Automation doesn't change the rules for marketing messages. It changes the scale of a mistake. Send one email without an unsubscribe link and you've made an error. Set up a sequence without one and you've made the same error to every contact it touches, every day, until someone notices.
In Australia, the main law here is the Spam Act 2003. This is a plain-English guide to what the Spam Act asks of businesses that send automated emails and SMS: what counts as a commercial message, consent, identifying yourself, unsubscribing, and keeping records that prove you did it properly. Everything below comes from the Act itself and the ACMA's guidance, which I've linked so you can read the source. It's general information, not legal advice. If your situation is unusual, talk to a lawyer.
What the Spam Act covers
The Act deals with "commercial electronic messages". You can read the current compilation of the Spam Act 2003 on the Federal Register of Legislation. Three definitions do most of the work.
Electronic message. Section 5 covers messages sent to an electronic address connected with an email account, an instant messaging account, a telephone account or a similar account. The Act's own note gives email addresses and phone numbers as examples, so email and SMS are both in. Voice calls made using a standard telephone service are excluded under section 5, so this guide sticks to email and SMS.
Commercial. Section 6 says a message is commercial if, looking at its content, how it's presented and what its links lead to, one of its purposes is to offer, advertise or promote goods or services, land, or a business or investment opportunity, or the supplier of any of those. Note the words "one of the purposes". A message can be mostly useful information and still be commercial because of one promotional line.
Australian link. Under section 7 a message has an Australian link if, among other things, it originates in Australia, the sender is in Australia, or the person receiving it accesses it in Australia. For an Australian business messaging Australian customers, assume the Act applies.
Commercial or transactional: where automated messages sit
You'll hear marketers split messages into "transactional" and "marketing". The Act doesn't use the word transactional. The question it asks is the section 6 one: is promoting something one of this message's purposes?
That gives a practical way to sort your automations. The table below is our general reading of how the definitions apply to common automated messages, not a ruling on any particular one.
| Automated message | How it's likely treated | What to watch |
|---|---|---|
| Booking confirmation or appointment reminder with only the booking details | Likely not commercial, as nothing in it offers or promotes | Adding "book your next service now" changes that |
| Invoice, receipt or payment reminder | Likely not commercial on its own | Promotional banners and offer links in the footer |
| Purely factual update that carries your name, logo and contact details | May be a designated commercial electronic message under Schedule 1 | Still needs accurate sender details |
| Quote follow-up or "still interested?" message | Treat as commercial, since it's about supplying your services | Consent, sender details and unsubscribe |
| Newsletter with offers, win-back emails, review requests with a discount | Commercial | Consent, sender details and unsubscribe |
The designated category deserves a sentence of its own. Schedule 1 says a message that is no more than factual information, plus things like your name, logo and contact details, is a designated commercial electronic message if it wouldn't be commercial without those extras. Designated messages are exempt from the consent rule in section 16 and the unsubscribe rule in section 18, but they still have to meet section 17 and identify who sent them. Schedule 1 also covers some messages from government bodies, registered charities, registered political parties and educational institutions, which most businesses won't fall under.
My advice is to keep transactional automations boringly factual. The moment someone adds a cross-sell to the appointment reminder, it starts needing everything a marketing email needs.
Consent under the Spam Act: express and inferred
Section 16 says you must not send an unsolicited commercial electronic message with an Australian link unless it's a designated message or the recipient consented. Schedule 2 defines consent as either express consent, or consent that can reasonably be inferred from the person's conduct and their business and other relationships.
Express consent
The ACMA's guide on how to avoid sending spam describes express consent as the person knowing and accepting that they'll receive marketing from you. It lists the ways people give it: filling in a form, ticking a box on a website, over the phone, or face to face. It also makes a point that trips up a lot of automation: you can't send an electronic message to ask for consent, because that request is itself a marketing message.
Inferred consent
The ACMA says you may infer consent where the person knowingly and directly gave you their address and would reasonably expect marketing from you. Usually that means a provable, ongoing relationship, with marketing directly related to it. Its example is a savings bank telling a customer about a higher-interest savings account, which would not stretch to selling that customer insurance. The ACMA also says inferred consent does not cover sending messages after someone has just bought something from your business, and that it's not as reliable as express consent.
