SMS compliance for tradies: what the Spam Act actually asks of you

A plumber sends 400 past customers a winter offer on hot water system checks. Some of the numbers came from the business's own jobs. The rest came from a list the previous owner left in a spreadsheet. Three people reply STOP, and one of them gets another offer the following month because the job-management system never heard about it.

None of that feels like spam to the plumber. It is a local business texting local people about a real service. But every part of it is covered by the Spam Act 2003, and two parts of it are breaches.

This guide is the practical version: what the law asks of a trade business that texts its customers, written for people who run vans, not compliance departments. It is general guidance, not legal advice. If you are unsure about a specific campaign, ask a lawyer before you send it.

Which texts the Spam Act covers

The Act applies to commercial electronic messages: any text or email whose purpose includes offering, advertising or promoting goods or services.[1] For a trade business that is most of the texts that ask for work: seasonal offers, service reminders with a price attached, "we have a cancellation Thursday", review requests with a discount, and anything sent to people who have not booked anything yet.

Purely factual messages about a job that is already happening are a different thing. "Your technician is 20 minutes away" or "your quote is attached, as requested" do not promote anything on their own. The trap is adding a line. A booking reminder that ends with "ask us about 15% off a ducted service" is now promoting something, and the whole message is treated as commercial.

ACMA knows this trap well. Stopping commercial messages being sent as if they were service messages was named an ACMA compliance priority for 2024–25.[6]

Consent: the part you have to be able to prove

You can send a commercial text with either of two kinds of consent.[1][2]

Express consent

The customer actively agreed to hear from you: they ticked "send me offers" on your booking form, opted in on your website, or said yes and you recorded when and how. It is the strongest kind, because it is on the record.

Inferred consent

Consent can also be inferred from an existing business relationship, but only where the message relates to that relationship.[2] A service reminder for the air conditioner you installed two years ago fits. A promotion for an unrelated service you have never done for that customer is much harder to justify. ACMA has publicly set out that it expects businesses not to stretch inferred consent past what the relationship supports.[2][3]

The rule underneath all of it: it is up to you to prove consent, not up to the customer to prove they never gave it.[1] "They were a customer once" is a story. A record of when and how they agreed is evidence.

What every commercial text has to include

Who it is from

The message must identify the business that authorised it, using your correct legal name or your name and ABN, and that information has to stay accurate for at least 30 days after you send it.[1] If a platform or agency sends on your behalf, it is still your business that has to be identified.

A way out

Every commercial text needs a functional unsubscribe that is free and easy to use, such as "Reply STOP to opt out", and it has to keep working after the message is sent.[1][4]

Put together, a compliant promotional text from a trade business can be this short:

The ABN and phone number above are placeholders. Use your own.

Unsubscribes: five business days, every tool

When someone opts out, you have five business days to stop sending them commercial messages.[4] In a trade business the difficult part is rarely the five days. It is that the customer's number lives in three places: your SMS platform, your job-management software and a marketing tool someone set up two years ago. An opt-out that only reaches one of them is not an opt-out.

This is exactly the failure that produced one of the largest penalties in the Act's history. The Commonwealth Bank paid A$7.5 million in October 2024 after sending more than 170 million marketing messages without a working way to unsubscribe, 34.8 million of them to people who had not consented or had withdrawn consent. It had already paid A$3.55 million in May 2023 for similar problems.[6]

Record keeping: what to write down

Because the burden of proof sits with you, the records are the compliance. For each person you market to, keep:[1][2]

1. Who consented: the name and number.
2. When: the date, ideally the time.
3. How: the form, the tick box, the call, and the wording they agreed to.
4. What for: offers in general, or only reminders about one system.
5. When they opted out, and when your systems stopped texting them.

A booking form that stores a timestamped "yes, send me offers" does most of this for you. A spreadsheet of numbers with no history does none of it.

The penalties at 2026 values

Spam Act penalties are written in Commonwealth penalty units rather than dollars.[7] The value of a unit rose from $330 to $364 on 1 July 2026,[5] so the dollar figures moved without the Act changing.

At the top of the scale, a company with a prior record faces up to 10,000 penalty units a day, which is A$3.64 million, and an individual up to 2,000 penalty units a day, which is A$728,000. Lower caps apply to a business without a prior record.[5][7]

Court penalties are not the only tool. ACMA also issues infringement notices and accepts enforceable undertakings, and businesses paid more than $20 million in spam penalties over the 18 months to October 2024.[6] Small businesses are not exempt. The rules are the same whether you send 40 texts or 40 million.

Where the Sender ID Register fits

Everything above is about whether you are allowed to send a message. A separate change from 1 July 2026 is about how it arrives: if your texts go out under your business name rather than a phone number, that name must be on ACMA's SMS Sender ID Register, or it is replaced with "Unverified" on the customer's phone.

The two do not cover for each other. We explain which of your texts that affects, and how to register, in why your business texts now say "Unverified".

A compliance checklist for trade businesses

1. List every tool that texts customers: job management, bookings, marketing, reviews, missed-call text-back.
2. Sort your texts into factual job messages and anything that promotes. Keep promotional lines out of the factual ones.
3. Add a consent question to your booking form and quote process, and store the answer with a date.
4. Delete or quarantine numbers you cannot show consent for, especially bought or inherited lists.
5. Put your business name or ABN in every promotional text.
6. Add "Reply STOP" to every promotional text, and test that it works.
7. Connect opt-outs so one STOP reaches every tool within five business days.
8. Check what sender name each tool shows, and register it if it is a name rather than a number.

Frequently asked questions