> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Australia: Spam Act 2003 and the Do Not Call Register

> Meet Australia's Spam Act 2003 and Do Not Call Register Act 2006 — the ACMA-enforced opt-in regime for commercial electronic messages and marketing calls — mapped to the consent ledger, DNC scrub, and suppression surfaces Orbit already gives you.

# Australia: Spam Act 2003 and the Do Not Call Register

Australia regulates commercial electronic messages under the **Spam Act
2003** and marketing voice calls under the **Do Not Call Register Act
2006** — both enforced by the Australian Communications and Media
Authority (ACMA). Like Canada's CASL and the UK's PECR, the Spam Act is
largely an **opt-in** statute: you need consent *before* you send a
commercial electronic message (email, SMS, MMS, instant message), and
for voice the Do Not Call Register gives a national opt-out registry
you must scrub against before a marketing call.

Australia gets its own page because it is not simply an "APAC row". The
two Acts above are supplemented by ACMA guidance and by carrier-level
filtering that rejects unregistered traffic the way US 10DLC vetting
does — a sender-ID registration posture you treat the same way you
treat US 10DLC brand vetting or India's DLT headers. This page maps
each Spam Act condition and each Do Not Call obligation to the Orbit
surface you already own so your reviewers can close the gaps
deliberately before you send to Australian recipients.

<Note>
  This page is documentation, not legal advice — an engineering map of
  product surfaces, not a legal opinion. The Spam Act and the Do Not
  Call Register Act both carry ACMA enforcement and civil penalties;
  have counsel review your consent capture, identification text,
  unsubscribe mechanics, and your register-scrub posture. Orbit
  supplies the record-keeping and suppression surfaces — the legal
  posture is yours.
</Note>

***

## Why Australia needs its own page

Two regimes apply in parallel:

* **Spam Act 2003 (electronic messages).** Covers email, SMS, MMS, and
  other electronic messages with a "commercial" purpose. The Act's core
  conditions (consent, identification, unsubscribe) are ACMA-enforced,
  and ACMA's guidance treats the record of consent — not your
  recollection — as the thing an audit asks for.
* **Do Not Call Register Act 2006 (voice).** Marketing calls (and
  marketing faxes) to a number on the national Do Not Call Register are
  restricted. Unlike the US TCPA's opt-in model, the Register is an
  **opt-out** list: the recipient doesn't have to act for the list to
  block you, but a listed number blocks regardless of your own
  suppression layer.

The register is also the reason the [DNC scrub](/compliance/dnc-scrub)
lists Australia among the supported national registries, and the
sender-rule row for `AU` exists on [Country Compliance
Requirements](/compliance/country-requirements). Until now a reader
assembling an AU posture had no canonical page to land on, unlike the
[Canada](/compliance/casl-canada-anti-spam), [UK](/compliance/uk-pecr-eprivacy),
and [India](/compliance/dlt-india) pages. This page fills that gap.

***

## Map the Spam Act conditions onto Orbit surfaces

The Act's main duties for a commercial electronic message map to the
same surfaces the CASL page uses, with one difference: the Spam Act's
record-keeping standard is the ACMA's own evidentiary guidance rather
than a statutory three-year clock.

| Spam Act condition                                                                                                                         | Where the control lives in Orbit                                                                                                                                                                                                                                                                                     |
| ------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Consent** — the message goes only to a recipient who consented (express consent, or one of the Act's narrow inferred-consent categories) | [Consent API](/compliance/consent-management) — a `POST /api/v1/compliance/consent` record with `state: opted_in` per `(identifier, channel)` pair, timestamped and exportable; inferred/consent-tier notes ride on your own CRM                                                                                     |
| **Sender identified** — the message accurately identifies the person or organisation that authorised it, and how to reach them             | **Sender domain verification** for email (the same posture as requirement 1 on [US CAN-SPAM](/compliance/can-spam#from-identity--sender-domain)) and **Sender-ID registration** for SMS — submit through `POST /compliance/sender-id-registrations` via [Sender-ID Registration](/compliance/sender-id-registration) |
| **Working unsubscribe** — a functional unsubscribe address or link that stays working for at least 30 days after the send                  | **List-Unsubscribe headers** on every outbound email ([full header behavior](/compliance/can-spam#list-unsubscribe-header-behavior)) and the **suppression layer** — a click or an inbound STOP writes a suppression row via [Opt-Out & Suppression Lists](/compliance/opt-out-suppression)                          |
| **Record the consent** — ACMA asks for proof the recipient consented, not for your assertion that they did                                 | `GET /api/v1/compliance/consent/lookup` against the identifier before the campaign — the same evidence pattern CASL's record-keeping duty uses ([CASL page](/compliance/casl-canada-anti-spam#the-consent-ledger-as-casl-evidence))                                                                                  |

