SMS Marketing in Australia: Consent Rules for Shopify

Quick answer: Under the Spam Act 2003, you can send a marketing text to an Australian number only if the person has consented, the message says who sent it and how to contact you, and it has a working way to unsubscribe. An email sign-up is not consent to be texted, and a phone number given for delivery is not consent either. The regulator, ACMA, says it is up to the sender to prove consent, so keep a record of who agreed, when, how and to what wording. This is general information, not legal advice.

SMS is a channel where you keep one eye on the revenue and the other on the regulator. A text lands on a lock screen, so the bar for permission is higher than for an email sitting in a promotions tab. In Australia the rules come from the Spam Act 2003, enforced by the Australian Communications and Media Authority (ACMA), and they are shorter than most guides make them sound: consent, identification and unsubscribe. On top sits a practical layer that began on 1 July 2026, the SMS Sender ID Register, and underneath sits the proof you keep.

Most of the articles I found on this topic come from SMS vendors and repeat the same summary. Here, each rule is tied to the text of the Act on the Federal Register of Legislation or to a page on acma.gov.au, and where I lean on Klaviyo’s or Shopify’s help centre I say so. I read all of them on 31 October 2026.

I am not a lawyer, and this is not legal advice. It is general information for Shopify store owners. For your own setup, ask a lawyer who handles Australian marketing law, and use ACMA’s page Avoid sending spam as the reference. Prism3 sells Shopify SEO, GEO and CRO. We do not run ads, email or SMS. The opt-in box on your store is a conversion surface, and it sits inside the wider DTC growth system of paid, organic, conversion and email.

What the Spam Act covers, and who it covers

The Act regulates “commercial electronic messages”. Under section 5, an electronic message is one sent over a carriage service to an address linked to an email, instant messaging, telephone or similar account. A text goes to a telephone account, and ACMA lists SMS alongside email and instant messages as e-marketing.

Under section 6, a message is commercial if, having regard to its content, how it is presented and what you find through its links and phone numbers, one of its purposes is to offer, advertise or promote goods or services (or a supplier of them). Three consequences matter for a store:

• One promotional purpose is enough. ACMA’s consent statement says a message with more than one purpose is commercial if one of them is to sell or promote, and that a link to a page with commercial content is likely to make the message commercial. A “your order has shipped” text with a “20% off your next order” line would very likely count as a commercial message.
• Size makes no difference. ACMA’s announcement of 1 July 2024 says its consent statement, and the laws it relates to, apply to any business that markets to Australian consumers by phone, email or SMS, regardless of size or turnover.
• Where you are based matters less than where the recipient is. Section 7 gives a message an “Australian link” in several ways, including when the device used to access it is in Australia, or when the person who holds the account is physically in Australia when they access it. A US-based Shopify store texting an Australian customer is within reach of the Act.

What about order and delivery texts? A message with no promotional purpose is not commercial under section 6. ACMA’s “common issues” page warns about the grey zone, though: it receives complaints about shipping emails that confirm delivery details but also advertise products and offer no unsubscribe, and it says a breach can occur even when a message is mostly factual. My rule of thumb: once a promotional line goes into an order or shipping text, treat it as a marketing text. ACMA’s page is about emails, but the section 6 test is the same for a text.

As at 31 October 2026, the Federal Register of Legislation shows the Spam Act 2003 in force, with its latest compilation (No. 10, dated 10 March 2016) and no unincorporated amendments listed. ACMA said on 1 July 2024 that businesses had paid more than $15 million in spam and telemarketing penalties over the previous 18 months, so enforcement is real.

Rule 1: consent comes before the first text

Section 16 says you must not send, or cause to be sent, a commercial electronic message with an Australian link unless an exception applies. The exception that matters to a store is in section 16(2): the account-holder consented. Schedule 2 defines consent as either express consent, or consent that can reasonably be inferred from the person’s conduct and their business or other relationships with you. Section 16(5) puts the evidential burden on whoever relies on consent, and ACMA’s version is blunter: “it’s up to you to prove that you have a person’s consent.”

