Skip to main content

​
Australia: Spam Act 2003 and the Do Not Call Register

Australia regulates commercial electronic messages under the Spam Act 2003 and marketing voice calls under the Do Not Call Register Act 2006 — both enforced by the Australian Communications and Media Authority (ACMA). Like Canada’s CASL and the UK’s PECR, the Spam Act is largely an opt-in statute: you need consent before you send a commercial electronic message (email, SMS, MMS, instant message), and for voice the Do Not Call Register gives a national opt-out registry you must scrub against before a marketing call. Australia gets its own page because it is not simply an “APAC row”. The two Acts above are supplemented by ACMA guidance and by carrier-level filtering that rejects unregistered traffic the way US 10DLC vetting does — a sender-ID registration posture you treat the same way you treat US 10DLC brand vetting or India’s DLT headers. This page maps each Spam Act condition and each Do Not Call obligation to the Orbit surface you already own so your reviewers can close the gaps deliberately before you send to Australian recipients.
This page is documentation, not legal advice — an engineering map of product surfaces, not a legal opinion. The Spam Act and the Do Not Call Register Act both carry ACMA enforcement and civil penalties; have counsel review your consent capture, identification text, unsubscribe mechanics, and your register-scrub posture. Orbit supplies the record-keeping and suppression surfaces — the legal posture is yours.

​
Why Australia needs its own page

Two regimes apply in parallel:
  • Spam Act 2003 (electronic messages). Covers email, SMS, MMS, and other electronic messages with a “commercial” purpose. The Act’s core conditions (consent, identification, unsubscribe) are ACMA-enforced, and ACMA’s guidance treats the record of consent — not your recollection — as the thing an audit asks for.
  • Do Not Call Register Act 2006 (voice). Marketing calls (and marketing faxes) to a number on the national Do Not Call Register are restricted. Unlike the US TCPA’s opt-in model, the Register is an opt-out list: the recipient doesn’t have to act for the list to block you, but a listed number blocks regardless of your own suppression layer.
The register is also the reason the DNC scrub lists Australia among the supported national registries, and the sender-rule row for AU exists on Country Compliance Requirements. Until now a reader assembling an AU posture had no canonical page to land on, unlike the Canada, UK, and India pages. This page fills that gap.

​
Map the Spam Act conditions onto Orbit surfaces

The Act’s main duties for a commercial electronic message map to the same surfaces the CASL page uses, with one difference: the Spam Act’s record-keeping standard is the ACMA’s own evidentiary guidance rather than a statutory three-year clock. A worked consent-ledger read for an Australian mobile before a campaign:
An opted_in record returned for (identifier, sms) is the ACMA-grade evidence you keep; a GET that returns no row is the signal the recipient is not sendable for marketing under your opt-in posture. For suppression, POST /api/v1/compliance/suppression-list/import carries the scope column your bulk import decides: decide whether an Australian opt-out blocks only the channel it arrived on or every channel you hold — the same scope decision CASL walks through for Canada (scope matrix).

​
Do-Not-Call scrub for voice

The DNC scrub page name-checks Australia’s Do Not Call Register among the supported international registries. Enable the per-org opt-in toggle (dnc_sync_enabled on your posture map) and scope the international registry lookup to Australia with the country=AU filter:
With country=AU, only Australian registers can produce an international match, so an unrelated country’s registry never flags an Australian campaign. The response’s source (one of intl_dnc for the Australian register, suppression for your own layer, or none) and last_synced_at tell you which registry answered and when the snapshot was last synced; intl_feeds_synced tells you whether an international snapshot actually backed the answer. For a bulk audience, POST /compliance/dnc/scrub takes up to 500 numbers per call with the same country scoping. Read the endpoint’s 403 gate, feed-wiring, and fail-open semantics on DNC Scrubbing. The one rule that matters for Australia: a country=AU check where intl_feeds_synced: false is not a scrub of the Do Not Call Register — it is a check of your own lists. Treat it the way the fail-open caveat tells you to.