A worked consent-ledger read for an Australian mobile before a campaign:

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/consent/lookup?identifier=%2B61412345678&channel=sms" \
  -H "X-API-Key: dv_live_sk_YOUR_KEY"
```

An `opted_in` record returned for `(identifier, sms)` is the
ACMA-grade evidence you keep; a `GET` that returns no row is the signal
the recipient is not sendable for marketing under your opt-in posture.
For suppression, `POST /api/v1/compliance/suppression-list/import`
carries the scope column your bulk import decides: decide whether an
Australian opt-out blocks only the channel it arrived on or every
channel you hold — the same scope decision CASL walks through for
Canada ([scope matrix](/compliance/opt-out-suppression)).

***

## Do-Not-Call scrub for voice

The [DNC scrub page](/compliance/dnc-scrub) name-checks Australia's Do
Not Call Register among the supported international registries. Enable
the per-org opt-in toggle (`dnc_sync_enabled` on your [posture
map](/compliance/posture-overview)) and scope the international
registry lookup to Australia with the `country=AU` filter:

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/dnc/check?phone=%2B61412345678&country=AU" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

With `country=AU`, only Australian registers can produce an
international match, so an unrelated country's registry never flags an
Australian campaign. The response's `source` (one of `intl_dnc` for
the Australian register, `suppression` for your own layer, or `none`)
and `last_synced_at` tell you which registry answered and when the
snapshot was last synced; `intl_feeds_synced` tells you whether an
international snapshot actually backed the answer. For a bulk audience,
`POST /compliance/dnc/scrub` takes up to 500 numbers per call with the
same `country` scoping.

Read the endpoint's 403 gate, feed-wiring, and fail-open semantics on
[DNC Scrubbing](/compliance/dnc-scrub). The one rule that matters for
Australia: a `country=AU` check where `intl_feeds_synced: false` is
**not** a scrub of the Do Not Call Register — it is a check of your own
lists. Treat it the way the fail-open caveat tells you to.

***

## AU opt-in quirks

ACMA's Spam Act guidance is stricter than a plain opt-in on two axes
that show up in your Orbit wiring:

1. **Don't-call-on retries.** ACMA treats a message sent *after* a
   failed unsubscribe attempt — for example a retry of the original
   send after the recipient clicked unsubscribe but the click didn't
   land — as a violation on its own. Handle it by reading clicks into
   the suppression ledger at click time (Orbit's List-Unsubscribe and
   STOP handlers do this by construction) and by **not** re-queuing a
   failed send against a freshly-suppressed identifier. If you run your
   own retry loop on top of a send API, gate the retry on a fresh
   suppression look-up — never on the retry counter alone.
2. **STOP exemplars.** An inbound `STOP` from an Australian mobile is a
   revocation the same way it is in Canada or the US. Route it at scope
   `all` (the same scope decision the Canada page walks through) so a
   mobile that STOPs your SMS is not then voice-dialed or emailed by
   the same program. The campaign fallback window and the recipient's
   own quiet-hours behaviour are unchanged — the revocation is the
   binding constraint.

For both, the thing your reviewer asks for is the record — the
timestamped suppression row or the consent-ledger entry. Keep the
source string on the record (`"source": "sms-stop"`, `"source":
"checkout-form"`) so an ACMA audit can tell which acquisition surface
produced which consent.

***

## Voice-specific requirements

Two voice-side obligations apply on top of the Do Not Call Register:

* **Call-type restrictions.** Voice marketing into distinguishable
  classes (telemarketing, research, charity) carries different
  obligations under the Do Not Call Register Act and ACMA's industry
  standards; the Register applies to marketing calls, not to every
  call. Classify the campaign on your side before the scrub — a
  confirmed-appointment callback is not a marketing call, but the
  classification is your determination per campaign, and it is the
  first thing an ACMA reviewer challenges.
* **Do Not Call Register scrub.** The `country=AU` filter above;
  the dialer enforces the same chain the endpoint **reads**, so a
  registered number is blocked at origination, not merely flagged by a
  pre-flight read. Keep the org opt-in (`dnc_sync_enabled`) on and the