Express consent

ACMA describes express consent as the person knowing and accepting that they will receive marketing messages from you, and calls it best practice. People can give it by filling in a form, ticking a box on a website, over the phone or face to face. You cannot send a message to ask for consent, because that is a marketing message.

ACMA’s 2024 Statement of Expectations adds what good express consent looks like. The terms should be readily accessible at the point of consent, not buried in fine print or a long privacy policy. They should say what the consent is for (including which products and marketing channels), who will use it, how long and how it can be withdrawn. The statement also suggests considering double opt-in.

Inferred consent is narrow

ACMA says you may infer consent where the person knowingly and directly gave you their address and would reasonably expect marketing, usually a provable, ongoing relationship with directly related marketing. It says this does not cover sending messages after someone has just bought something, and that it is not as reliable as express consent. Its Statement of Expectations goes further: do not infer consent from one-off purchases, even where a phone number was collected to send a receipt.

Klaviyo is stricter here: its Australia article says SMS always requires express consent in Klaviyo, and that inferred consent likely does not apply to someone who has only abandoned a cart. My decision rule: for SMS on Shopify, rely on express consent only.

Why an email opt-in is not SMS consent

This is the mistake I would check first in any store that has added SMS to an existing email list. Three sources point the same way:

• Klaviyo’s Australia article: consent to receive one type of electronic marketing does not count as permission for any other. Someone who agreed to email can only be emailed, not texted.
• ACMA’s expectations: consent terms should cover which marketing channels they apply to, and “bundled consent”, where one request covers several purposes without a choice about each, is among the practices to avoid.
• Shopify: SMS marketing is its own option under Marketing opt-in, Shopify calls it a separate setting from order confirmation SMS, and Shopify Messaging sends SMS campaigns only to customers who opted in to SMS marketing.

So your email list is not your SMS list. Exporting “all subscribers” into an SMS tool is how a store ends up texting people who never agreed to be texted.

Which phone numbers can you text?

A partner or giveaway list is the same test: the person has to have agreed to receive your marketing, and you have to hold the record. ACMA says outsourcing does not move that responsibility off you.

An illustrative example, with made-up numbers: a store has 6,000 email subscribers and 1,500 customers with a phone number on an order. Only the people who ticked an SMS box or submitted an SMS form can be texted. Say 300 of those 1,500 did. The other 1,200 numbers are delivery contact details. If your SMS list is close to the size of your email list, treat that as a red flag and find out how it was built.

Boxes and forms ACMA says to avoid

ACMA’s Statement of Expectations lists practices that will generally not meet its expectations. The ones that bite on a Shopify store: pre-checked tick boxes, bundled consent, refer-a-friend arrangements, consent so old the person would not expect it to apply, and adding people to lists because they visited your site or emailed you.

Shopify helps on the SMS side: its help centre says the SMS checkbox at checkout cannot be preselected. The email checkbox is different. Shopify lets it be preselected in regions it recommends or regions you choose, and says its recommendations are not legal advice. Given ACMA’s line on pre-checked boxes, I would open Settings > Checkout > Marketing opt-in > Email, look at what is set for Australia, then ask your lawyer.

Rule 2: say who is sending

Section 17 requires a commercial message to clearly and accurately identify the person or organisation that authorised it, to include accurate information on how to contact them, and for that information to be reasonably likely to stay valid for at least 30 days after sending. ACMA puts it as: accurately identify your name or business name and give correct contact details. If someone else sends on your behalf, the message must still identify you.

SMS gives you very little room, which is where stores trip. ACMA asks for the correct legal name, or your name and ABN, in the message. Whether a trading name plus a short link to a page showing your legal name, ABN and contact details is enough is a question for your lawyer, and I would not assume it is. Whatever you use, keep it accurate for at least 30 days after each send. If an app or agency sends for you, you are still the business that authorised the message.

