Automated texts, emails and calls: the rules before you switch them on

Software that follows up for you is one of the easiest wins in a small business. It sends the appointment reminder, chases the quote nobody replied to, texts last year's customers that it's time for a service, and asks happy customers for a review. Some of it now runs on AI, including voice agents that can make the call themselves.

Most of those messages are fine. Some are marketing, and marketing by text, email or phone has rules in Australia. The regulator, the ACMA, has spent the last two years fining businesses that got the line wrong.

Reminders are fine; selling needs permission

The Spam Act covers messages that sell. The ACMA's plain-English page says: "To be spam, the message must be commercial. That means it must contain one or more of the following: offers, advertisements, promotions." It also says messages are generally not spam if they "are appointment or payment reminders".

So "Reminder: your appointment is Tuesday at 10am" is a reminder. "Reminder: your appointment is Tuesday at 10am. Book a whitening session this month and save 20%!" is marketing, and the whole message has to follow the marketing rules.

That is not a technicality. In March 2026 Lululemon paid $702,900 after sending "service emails such as shipping updates that also contained sales material and direct links to promotions" without a way to unsubscribe. The ACMA said "if an electronic message contains any promotional or sales content, it is considered commercial regardless of whether the message has any other purpose" (ACMA, 11 March 2026). The Commonwealth Bank paid $7.5 million in 2024 over messages it treated as service messages (ACMA, 17 October 2024).

The three rules for anything that sells

The ACMA's guide for businesses sets them out. You need the person's consent first. Then every message must identify you as the sender, include your contact details, and make it easy to unsubscribe.

Consent. The best kind is someone ticking a box or saying yes to hearing from you. The ACMA also accepts consent it calls inferred, where someone has "a provable, ongoing relationship with your business", such as a membership or an account. But, it says, "It does not cover sending messages after someone has just bought something from your business." A plumber who fixed a tap once can't treat that customer as signed up for promotions.

Two more points from the same page. "It's up to you to prove that you have a person's consent", so keep a record of how and when each person agreed. And "You cannot send an electronic message to ask for consent, because this is a marketing message."

Unsubscribe. The opt-out must work, cost nothing beyond a normal text, not ask the person to log in or give more details, and be honoured "within 5 working days". There is a common trap with texts. Many businesses send SMS under a name, such as "SmithDental", instead of a number. The ACMA warns that people "generally can't reply to an SMS with a Sender ID", so an instruction to reply STOP doesn't work there and "will therefore break the law" (ACMA). Use a link or a number that can receive the reply.

Software sending it doesn't move the blame

The ACMA says businesses "cannot outsource their obligations under the spam and telemarketing laws" and "Ultimately, the business is responsible." It doesn't mention AI by name. On our reading, a message written or sent by an AI tool is your message, the same as one sent by a marketing agency.

The fines are not small. The ACMA puts the maximum a court can order at "$626,000 per day" for a company without a prior record. Latitude Finance paid $3.96 million in 2026 for messages without accurate contact details or a working unsubscribe (ACMA, 15 April 2026). TAB paid $4,003,270 in 2025, including for messages to VIP customers with no way to opt out (ACMA, 17 June 2025). Those are big companies. The rules are the same for a four-chair clinic.

What about asking for a review?

The ACMA hasn't said. On our reading, a plain "How did we go? Here's the link to leave a review" is closer to a service message than an ad. Add "and get 10% off your next visit" and it is selling. (Google also bans rewards for reviews; we cover that separately.) The safe path is to send review requests only to people who've agreed to hear from you, with your business name and an easy opt-out.

Texts sent under your business name

Since 1 July 2026, texts sent under a business name that isn't on the new SMS Sender ID Register "must be labelled by the telco carrier as 'Unverified'" (ACMA, 1 July 2026). The ACMA's aim is to make it harder for scammers to pass as real businesses. Registration goes through your telco or messaging provider, and there is no cut-off date. If your reminders arrive as "Unverified", patients may ignore them.

Calls, including AI voice agents

Calls are a separate set of rules; the ACMA says "Telemarketing calls are also not spam." A call is telemarketing if "the caller aims to sell, advertise or promote goods or services". An appointment reminder call is not (ACMA).

For calls that sell, numbers on the Do Not Call Register can only be called with the person's consent, unless the caller is exempt, such as a charity or a government body (ACMA). On our reading, as with texts and emails, that consent can come from an existing customer relationship rather than an outright yes. If you're unsure about a past customer, treat them the way you would for marketing texts. Even when a call is allowed, the caller must keep to set hours (weekdays 9am to 8pm, Saturdays 9am to 5pm, never Sundays or national public holidays). The caller must also say their name and who they're calling for, say why they're calling, end the call if asked, and show a caller ID people can ring back.

On our reading, none of that changes when the caller is an AI voice agent. If it is set up to ring past customers and offer them something, it is making telemarketing calls, and it should be built to follow those rules.

What to check before you switch it on

1. List every automatic message you send. Sort them into reminders and receipts, and anything that sells.
2. Keep reminders plain: no offers, no "book now and save", no links to promotions.
3. Send selling messages only to people who said yes, and keep a record of when and how they did.
4. Don't add one-off customers to promotions just because they bought once.
5. Check every selling message has your business name, your contact details and an unsubscribe that works. Test it: opt out yourself and see if it sticks within 5 working days.
6. If your texts go out under a business name, ask your provider whether it's on the SMS Sender ID Register.
7. If staff or an AI agent make calls that sell, check the Do Not Call Register first, keep to the hours, and make sure the caller says who they are and why they're calling.
8. If a provider or app sends for you, ask them to show you the consent records and how unsubscribes are handled. It's your business on the line.

This is general information, not legal advice.