Topics: Meta & Google ads
Want this done for your business? Get a fixed quote or book a free 30-minute call.
Quick answer: Yes, the Spam Act 2003 applies to the marketing emails, SMS and instant messages you send to ad leads, whatever your business size. Capture express consent on the lead form, identify your business in every message, include a free unsubscribe and action it within five working days. Since 1 July 2026, SMS from unregistered alphanumeric sender IDs display as "Unverified".
A lead form is a promise as well as a capture tool. The person typed in their mobile number to hear back about one thing. Whether you can keep texting them about everything else is a question the Spam Act answers, and the answer depends largely on what your form said. This guide covers consent, message content, unsubscribes, the SMS Sender ID Register and what ACMA has enforced. It's general information, not legal advice.
Does the Spam Act apply to emails and SMS sent to your ad leads?
Yes, when the message is commercial and has an Australian link, such as being sent by an Australian business or to an Australian address or number. The Act covers commercial electronic messages: email, SMS, MMS and instant messages. ACMA enforces it, and there's no small-business exemption.
What counts as commercial is broad. A message that offers, advertises or promotes goods or services is commercial, even if it's mostly helpful content with a promotion at the end. Some messages fall outside, such as purely factual service messages about an existing transaction; ACMA has noted that genuinely non-commercial "service" messages can be sent without consent or an unsubscribe. Phone calls are a different regime: telemarketing is governed by the Do Not Call Register Act, not the Spam Act.
For ad leads, the practical split looks like this:
- A direct reply to the enquiry (the quote or information the person asked for) is the low-risk part, because they requested it.
- Everything after that, such as newsletters, offers, "still interested?" campaigns and promotions for other services, needs consent you can prove.
What counts as express consent and inferred consent?
Express consent is a clear yes to receiving marketing; inferred consent is a narrow exception based on an existing relationship. Build your system on express consent wherever possible.
| Express consent | Inferred consent | |
|---|---|---|
| How it's given | The person actively agrees, for example ticking an unticked box | Implied from an existing business or other relationship |
| Example | "Send me offers and tips by email" checkbox on a lead form | A current customer receiving messages about related services |
| Strength | Strong, if you record when and where it was given | Narrow and easily disputed |
| Risk | Low with good records | Relying on it for a mere enquirer is risky |
Three traps catch businesses regularly:
- Asking for consent by email is itself a commercial message, so you can't email a list without consent to ask for consent.
- Bought or shared lists don't carry consent to you. The person consented to someone else, if at all.
- Consent can be withdrawn, and an unsubscribe overrides earlier consent.
How should your lead forms collect consent?
With a separate, unticked checkbox for each channel, and a record of what the person agreed to, when and on which form.
On your website form:
- Add an unticked box such as "Email me offers and updates from [business name]".
- Add a second unticked box for SMS if you plan to text marketing messages.
- Keep the main enquiry submission separate, so people can enquire without opting in.
- Store the consent, the timestamp, the page URL and the form wording in your CRM.
On Meta instant forms, use the custom disclaimer section to add optional consent checkboxes, and make sure your CRM integration carries those answers across; our guide to Meta lead ads to CRM covers the plumbing. If a lead didn't tick the box, tag them as "enquiry only" and keep follow-up to what they asked for.
Industries with their own advertising rules need the same care; registered agents, for example, should read our guide to migration agent advertising rules alongside this one.
What must every marketing email and SMS include?
Clear identification of who sent it, accurate contact information and a functional unsubscribe.
| Element | SMS | |
|---|---|---|
| Sender identity | Business name in the "from" field and the footer | Business name in the sender ID or message text |
| Contact details | How to reach you, accurate for at least 30 days | Same, often a website or number |
| Unsubscribe | A link or reply instruction that works | "Reply STOP to opt out" or similar |
| Cost to unsubscribe | Free | Free, or the cost of a standard reply at most |
The unsubscribe must keep working for at least 30 days after the message is sent and can't require a login, a fee or a long form. The content itself also needs to be accurate; misleading offers raise Australian Consumer Law issues as well.
How fast must you honour unsubscribe requests?
Within five working days. That deadline covers every system that sends messages, not just your email platform.
Weak points we see:
- An unsubscribe in Mailchimp or Klaviyo that never reaches the SMS tool
- Sales staff sending one-off promotional emails from Outlook or Gmail to old leads
- A CRM import that restores contacts who had already opted out
- A new agency or tool loaded with an old list
Keep one suppression list, sync it across tools daily and check it before every import. Our guides to lead nurturing after the click and email flows that retain customers show where opt-outs need to stop the sequence.
What changed with SMS sender ID registration?
ACMA's SMS Sender ID Register means branded sender names must be registered, or messages arrive labelled "Unverified". Since 1 July 2026, SMS sent with an unregistered alphanumeric sender ID (a name such as "SmithDental" instead of a phone number) display as "Unverified", and ACMA's guide says these messages are grouped into a single thread on the recipient's phone, alongside likely scams.
What to do:
- Register each sender ID your business uses through ACMA's register process.
- Authorise every SMS provider that sends on your behalf to use it, as ACMA's guidance requires.
- Check reminders and follow-ups sent by your booking, CRM and payment tools, not only your marketing platform.
- Send a test to your own phone after any provider change.
An "Unverified" label on an appointment reminder or quote follow-up undoes the trust your ads paid for.
What are the penalties, and what has ACMA enforced recently?
Penalties can be large, and ACMA pursues big brands as well as small senders. It can issue formal warnings and infringement notices, accept court-enforceable undertakings and take matters to the Federal Court.
The best-known recent case: in October 2024, ACMA announced that the Commonwealth Bank had paid a $7.5 million penalty after sending more than 170 million marketing messages between November 2022 and April 2024 without an unsubscribe facility. ACMA said 34.8 million of those went to people who hadn't consented or had withdrawn consent. It followed a $3.55 million penalty against the same bank in 2023.
The lesson for smaller businesses isn't the dollar figure. Those breaches came from systems: templates without unsubscribe links and consent records nobody checked.
Frequently asked questions
Can I email people who filled in my Facebook lead form?
You can reply with what they asked for. For ongoing marketing, you need consent, ideally an unticked checkbox on the form recorded in your CRM. Without it, keep follow-up to their original enquiry.
Do I need separate consent for SMS and email?
The Act doesn't strictly demand separate boxes, but consent must cover the messages you send. Separate checkboxes make that clear, let people choose, and give you better evidence if a complaint arises.
How quickly must I process an unsubscribe in Australia?
Within five working days of the request, across every tool that sends marketing messages. The unsubscribe option must also stay functional for at least 30 days after each message.
Does the Spam Act apply to WhatsApp messages?
Yes. Instant messages are electronic messages under the Act, so commercial WhatsApp messages need consent, sender identification and a way to opt out. WhatsApp's own business policies separately require opt-in.
What happens if my SMS sender ID is not registered?
Since 1 July 2026, messages sent with an unregistered alphanumeric sender ID show as "Unverified" and are grouped with other unverified messages. Register the ID with ACMA and authorise each provider that sends for you.
Want follow-up that stays on the right side of ACMA?
We build lead forms with proper consent capture, CRM records and opt-out syncing for clients across Australia; read more about GRWW in Australia. Ask us to review your lead forms and messages and we'll point out what to fix first.