Rule 3: an unsubscribe that works

Section 18 requires a clear and conspicuous statement that the recipient can unsubscribe using an address set out in the message, and that address must be able to receive unsubscribe messages for at least 30 days after sending. ACMA’s plain-English list says every commercial message must have an unsubscribe option that:

• presents the instructions clearly,
• honours the request within 5 working days,
• charges no fee and costs no more than the usual cost of using the address (a standard text charge),
• keeps working for at least 30 days after the message is sent, and
• does not require extra personal information, a login or an account.

The five-day figure. You will see “five business days” repeated in guides, so here is where it comes from. Schedule 2, clause 6 of the Act says withdrawal of consent takes effect at the end of a period of 5 business days beginning on the day the unsubscribe message was sent, and a business day excludes Saturdays, Sundays and public holidays in the place the message was sent to. ACMA’s Avoid sending spam page says 5 working days. Its Statement of Expectations says to action requests as quickly as practicable and always within a maximum of 5 business days. Treat five as a ceiling, not a target. Automate it so STOP takes effect straight away, and brief whoever answers your support inbox, because clause 6 covers any message to the effect that the account-holder does not want further commercial messages, or one of similar effect. Treat a “please stop texting me” sent to support as a STOP.

Sender IDs cannot take replies. ACMA’s page warns that alphanumeric headers (a business name instead of a number) are generally not capable of receiving return messages, and its common-issues page says asking people to reply to a Sender ID to unsubscribe does not work and breaks the rules. Klaviyo says the same: branded sender IDs cannot receive replies, so it puts an unsubscribe link in the message by default, while a long code can use an instruction such as “Reply STOP” (one of ACMA’s own SMS examples). The rule of thumb: Sender ID means a link, a number means a keyword.

Other things ACMA expects:

• Offer a straightforward way to unsubscribe from all marketing messages, not only some.
• Honour the request even if someone else uses the number: it applies to the number.
• Do not text unsubscribed people to coax them back.

The SMS Sender ID Register, from 1 July 2026

ACMA announced on 1 July 2026 that the SMS Sender ID Register had commenced. Messages from registered sender IDs keep showing the business name. Messages from unregistered sender IDs must be labelled “Unverified” by the telco and are grouped in a single thread. ACMA’s Chair said unregistered messages are being labelled rather than blocked while the register grows, and that there is no cut-off date for registration. Businesses that rely on branded SMS and have not registered should contact their messaging provider as soon as possible.

How it works for a store, per ACMA’s business pages:

• You register through your telco or message provider. You need to contact each provider you send through, and ACMA says you can only authorise a provider by registering via that provider, so a self-registration alone is not enough.
• If you have an ABN, the authorised contact or service-of-notice email in the Australian Business Register must be up to date, because identity checks run against it.
• A sender ID must be 2 to 11 characters, cannot be only numbers, cannot contain the word “Unverified”, and must be clearly linked to you: it should match your registered business name, company name, trademark or domain name.
• If you send from a phone number instead of a sender ID, ACMA says you do not need to do anything.

Klaviyo’s help centre (updated 22 October 2026) adds a platform rule: in Australia you must register your branded sender ID before you begin collecting SMS consent or sending messages. Some ACMA pages still read as if the deadline is ahead of us (“before 1 July 2026”); the 1 July release is the most recent position I found. If you are a store outside Australia without an ABN, ACMA says international organisations can register through a certified telco or its partner.

What proof of consent to keep

ACMA’s July 2024 statement says records should include the method by which consent was obtained, the terms that applied, and the date and time. Its Avoid sending spam page puts it as who gave consent, when and how. The statement also warns not to assume a third party keeps those records for you, and says they must be produced if ACMA requires them.

