SMS Consent Management in Australia: 4 Opt In Templates, Onshore AI
Capture SMS consent in Australia with channel specific opt in wording, evidence logs, opt out workflows, and a checklist for onshore conversational AI.
Before you send a single marketing text, you need two things locked in: clear, provable consent and a working opt-out that costs nothing and takes seconds. Get the wording right at collection, log it properly, and honour every “STOP” fast. That’s the whole job, done well.
TL;DR:
- Use express SMS consent for ongoing campaigns; inferred consent applies only to relevant messages within an existing relationship, such as appointment reminders.
- Treat automated promotional sequences like other commercial texts: they still require consent, sender identification, contact details, and a working unsubscribe option.
- Keep an immutable, exportable record with the phone number, timestamp, exact consent wording, collection source, and IP address or staff identifier.
- Make STOP work across campaigns without a login or extra fee, action requests within five business days, and keep unsubscribe routes active for 30 days.
- Keep SMS and email permissions separate, with distinct checkboxes, records, and withdrawal paths, because agreeing to email does not authorize text messages.
Table of Contents
- Regulatory essentials: express consent, unsubscribe rules and evidence
- How to collect valid SMS consent across common touchpoints
- What to log and how to store consent evidence
- How to operationalise opt-outs and escalate complaints
- Implementation checklist and ready-to-use templates
- How Conversational AI automates compliant consent capture
- Why sloppy consent records cost more than fines
- Why Conversational AI is built for compliant SMS consent at scale
- FAQ
- Sources
Regulatory essentials: express consent, unsubscribe rules and evidence
Two types of consent exist, and the difference matters. Express consent is when someone actively says yes, ticking a box, replying to a keyword, or signing a form that names SMS specifically. Inferred consent is narrower: it applies only when there’s an existing relationship and the message is reasonably connected to it, such as a appointment reminder from a clinic you’ve visited. Schedule 2 of the Spam Act 2003 defines both, and express consent is the safer bet whenever you’re building a list for ongoing campaigns.
Every commercial SMS must identify who sent it, include a way to contact you, and offer an unsubscribe option. According to ACMA, senders need consent on file, visible sender details, and a working way to stop messages, and you must be able to produce that consent evidence if the regulator asks.
- Express consent: a clear, separate opt-in for SMS, ideally with the exact wording the person agreed to.
- Inferred consent: only valid within an existing relationship, and it’s the narrower, riskier path.
- Sender identification and contact details: mandatory on every commercial message, not just the first one.
Businesses must keep evidence of consent and honour unsubscribe requests, per ACMA’s spam guidance: without that evidence, a complaint becomes very hard to defend.
Automated welcome journeys count too. If a triggered sequence promotes a product or service, it’s commercial, consent rules apply in full, and you can’t treat it as a free pass just because it’s automated.
How to collect valid SMS consent across common touchpoints
Consent needs to be specific to SMS and collected at the point where someone can genuinely say yes. The channel shapes the wording, but the principle stays the same: no ambiguity about what they’re signing up for.
- Web form: “Tick here to receive appointment reminders and offers by SMS. Message and data rates may apply. Reply STOP to opt out.”
- In person: “By providing your mobile number, you agree to receive booking confirmations and promotions via SMS from us.”
- Transactional: “Your order is confirmed. Want delivery updates by text? Reply YES to opt in to SMS notifications.”
- Keyword opt-in: “Text JOIN to 1234 to receive deals via SMS. Msg frequency varies. Reply STOP anytime.”
Double opt-in, where someone confirms a second time after the initial sign-up, adds friction but it also gives you a cleaner, more defensible consent record. It’s worth the extra step for competitive or high-volume lists where a complaint is more likely; for a single transactional confirmation, a one-step opt-in is usually enough.
Pro Tip: Never bundle SMS consent inside your email opt-in checkbox. Keep them as two separate ticks, two separate records, and two separate withdrawal paths.
That separation matters because a person might happily receive emails but never want a text, and regulators expect the channels to be distinguishable in your records.
What to log and how to store consent evidence
A consent record only protects you if it’s detailed enough to reconstruct what happened. Thin logs (“opted in on web form”) don’t hold up under scrutiny.
- Phone number in a consistent format, ideally E.164.
- Timestamp of the exact moment consent was given.
- Consent text shown to the person at the time, word for word.
- Source channel, whether web form, in-store tablet, keyword or transactional flow.
- IP address or staff/agent ID that captured the consent.
- Transaction or order ID where the consent ties to a purchase or booking.
Store these records somewhere immutable, meaning entries can’t be quietly edited after the fact, and keep them exportable so you can produce a clean CSV if a regulator or a customer asks. Access should be limited to the people who actually need it, and retention should be tied to why you collected the data in the first place rather than kept indefinitely out of habit.
If a third party sends messages for you, their mistakes are still your liability. The ACMA unsubscribe fact sheet warns that outsourcing the sending doesn’t outsource the responsibility, so review any provider’s consent handling regularly rather than assuming it’s correct.
