurately identify who authorised it, and include information about how to contact that business. The details must be accurate and stay reasonably current for a period after sending, so a phone number that was disconnected last quarter is a problem.
For a retailer this is straightforward: put your registered business name, your ABN if you use it publicly, and a working contact method in the footer of every campaign. For SMS, where footers are expensive, make sure the sender name or the message body identifies your business unambiguously. "Your order is ready" from an unrecognised number is both a compliance risk and a bad experience.
Every commercial message needs a functional unsubscribe facility, and the requirements are more specific than "put a link in the footer".
For SMS, a reply keyword such as STOP is the norm, and it must actually be processed. The most common failure we see is not a missing link: it is an unsubscribe that works in the email platform but never flows back to the CRM, the point-of-sale system or the SMS tool, so the person keeps hearing from you through another door.
The Act puts the burden on the sender to show that consent existed. If a complaint reaches ACMA, "we are pretty sure they signed up" is not a defence. Keep, for every contact:
Keep those records for as long as you are relying on the consent, and for a sensible period after. Separately, contact data is personal information, so the Privacy Act 1988 and the Australian Privacy Principles also apply to how you collect, store, use and disclose it.
Compliance is much easier when the platform will not let you break it. In Reachable, consent state lives with the contact and is enforced at the database layer, so a marketing send can only ever reach subscribed, non-suppressed profiles no matter who builds the campaign. Unsubscribes and SMS STOP replies are honoured immediately and permanently, suppression lists are handed back to you after every campaign so your own CRM stays the single source of truth, and consent source and timestamp travel with the record when you import.
That is a floor, not a substitute for your own judgement. The Act asks you to know where your list came from, and no software can know that for you.
We will walk through where your contacts came from and what your consent records look like.
Book a walkthrough