Schedule 2 adds that consent can't be inferred merely because an address has been published. There's a narrow exception for work addresses that are conspicuously published, where the message relates to that person's role and the address isn't published alongside a "no unsolicited messages" statement.
And if you buy or use a marketing list, the ACMA is clear that you're still responsible for having consent for every address on it. Part 3 of the Act separately bans supplying, acquiring or using address-harvesting software and harvested-address lists.
Honestly, inferred consent is a weak foundation for any automation you plan to run for years. A tick box costs nothing to add to a form.
Identify your business in every message
Section 17 applies to every commercial electronic message with an Australian link, designated ones included. The message must clearly and accurately identify the individual or organisation who authorised it, include accurate information about how to contact them, and that information must be reasonably likely to stay valid for at least 30 days after sending.
The ACMA's guidance adds the practical detail. Use the correct legal name of your business, or your name and ABN. If someone else sends messages on your behalf, such as an agency or a platform, the message must still identify you as the business that authorised it.
SMS is where this gets squeezed. A short text message still needs to say who it's from and how to reach you, so build that into the template rather than trusting whoever writes each campaign to remember.
Unsubscribe rules automation has to honour
Section 18 requires commercial messages, other than designated ones, to include a clear and conspicuous statement that the recipient can use an electronic address in the message to unsubscribe. That address has to be able to receive unsubscribe messages for at least 30 days after sending.
The ACMA's guidance spells out what a compliant unsubscribe option looks like. It must:
- present the instructions clearly
- honour a request within 5 working days
- not charge a fee, or cost more than the usual cost of using the address, such as a standard text
- keep working for at least 30 days after the message is sent
- not require the person to give extra personal information, log in or create an account
Schedule 2 says that when someone unsubscribes by electronic message, the withdrawal of consent takes effect at the end of 5 business days beginning on the day they sent it. For SMS, the ACMA's examples include "Reply STOP" or an unsubscribe phone number, and it warns that alphanumeric sender headers generally can't receive replies. If your texts show a business name instead of a number, "Reply STOP" won't work.
For automation, the real risk is plumbing. An unsubscribe recorded in your email platform does nothing if your SMS tool or CRM keeps sending from a separate list. Strictly, the Act frames withdrawal around the address the person unsubscribes from. I'd go further and treat a clear "stop" on any channel as a stop for marketing on all of them. It's simpler to run and it's what customers expect.
Keeping consent records you can find later
The ACMA puts it bluntly: under the Spam Act it's up to you to prove you have a person's consent. It says to keep a record of who gave consent, when and how.
In practice, store this against each contact rather than in a separate file:
- the source, such as the form, page or phone call where consent was given
- the exact wording the person agreed to
- the date and time
- which channels it covers, email, SMS or both
- any unsubscribe, with its date and how it arrived
This matters most when you move systems. Contacts imported from an old spreadsheet often arrive with no consent history at all, so carry the consent fields across deliberately. Our guide to migrating from spreadsheets to a CRM without losing data covers how to map fields like these. Consent records are also personal information, which ties into the questions in our article on AI, privacy and customer data in Australian businesses.
Where automated messages most often trip up
Most problems aren't deliberate. They come from small changes nobody checked:
- a promotional line added to a reminder template
- an old customer list imported into a new email tool
- a plain-text or SMS version of a campaign that lost its footer
- a follow-up sequence that keeps running after someone asked it to stop
- an agency sending on your behalf without your business details in the message
That last one matters because the ACMA notes it's also against the rules to help, work with or be knowingly concerned with someone else breaking them, and Part 4 of the Act sets out civil penalties. Responsibility doesn't sit only with whoever pressed send.
If you're setting up sales follow-ups, our article on why quotes go cold and how follow-ups win them back shows how to build these rules into a quote sequence. When Imagine AI builds automated follow-ups for quotes and enquiries, consent and unsubscribes are built into the CRM itself and sequences stop when the customer replies. For the legal detail, the Act and the ACMA's guidance are the sources to rely on, and if you'd like to talk through how your current automations handle consent and unsubscribes, book a 30-minute call with our team.
— Craig Winder, Founder
