Before anything else
This is a plain-English summary written to help you ask the right questions. It is not legal advice, it does not account for your circumstances, and the Australian Communications and Media Authority is the authority on how the law is applied, not us. If you are running text messaging at any scale, or you are unsure which side of a line you are on, get advice from someone qualified to give it.
Nothing on this page is legal advice. ACMA publishes the guidance that governs this, and it is worth reading directly.
What the law actually covers
The relevant legislation is the Spam Act 2003 (Cth). It applies to "commercial electronic messages" — messages with a commercial purpose, including SMS, sent to an Australian address. It is enforced by ACMA, and the penalties for getting it badly wrong are not trivial.
The Act sets three requirements for commercial electronic messages, usually summarised as consent, identify, unsubscribe.
- Consent. You need the recipient’s consent, which can be express (they said yes) or inferred (their conduct or an existing relationship reasonably implies it).
- Identify. The message must clearly identify who sent it and how to contact you. This is the requirement most small businesses accidentally fail, by sending an unattributed text from an unfamiliar number.
- Unsubscribe. Commercial messages must include a functional way to opt out, and opt-out requests must be honoured promptly.
Where a reply to a caller sits
A text sent to someone who has, seconds earlier, deliberately rung your business is a fundamentally different thing from a marketing blast to a purchased list. The caller initiated contact, they gave you their number by dialling, and they are expecting a response. That is the clearest case there is for inferred consent, and it is the ordinary way businesses have responded to enquiries for years.
That said, "clearest case" is not the same as "no rules apply". The safe approach is to behave as though the requirements apply anyway, because doing so costs you nothing and removes the question entirely.
How to stay comfortably inside the line
- Identify yourself in the first few words. Your business name and your own name. This satisfies the identification requirement and, separately, is the single biggest thing that makes people reply.
- Only text people who rang you. The moment you are texting numbers that did not contact you, you are in marketing, and the full consent requirements apply without qualification.
- Keep it responsive, not promotional. "What do you need and what suburb are you in" is a reply to an enquiry. "Ten per cent off gutter cleaning this month" is marketing, even sent to someone who rang you, and it needs consent and an unsubscribe.
- Honour any request to stop, immediately and permanently. If someone replies STOP, or asks you not to text them, that is the end of it. Keep a record.
- Do not add callers to a marketing list because they rang once. Consent to be replied to is not consent to be marketed to, and treating it as such is where businesses get into trouble.
- Keep records of what was sent and when. If a complaint is ever made, the thread is your evidence.
The Do Not Call Register is a separate thing
The Do Not Call Register applies to telemarketing calls and marketing faxes, and it is governed by different legislation from the Spam Act. It does not restrict you from replying to a person who rang you.
It matters here only because people conflate the two and conclude either that everything is banned or that nothing is. Neither is right, and they cover different conduct.
Privacy is a third thing again
Separately from spam rules, if you are holding personal information about your customers — phone numbers, addresses, what they told you about their property — you have privacy obligations. Whether the Privacy Act applies to your business depends largely on turnover and what kind of information you handle, but customers increasingly expect the standard regardless of whether it is legally compelled.
In practice this means: hold what you need, keep it somewhere it is not casually accessible, do not sell it or pass it on, and be able to tell a customer what you hold about them if they ask.
The short version
Replying to a person who just rang you, in your own name, asking what they need, and stopping if they ask you to, is ordinary business conduct and is treated as such. Sending unsolicited promotional texts to people who never contacted you is a different activity with a different set of rules, and the fact that it goes out over the same technology does not merge the two.
If you find yourself wanting to blur that boundary, that is the point to get advice rather than to reason your way through it.
Written by the team at Kryon. We sell a missed-call text-back service, which is a conflict of interest worth stating outright — so where a guide would be improved by telling you not to buy anything, it does.