​
AU opt-in quirks

ACMA’s Spam Act guidance is stricter than a plain opt-in on two axes that show up in your Orbit wiring:
  1. Don’t-call-on retries. ACMA treats a message sent after a failed unsubscribe attempt — for example a retry of the original send after the recipient clicked unsubscribe but the click didn’t land — as a violation on its own. Handle it by reading clicks into the suppression ledger at click time (Orbit’s List-Unsubscribe and STOP handlers do this by construction) and by not re-queuing a failed send against a freshly-suppressed identifier. If you run your own retry loop on top of a send API, gate the retry on a fresh suppression look-up — never on the retry counter alone.
  2. STOP exemplars. An inbound STOP from an Australian mobile is a revocation the same way it is in Canada or the US. Route it at scope all (the same scope decision the Canada page walks through) so a mobile that STOPs your SMS is not then voice-dialed or emailed by the same program. The campaign fallback window and the recipient’s own quiet-hours behaviour are unchanged — the revocation is the binding constraint.
For both, the thing your reviewer asks for is the record — the timestamped suppression row or the consent-ledger entry. Keep the source string on the record ("source": "sms-stop", "source": "checkout-form") so an ACMA audit can tell which acquisition surface produced which consent.

​
Voice-specific requirements

Two voice-side obligations apply on top of the Do Not Call Register:
  • Call-type restrictions. Voice marketing into distinguishable classes (telemarketing, research, charity) carries different obligations under the Do Not Call Register Act and ACMA’s industry standards; the Register applies to marketing calls, not to every call. Classify the campaign on your side before the scrub — a confirmed-appointment callback is not a marketing call, but the classification is your determination per campaign, and it is the first thing an ACMA reviewer challenges.
  • Do Not Call Register scrub. The country=AU filter above; the dialer enforces the same chain the endpoint reads, so a registered number is blocked at origination, not merely flagged by a pre-flight read. Keep the org opt-in (dnc_sync_enabled) on and the scrub scoped to AU; the send path fails closed when the chain can’t complete.
For a recorded Australian call, the recording-consent jurisdiction matrix is the guide — the Australian surveillance-device and privacy posture sits beside the Register’s marketing rules, and the announcement pair you apply is a separate decision from the scrub.

​
Country rules and Sender-ID registration for AU

The AU rows on Country Compliance Requirements carry the per-channel sender rules. Read them before the first send — the row shape the voice channel returns for Oceania (region=OC) is the canonical reference:
A returned AU row carries the same fields the France example on the country-requirements page shows — sender_types, registration (none / recommended / required), sender_rules, content_restrictions, stop_requirement, two_way, dlr_support, default_tps — plus last_synced_at and last_reviewed_at for the freshness the validation checklist asks you to confirm before flipping a country live. When the row marks registration required or recommended, submit the Sender ID through POST /compliance/sender-id-registrations and track approval (full flow); for SMS into Australia the same SHAFT-style content restrictions the sender-ID atlas documents for other destinations apply — check the live AU row rather than assuming “no registration” from memory. KYC documents a registry asks for are uploaded through Documents & KYC.

​
Launch checklist for Australian traffic

1

Posture decided

Keep unknown_marketing_policy: refuse (the default; do not loosen it for AU recipients) and set consent_default_policy: deny_on_missing on your posture map.
2

Consent captured

At acquisition, write POST /compliance/consent with state: opted_in per identifier+channel; verify with GET /compliance/consent/lookup before the first send.
3

Suppression scope picked

Route Australian revocations at scope all so a STOP propagates across SMS, voice, and email — one scope, by construction.
4

Voice scrubbed

Bulk-scrub the audience with country=AU; treat intl_feeds_synced: false as “own-suppression only”, not a pass.
5

Sender identity registered

Read the AU row of GET /compliance/country-rules; if registration: required or recommended, file the Sender ID through /compliance/sender-id-registrations and wait for approval.
6

Recording announced

For recorded AU calls, apply the announcement pair the recording-consent matrix recommends.
7

Revocation recorded

Confirm each STOP lands in the suppression ledger with a source string; check the compliance-health score as coverage rises.