​

Australia: Spam Act 2003 and the Do Not Call Register

​

Why Australia needs its own page

• Spam Act 2003 (electronic messages). Covers email, SMS, MMS, and other electronic messages with a “commercial” purpose. The Act’s core conditions (consent, identification, unsubscribe) are ACMA-enforced, and ACMA’s guidance treats the record of consent — not your recollection — as the thing an audit asks for.
• Do Not Call Register Act 2006 (voice). Marketing calls (and marketing faxes) to a number on the national Do Not Call Register are restricted. Unlike the US TCPA’s opt-in model, the Register is an opt-out list: the recipient doesn’t have to act for the list to block you, but a listed number blocks regardless of your own suppression layer.
• ACMA SMS Sender ID Register (2026). A regulator-run register of alphanumeric sender names, phased in through 2026; unregistered alphanumeric IDs get stamped Unverified at the network before delivery. It is a sender-identity regime, distinct from the Spam Act’s consent, identification, and unsubscribe obligations — see ACMA SMS Sender ID Register (2026).

​

Map the Spam Act conditions onto Orbit surfaces

curl "https://api.orbit.devotel.io/api/v1/compliance/consent/lookup?identifier=%2B61412345678&channel=sms" \
  -H "X-API-Key: dv_live_sk_YOUR_KEY"

​

Do-Not-Call scrub for voice

curl "https://api.orbit.devotel.io/api/v1/compliance/dnc/check?phone=%2B61412345678&country=AU" \
  -H "Authorization: Bearer $ORBIT_API_KEY"

​

AU opt-in quirks

1. Don’t-call-on retries. ACMA treats a message sent after a failed unsubscribe attempt — for example a retry of the original send after the recipient clicked unsubscribe but the click didn’t land — as a violation on its own. Handle it by reading clicks into the suppression ledger at click time (Orbit’s List-Unsubscribe and STOP handlers do this by construction) and by not re-queuing a failed send against a freshly-suppressed identifier. If you run your own retry loop on top of a send API, gate the retry on a fresh suppression look-up — never on the retry counter alone.
2. STOP exemplars. An inbound STOP from an Australian mobile is a revocation the same way it is in Canada or the US. Route it at scope all (the same scope decision the Canada page walks through) so a mobile that STOPs your SMS is not then voice-dialed or emailed by the same program. The campaign fallback window and the recipient’s own quiet-hours behaviour are unchanged — the revocation is the binding constraint.

​

Voice-specific requirements

• Call-type restrictions. Voice marketing into distinguishable classes (telemarketing, research, charity) carries different obligations under the Do Not Call Register Act and ACMA’s industry standards; the Register applies to marketing calls, not to every call. Classify the campaign on your side before the scrub — a confirmed-appointment callback is not a marketing call, but the classification is your determination per campaign, and it is the first thing an ACMA reviewer challenges.
• Do Not Call Register scrub. The country=AU filter above; the dialer enforces the same chain the endpoint reads, so a registered number is blocked at origination, not merely flagged by a pre-flight read. Keep the org opt-in (dnc_sync_enabled) on and the scrub scoped to AU; the send path fails closed when the chain can’t complete.

​

Country rules and Sender-ID registration for AU

curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=voice&region=OC" \
  -H "Authorization: Bearer $ORBIT_API_KEY"

​

ACMA SMS Sender ID Register (2026)

​

Tenant-owned posture — no platform hard gate for AU

1. Upload the KYC documents the filing needs through Documents & KYC and note each returned doc_… reference.
2. Submit the sender ID with POST /compliance/sender-id-registrations — one countries entry with country: "AU" and your document references.
3. Poll GET /compliance/sender-id-registrations until the AU entry reports approved, then launch alphanumeric traffic.

# 1 — file the AU sender ID (document_refs come from Documents & KYC)
curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/sender-id-registrations" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "sender_id": "ACME",
        "countries": [
          { "country": "AU", "document_refs": ["doc_acme_abn_2026"] }
        ]
      }'

# 2 — poll until the AU entry reports status approved
curl "https://api.orbit.devotel.io/api/v1/compliance/sender-id-registrations" \
  -H "Authorization: Bearer $ORBIT_API_KEY"

# 3 — read the AU row and note registration + last_reviewed_at
curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=sms&region=OC" \
  -H "Authorization: Bearer $ORBIT_API_KEY"

​

Evidence to keep

​

Launch checklist for Australian traffic

​

Related references

• CASL (Canada) — the sister opt-in regime page; the structure of the condition-to-surface map parallels this one.
• UK PECR / ePrivacy — another opt-in jurisdiction page with the same consent-posture knobs.
• US CAN-SPAM — the opt-out counterpart; the List-Unsubscribe header behaviour this page points to lives there.
• DNC Scrubbing — the endpoint mechanics, feed wiring, and fail-open caveat.
• Opt-Out & Suppression Lists — scope-all routing for AU revocations.
• Consent Management — the ledger the lookup read returns.
• Country Compliance Requirements — the live AU sender rows and the per-country validation checklist.
• Sender-ID Registration — the registration flow for the AU row’s required / recommended states.
• Singapore SGNIC sender rules — the same regulator-run registry shape backed by a hard send-time gate; the contrast the 2026 register section draws on.
• Documents & KYC — registry document uploads.
• Call Recording Consent — the announcement posture for recorded AU calls.