The wording row is the gap. Shopify’s SMS consent fields (documented on shopify.dev) record when, how and where consent was given, and Klaviyo records consent from its own sign-up forms and can import statuses and timestamps. I did not find anything in the documents I read that stores the wording the person actually saw, so keep a dated copy of every checkout label, popup and terms page, and save a new one each time you edit them. Klaviyo advises keeping your original records of how consent was obtained when you import from another tool. My own rule on top of that: import only profiles that carry an SMS consent status and a timestamp.

One Shopify detail worth knowing: Shopify says a customer’s SMS marketing preference is saved only if the customer submits the checkout. Someone who ticks the box and abandons the checkout has not, on Shopify’s description, been saved as consented, so do not text them from a list that treats them as opted in.

What a careful Shopify opt-in looks like

I will not call any wording compliant, because that is a lawyer’s call on your facts. Here is a structure that matches what ACMA, Klaviyo and Shopify describe.

At checkout

1. Go to Settings > Checkout > Marketing opt-in and turn on SMS. Shopify keeps this box unticked.
2. Use Customize labels to edit the text. Shopify’s help centre says that if your store sends abandoned cart reminders, you need to change the default wording, which refers to news and offers, so the label covers them.
3. Make sure your terms of service and privacy policy are published. Shopify lists them as a requirement for collecting phone numbers at checkout.
4. Keep SMS consent separate from order notifications, which Shopify treats as a different setting.

A structure to take to your lawyer, not approved text: “Send me marketing texts and offers from [legal name], including reminders about items I have left in my cart, to this number. I can unsubscribe at any time using the link in each message. Terms and privacy policy.” It names the sender, the channel, the content and the exit, and links to the terms. It does not say how long the consent lasts, which ACMA’s statement lists as something good terms cover, so ask your lawyer what to add.

In a popup or form

• Separate the SMS box from the email box. Klaviyo says SMS consent must be collected separately, and that you can collect both in one form if SMS is clearly optional, with its own checkbox or button. It advises against collecting both on the same step, because people may think they need SMS to get the email.
• Put the disclosure above the box or button, where it is read before the person opts in (Klaviyo’s guidance).
• Do not make a purchase depend on it. Klaviyo says SMS consent cannot appear to be required.
• Consider a confirmation step. ACMA suggests considering double opt-in. Klaviyo’s Smart Opt-in, available on paid SMS plans, sends a one-time code that the visitor uses to confirm.

On the conversion side, test the offer, headline, timing and field order. Do not test the consent mechanics: a pre-ticked box or a hidden disclosure may lift the opt-in count, but subscribers you cannot prove are a liability, not an asset. Track SMS opt-ins as their own event and reconcile the count with your SMS platform, so you can trust the opt-in rate by device.

The first text and the welcome flow

ACMA’s common-issues page says “welcome journeys” are not exempt because they often contain commercial content. So the first text needs the sender, a way to contact you and a working unsubscribe, like any campaign. Build the SMS step of your welcome flow with those three items in the first message. Do not send a text asking someone to “confirm” if they have not already opted in, because ACMA says a message asking for consent is itself marketing.

Abandoned cart and post-purchase texts

An abandoned cart flow by SMS needs express SMS consent: Klaviyo requires it, and ACMA recommends express consent in any case. For the post-purchase flow, keep order and delivery texts free of promotion unless that person has consented to SMS marketing.

A 30-minute consent audit

1. List every app and setting that can send a text: Shopify’s order notifications, Shopify Messaging, Klaviyo and any other app each hold their own subscribers and sender IDs. Shopify says its order SMS sender ID is based on your store name, cut to 11 characters, so check what customers see.
2. Open Settings > Checkout > Marketing opt-in and read the SMS and email settings and labels, including what the email box is set to for Australia.
3. Open each popup and form. Is SMS a separate, unticked choice with the disclosure above it?
4. Export your SMS-subscribed profiles. How many have a consent date and a source? How many do not?
5. Compare three numbers: SMS subscribers, email subscribers and phone numbers on file. An SMS list close to the size of the email list needs explaining.
6. Opt in with your own number, then unsubscribe exactly as the message tells you. Check that no login or extra details are demanded, note how long the change takes to appear in each tool, and confirm the next campaign skips you.
7. Ask your SMS provider whether your sender ID is registered, or confirm you send from a number.
8. Take dated screenshots of every checkout label, popup and terms page.
9. Write down who handles “stop texting me” emails and replies, and how fast.