How to operationalise opt-outs and escalate complaints
An opt-out only counts as compliant if it’s genuinely easy to use. No login screens, no multi-step forms, no cost beyond the recipient’s standard message rate.
- Reply STOP to the same number, with instant automated confirmation.
- A shortlink in the message footer that leads straight to an unsubscribe page.
- A keyword opt-out (STOP, CANCEL, UNSUBSCRIBE) that works across your whole sending platform, not just one campaign.
- A web form as a backup option for people who’ve lost the original text thread.
Timing is strict. Unsubscribe requests must be actioned within five business days, and the mechanism itself has to keep working for at least 30 days after each campaign, per the ACMA unsubscribe fact sheet. Test your STOP flow regularly, monitor opt-out volume for spikes that signal a broken process, and escalate genuine complaints promptly rather than letting them sit in a shared inbox.
Pro Tip: Forward any suspected spam SMS, unedited, to ACMA’s reporting number at 0429 999 888. It helps the regulator’s compliance work and gives you a paper trail if you’re ever the one reporting a rogue sender impersonating your brand.
Implementation checklist and ready-to-use templates
Before launch, run through a short checklist: separate SMS consent capture, immutable storage, a registered sender ID, a tested STOP flow, and someone assigned to monitor opt-out volume weekly.
| Message type | Example wording |
|---|---|
| Web opt-in | ”Get exclusive offers by SMS. Reply STOP anytime to opt out.” |
| Transactional opt-in | ”Reply YES to get text updates on your booking. Msg & data rates may apply.” |
| Keyword opt-in | ”Text DEALS to 1234 for weekly offers by SMS.” |
| Double opt-in confirmation | ”You’re almost there! Reply YES to confirm you want texts from us.” |
| STOP reply | ”You’ve been unsubscribed and won’t receive further messages. Contact us at [business phone/email].” |
| Welcome message | ”Welcome! You’re now set to receive updates from [Business Name]. Reply STOP to opt out, HELP for support.” |
- Always include a business name or sender ID the recipient recognises.
- Always give a way to contact you beyond the SMS thread itself.
- Always confirm opt-out in the same message thread, immediately.
How Conversational AI automates compliant consent capture
We built our SMS AI Agents to handle the mechanics above without manual follow-up. Consent capture, timestamped logging and STOP processing run inside the same workflow, hosted on infrastructure kept within Australia.
- Capture and timestamp consent at the point of opt-in, across web forms, keyword replies and transactional flows.
- Store records in an audit-ready format tied to CRM contact history, so nothing sits in a spreadsheet nobody owns.
- Process STOP replies automatically and update suppression lists in real time across every connected channel.
- Flag sender ID or message-frequency issues before a campaign goes out, drawing on the practical guidance in our sender ID compliance guide.
Before relying on any automated flow, test the full opt-in to opt-out loop end to end, including what happens when someone replies STOP mid-campaign.
Why sloppy consent records cost more than fines
We’ve seen the same failure pattern repeatedly: businesses treat consent as a checkbox event rather than a living record, then can’t reconstruct what a customer agreed to when a complaint lands. The fix is rarely complicated, it’s usually a missing timestamp or a merged email and SMS opt-in. Prioritise testing your STOP flow and keeping immutable records over almost anything else on your compliance list.
— Sowrabh
Why Conversational AI is built for compliant SMS consent at scale
We host every consent log and message thread on infrastructure that stays within Australia, which matters if you’re in healthcare, finance or any sector where data residency isn’t negotiable. Our SMS AI Agents capture consent, apply it consistently across campaigns, and connect straight into your CRM so support staff and marketers see the same opt-out status in real time.
- Consent capture and STOP processing run automatically, with no manual list-cleaning.
- Logs stay audit-ready and exportable, hosted entirely within Australia.
- CRM integration means one opt-out updates every channel, not just SMS.
If you’re planning automated collections or appointment sequences, our Conversational AI for Debt Collection page walks through how compliant SMS sequences work in practice. For teams upskilling on AI-driven outreach more broadly, Metapilot Academy’s AI agents for digital marketing course covers the workflow side of consent-aware automation. Book a demo through our Conversational AI CRM page to see consent handling running on your own number.
FAQ
Is it legal to send text messages without consent?
No, sending commercial SMS without consent breaches the Spam Act 2003, which requires either express or narrowly defined inferred consent before you send. Businesses must also be able to produce evidence of that consent if ACMA asks for it.
How do I allow SMS permission on Android?
SMS permissions on Android control what an app can read or send from a device, which is separate from marketing consent under the Spam Act. For business SMS compliance, the permission that matters is the recipient’s documented opt-in, not a phone’s app settings.
Does SMS fall under CRM?
Yes, SMS consent and message history are typically managed inside a CRM so opt-in status, timestamps and opt-out requests stay linked to the same customer record. This keeps SMS consent visible alongside email and other channel preferences without merging them into one blanket permission.
How do I stop receiving marketing SMS?
Reply STOP, CANCEL or UNSUBSCRIBE to the number that sent the message, and the sender must action it within five business days under the ACMA unsubscribe rules. If messages continue past that window, you can forward the spam, unedited, to ACMA’s reporting number.