  scrub scoped to `AU`; the send path fails closed when the chain
  can't complete.

For a recorded Australian call, the [recording-consent jurisdiction
matrix](/compliance/recording-consent) is the guide — the Australian
surveillance-device and privacy posture sits beside the Register's
marketing rules, and the announcement pair you apply is a separate
decision from the scrub.

***

## Country rules and Sender-ID registration for AU

The AU rows on [Country Compliance
Requirements](/compliance/country-requirements) carry the per-channel
sender rules. Read them before the first send — the row shape the
`voice` channel returns for Oceania (`region=OC`) is the canonical
reference:

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=voice&region=OC" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

A returned `AU` row carries the same fields the France example on the
country-requirements page shows — `sender_types`, `registration`
(`none` / `recommended` / `required`), `sender_rules`,
`content_restrictions`, `stop_requirement`, `two_way`, `dlr_support`,
`default_tps` — plus `last_synced_at` and `last_reviewed_at` for the
freshness the [validation checklist](/compliance/country-requirements)
asks you to confirm before flipping a country live. When the row marks
registration `required` or `recommended`, submit the Sender ID through
`POST /compliance/sender-id-registrations` and track approval
([full flow](/compliance/sender-id-registration)); for SMS into
Australia the same SHAFT-style content restrictions the sender-ID
atlas documents for other destinations apply — check the live AU row
rather than assuming "no registration" from memory.

KYC documents a registry asks for are uploaded through [Documents &
KYC](/compliance/documents-kyc).

***

## Launch checklist for Australian traffic

<Steps>
  <Step title="Posture decided">
    Keep `unknown_marketing_policy: refuse` (the default; do not
    loosen it for AU recipients) and set `consent_default_policy:
            deny_on_missing` on your [posture map](/compliance/posture-overview).
  </Step>

  <Step title="Consent captured">
    At acquisition, write `POST /compliance/consent` with
    `state: opted_in` per identifier+channel; verify with
    `GET /compliance/consent/lookup` before the first send.
  </Step>

  <Step title="Suppression scope picked">
    Route Australian revocations at scope `all` so a STOP propagates
    across SMS, voice, and email — one scope, by construction.
  </Step>

  <Step title="Voice scrubbed">
    Bulk-scrub the audience with `country=AU`; treat
    `intl_feeds_synced: false` as "own-suppression only", not a pass.
  </Step>

  <Step title="Sender identity registered">
    Read the `AU` row of `GET /compliance/country-rules`; if
    `registration: required` or `recommended`, file the Sender ID
    through `/compliance/sender-id-registrations` and wait for approval.
  </Step>

  <Step title="Recording announced">
    For recorded AU calls, apply the announcement pair the
    [recording-consent matrix](/compliance/recording-consent) recommends.
  </Step>

  <Step title="Revocation recorded">
    Confirm each STOP lands in the suppression ledger with a source
    string; check the [compliance-health
    score](/compliance/compliance-health) as coverage rises.
  </Step>
</Steps>

***

## Related references

* [CASL (Canada)](/compliance/casl-canada-anti-spam) — the sister
  opt-in regime page; the structure of the condition-to-surface map
  parallels this one.
* [UK PECR / ePrivacy](/compliance/uk-pecr-eprivacy) — another opt-in
  jurisdiction page with the same consent-posture knobs.
* [US CAN-SPAM](/compliance/can-spam) — the opt-out counterpart; the
  List-Unsubscribe header behaviour this page points to lives there.
* [DNC Scrubbing](/compliance/dnc-scrub) — the endpoint mechanics,
  feed wiring, and fail-open caveat.
* [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) —
  scope-`all` routing for AU revocations.
* [Consent Management](/compliance/consent-management) — the ledger the
  `lookup` read returns.
* [Country Compliance Requirements](/compliance/country-requirements) —
  the live AU sender rows and the per-country validation checklist.
* [Sender-ID Registration](/compliance/sender-id-registration) — the
  registration flow for the AU row's `required` / `recommended` states.
* [Documents & KYC](/compliance/documents-kyc) — registry document
  uploads.
* [Call Recording Consent](/compliance/recording-consent) — the
  announcement posture for recorded AU calls.