Where this fits in the wider system

The list that consent produces is smaller than “everyone we have a number for”, and that is fine: the only list you can use is the one people agreed to. We do not run SMS, email or ads. What we look at is conversion after the click: how many visitors buy, where a sign-up prompt gets in the way on a phone, and whether the opt-in and order numbers in your tools agree, because paid and email figures are only as trustworthy as the tracking behind them. Consent wording and legal duties are for your lawyer and ACMA.

Key takeaways

• The Spam Act 2003 applies to marketing texts with an Australian link, whatever the size of the business: consent, identification, unsubscribe.
• Consent is yours to prove (section 16 and ACMA). Keep who, when, how and the exact wording shown.
• An email opt-in is not SMS consent. A phone number given for delivery is not consent either, and neither is a one-off purchase, an enquiry, a referral or a bought list.
• Unsubscribe must work without a login or extra details, stay functional for 30 days after sending, and be honoured within 5 business days at the latest. Treat that as a ceiling.
• A sender ID cannot receive replies, so use an unsubscribe link with it and a keyword with a number. Since 1 July 2026, unregistered sender IDs are labelled “Unverified”.
• This is general information, not legal advice. Check your own setup with a lawyer.

FAQs

Do I need consent to text customers who have bought from me?

For marketing texts, yes. ACMA says inferred consent does not cover sending messages after someone has just bought something, and its Statement of Expectations says not to infer consent from a one-off purchase, even where the number was collected for a receipt. A plain order or delivery update with no promotional purpose is not a commercial message under section 6, but adding promotion changes that.

If someone is on my email list, can I text them?

Not on that basis. Klaviyo’s Australia article says consent for one type of message is not permission for another, so an email subscriber needs to opt in to SMS separately.

How long do I have to honour a STOP?

Schedule 2, clause 6 of the Act says withdrawal of consent takes effect at the end of 5 business days beginning on the day the request was sent, and ACMA says always within a maximum of 5 business days. Automate it, so STOP works at once.

Do I have to register a sender ID?

If you send texts under a business name rather than a number, register it through your telco or message provider. Unregistered sender IDs are labelled “Unverified” from 1 July 2026, labelled rather than blocked for now, with no cut-off date. If you send from a phone number, ACMA says you do not need to do anything.

I am a US store with some Australian customers. Does this apply to me?

It can. Section 7 of the Act treats a message as having an Australian link in several ways, including when the account-holder is physically in Australia when they access it. US rules are separate (Klaviyo’s SMS compliance page describes written consent for US marketing texts), so ask a lawyer who knows both countries.

Are there legal sending hours for marketing texts?

I did not find a statutory sending window in the Act text or the ACMA pages I read. Klaviyo’s Australia article lists 9 a.m. to 8 p.m. in the recipient’s local time as a best practice, not a legal requirement, and notes its quiet-hours settings do not enforce that window for each recipient’s time zone automatically.

Keep reading

• How email lifts customer lifetime value on Shopify
• Gmail and Yahoo sender rules for Shopify stores
• Three numbers Shopify founders watch

Want to see where your store loses buyers after the click?

Consent rules decide who you may text; they do not show where your store loses buyers before they reach the list. Book a free 30-minute diagnostic: we look at where your store loses buyers after the click, using your own numbers, and tell you what to fix first. We do not run ads or email. No pitch. No email gate. Whether your consent wording meets the Spam Act is a question for your lawyer or ACMA, not for us. If you want the conversion side looked at properly, see how our Shopify CRO service works.