CRM Costs, Pricing Models and 2026 Rules
Spam Act and Do Not Call rules for CRM users: consent, unsubscribes and telemarketing
What the Spam Act 2003 and Do Not Call Register Act 2006 require of Australian businesses emailing, texting and calling from a CRM, and how to set up the CRM to prove compliance.
If you send marketing emails or SMS from your CRM, the Spam Act 2003 requires three things: consent from the recipient (express, or in limited cases inferred), clear identification of your business, and a working unsubscribe facility in every message, with requests actioned within 5 working days. If you make telemarketing calls, the Do Not Call Register Act 2006 generally prohibits calls to numbers on the Register unless the person has consented, and an industry standard limits calling hours and sets rules for how calls are made. The Australian Communications and Media Authority (ACMA) enforces both. A CRM helps only if it records consent, syncs unsubscribes and flags washed numbers, and if your team uses those features.
This guide is part of the best-fit CRM overview. It is general information, not legal advice. Check current ACMA guidance before a campaign.
What counts as a commercial electronic message
The Spam Act covers commercial electronic messages with an Australian link: emails, SMS, MMS and instant messages whose purpose, or one of whose purposes, is to offer or promote goods, services, land, business or investment opportunities, or the sender. A follow-up email from a salesperson promoting a product is a commercial message. A message that only contains factual information (for example an order confirmation or an invoice) is generally not, provided it does not also promote. Voice calls are not covered by the Spam Act; they fall under the Do Not Call rules.
Rule 1: consent
| Type | What it looks like | What to record in the CRM |
|---|---|---|
| Express consent | The person ticked an unticked box, signed up to a newsletter, or asked to receive offers | Date, time, source (form, event, call), wording shown, IP address or staff member |
| Inferred consent from a relationship | An existing business or other relationship where the person would reasonably expect your messages, for example a current customer | The relationship, its start date and when it ended |
| Inferred consent from conspicuous publication | A work email address is published conspicuously, it is reasonable to assume it was published with the person's (or organisation's) agreement, there is no statement refusing unsolicited messages, and your message relates to the person's role or function. Mere publication of an address is not enough | Where and when you found it, and why it is relevant |
The sender bears the burden of proving consent. Pre-ticked boxes, buried terms and lists bought from third parties are weak grounds. Part 3 of the Act prohibits supplying, acquiring or using address-harvesting software, or lists created with it, in connection with sending messages without consent. Inferred consent from a past relationship does not last forever; if a customer has not bought for years, the reasonable expectation fades.
Rule 2: identify the sender
Each message must clearly and accurately identify the individual or business that authorised it, and include accurate contact details. For SMS from a business name, note the SMS Sender ID Register: since 1 July 2026, under the Telecommunications (SMS Sender ID Register) Industry Standard 2025, SMS sent with an alphanumeric sender ID that is not registered have the sender name replaced with "Unverified" on recipients' phones. You can register through your SMS or telecommunications provider, or apply to ACMA directly. Check ACMA's current guidance if your CRM or SMS provider sends texts under your business name.
Rule 3: a working unsubscribe
- Every commercial message must include a functional unsubscribe facility, such as a link or a "reply STOP" instruction.
- The facility must keep working for at least 30 days after the message is sent.
- Unsubscribe requests must be honoured within 5 working days: the Act treats the withdrawal of consent as taking effect at the end of 5 business days from the day the request was sent.
- Under the Spam Regulations 2021, unsubscribing must not cost more than the usual cost of using that kind of address, must not require a premium service or a fee, and must not require the recipient to log in, create an account or give personal information other than the address the message was sent to.
The most common CRM failure is unsubscribes that do not sync: a contact unsubscribes from the newsletter tool but a salesperson's sequence keeps emailing them. Test the sync in your trial. See contact-based marketing pricing for how suppressed contacts affect your bill.
Do Not Call Register
The Do Not Call Register Act 2006 prohibits making, or causing to be made, telemarketing calls to Australian numbers on the Register, and marketing faxes to registered fax numbers, unless the account holder has consented. Points for CRM users:
- Which numbers are on it. Numbers used mainly for private or domestic purposes, fax numbers, and government numbers can be registered. Business numbers are not eligible, but a sole trader's mobile used mainly for personal calls may be registered. Do not assume a "business" list contains no registered numbers.
- Washing. Businesses can submit lists to the Register to check ("wash") them. ACMA's position is that lists should be re-washed at least every 30 days. Fees depend on volume; check the Register's industry pages.
- Consent must be clear and should be recorded, like Spam Act consent.
- Exemptions exist for certain calls by government bodies, registered charities, political parties, independent members of parliament and candidates, and educational institutions (Schedule 1 of the Act). Ordinary businesses should not rely on them.
Calling rules for every telemarketing call
The Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 applies to telemarketing calls whether or not the number is on the Register. In summary:
| Rule | What it requires |
|---|---|
| Calling hours | Weekdays 9am–8pm and Saturdays 9am–5pm, in the recipient's local time; no telemarketing calls on Sundays or national public holidays, unless the person has agreed in advance |
| Identification | Give the caller's name, the business on whose behalf the call is made, and the purpose |
| Calling line identification | The caller's number must be shown, not blocked |
| Ending the call | Stop when the person asks |
| Information on request | Give details of how to make a complaint and where the number was obtained, if asked |
If you sell to consumers by phone, the Australian Consumer Law's unsolicited consumer agreement rules may also apply, including cooling-off rights. Check the ACCC's guidance.
Setting up your CRM for compliance
- A consent field for email, SMS and calls separately, with date, source and wording.
- A suppression list that every sending tool reads, including SMS and any separate email platform.
- A Do Not Call status field updated from each wash, with the wash date.
- Time-zone-aware call lists, so a Perth contact is not called at 8am Perth time from a Sydney office.
- Audit trail of message sends and consent changes.
- Access controls so only trained staff can import lists or launch campaigns.
- A rule that imported lists start as non-marketing until consent is confirmed.
Enforcement and risk
ACMA can issue formal warnings, accept enforceable undertakings, issue infringement notices and seek civil penalties in the Federal Court. In recent years it has issued infringement notices of more than $1 million to some large businesses for Spam Act breaches, often involving unsubscribe failures. The maximum penalties depend on the type of breach and whether the business has a history of breaches; check the Act and ACMA's website. For a small business, the cost of a complaint investigation and lost reputation is often the bigger risk.
If your business is covered by the Privacy Act, APP 7 on direct marketing also applies, except to the extent the Spam Act or the Do Not Call Register Act applies. See the Privacy Act guide.
Frequently asked questions
Can I email people who gave me a business card?
Possibly, under inferred consent if your message relates to their role and they did not say they do not want messages. Record where and when you got the card. Express consent is safer.
Does a sales follow-up email need an unsubscribe link?
If it promotes your goods or services, it is a commercial electronic message and needs one.
Are B2B cold calls covered by Do Not Call?
Business numbers cannot be registered, but some numbers on a B2B list may be registered personal mobiles. The calling-hours standard applies to telemarketing calls generally.
Who is responsible if my agency sends the campaign?
You can be liable for messages sent on your behalf. Put compliance obligations in the agency agreement and check its process.
Sources
- Australian Communications and Media Authority — Spam Act guidance, telemarketing standard, SMS Sender ID Register and enforcement
- Do Not Call Register — eligibility, washing and industry obligations
- Federal Register of Legislation — Spam Act 2003 and Do Not Call Register Act 2006
- Australian Competition and Consumer Commission — unsolicited consumer agreements
- Office of the Australian Information Commissioner — APP 7 direct marketing
