Opt-out notices for direct marketing in Australia

The moment you start sending promotional emails, SMS campaigns, or making outbound sales calls, Australian law switches on a set of obligations you cannot ignore. An opt-out notice is the mechanism that lets recipients say "stop" — and your legal duty is to make it easy, free, and actually work. Get it right from the start, and compliance becomes a background task. Get it wrong, and the Australian Communications and Media Authority (ACMA) and the Office of the Australian Information Commissioner (OAIC) have the power to investigate and take enforcement action.

What you end up with at the end of this process is a business-wide opt-out system: every marketing channel has a working unsubscribe mechanism, requests flow into a centralised suppression list, and your Privacy Policy and collection notices accurately describe how customers can stop receiving marketing from you.

One common misconception: an email disclaimer or legal footer is not an opt-out notice. They serve different functions. A disclaimer may protect you from misuse of information; an opt-out notice is a separate obligation under distinct legislation.

Prerequisites

Before you build your opt-out process, confirm you have these in place:

• A mapped list of every marketing channel — email, SMS, outbound calls, push notifications, printed mailers, and social media custom audiences. You cannot build suppression into a channel you have not identified.
• An email and SMS platform (or custom system) capable of generating unique per-recipient unsubscribe links and processing reply-STOP responses. Most major platforms have this built in; confirm it is switched on and tested.
• A customer relationship management (CRM) system or database where suppression status can be recorded and queried before each send. If multiple platforms send on your behalf, they all need to read from the same suppression list.
• Decision on scope of each opt-out — does an email unsubscribe also suppress SMS, or are they separate? Document the answer before you write the notices, because your notices must accurately describe what they cover.
• A person or team assigned ownership of processing opt-out requests within your internal service level (set this shorter than the statutory five business days under the Spam Act 2003 (Cth) to give yourself a buffer).

Step 1: Understand which laws apply to each channel

Different channels attract different statutory obligations, and you need to know which regime applies before you draft the notice wording.

Email and SMS — the Spam Act 2003 (Cth)

Commercial electronic messages (emails and SMS sent for marketing purposes) must, under the Spam Act 2003 (Cth), include an unsubscribe facility that:

• is functional for at least 30 days after the message is sent
• can be used without cost beyond the standard cost of the channel (for example, the ordinary SMS rate)
• does not require the recipient to log in or create an account to complete the unsubscribe
• results in the request being actioned within five business days of receipt

The Act also requires that commercial messages accurately identify the sender and include current contact details.

All direct marketing using personal information — the Privacy Act 1988 (Cth), Australian Privacy Principle 7

Australian Privacy Principle 7 (APP 7), administered by the OAIC, applies to any organisation that uses or discloses personal information for direct marketing. APP 7 requires that, where an individual requests not to receive direct marketing, the organisation must give effect to the request within a reasonable time and at no cost to the individual. This applies across all channels, not just email and SMS.

Outbound sales calls — the Do Not Call Register Act 2006 (Cth)

If you make unsolicited telemarketing calls, you must check numbers against the Do Not Call Register before calling (unless an exemption applies) and honour an on-call request not to be contacted again by recording the number on your internal do-not-call list immediately.

Step 2: Draft opt-out notice wording for each channel

There is no prescribed statutory wording, but the notice must be clear, prominent, and honest about what it covers.

Email unsubscribe

Place the opt-out in the footer of every marketing email. Use plain language:

"You're receiving this because you subscribed at checkout or on our website. To stop receiving these emails, [Unsubscribe]."

The word "Unsubscribe" (or "Opt out") should be a live link leading directly to a one-step confirmation page — no compulsory account creation, no long forms, no forced survey. The link must remain active for at least 30 days after the send date.

SMS unsubscribe

Include a reply instruction at the end of every marketing SMS:

"Reply STOP to opt out."

If your platform routes replies back through a short code or virtual number, confirm the STOP response triggers automatic suppression in your system. Do not rely on a human monitoring a phone.

Telemarketing opt-out script

Train staff to offer an opt-out unprompted where the conversation permits, and to respond to requests immediately:

"If you'd prefer not to receive calls from us, just say so and I'll update our records now."

Note the number on your internal do-not-call list before the call ends. Do not wait until later in the day.

Privacy Policy and preference centre

For digital advertising, retargeting, and any channel where the opt-out is managed through account settings rather than a single action, your Privacy Policy must explain what data is used for marketing and how people can opt out. Many businesses also provide a preference centre where customers can control which types of communications they receive.

Collection notices (offline and online)

When you collect personal information at point of sale, through a competition, or via a sign-up form, the collection notice must state whether the information will be used for direct marketing and how the person can opt out later. This applies to paper forms, QR codes, and tablet sign-ups.

Step 3: Configure your platforms and test

• Turn on the built-in unsubscribe feature in your email and SMS platform. Do not assume it is active by default — check the settings.
• Send a test message to yourself and click the unsubscribe link. Confirm it loads without login prompts, completes in one action, and immediately suppresses the test address in your platform.
• For SMS, send a test STOP reply and confirm the number is suppressed in your system before any further messages are sent.
• For custom-built systems, work with your developer to implement unique per-recipient tokens in unsubscribe URLs so that a single click identifies and suppresses the correct contact without exposing other subscribers' data.

Step 4: Centralise suppression across all systems

An opt-out from one channel must feed into a centralised suppression list that all outbound marketing systems read before sending. If your email platform, SMS gateway, CRM, and digital ad platform each maintain separate lists, a customer who unsubscribed from email can still receive an SMS — which is both a compliance risk and a poor customer experience.

• Export suppression data from each platform into your CRM as the master record.
• Set up automated sync so that new unsubscribes are reflected across systems within your internal SLA window.
• If you use an agency or third-party platform to send marketing on your behalf, your contract should require them to include opt-outs in every message, process requests within the statutory timeframe, and return suppression data to you.

Step 5: Process opt-out requests within the statutory timeframe

Under the Spam Act 2003 (Cth), unsubscribe requests for commercial electronic messages must be actioned within five business days. Under APP 7, direct marketing opt-outs must be actioned within a reasonable time at no cost.

In practice:

• Set your internal SLA to 24–48 hours so that the five-business-day cap is not a cliff edge.
• Automate wherever possible — manual processing is slower and creates records gaps.
• Assign a named owner (for example, marketing operations) who is responsible for the queue and for escalating failures.
• Never resubscribe a person who has opted out unless they actively re-subscribe and you record the new consent with a timestamp and source.

Step 6: Align your public-facing documents

Your opt-out notices are only credible if your Privacy Policy, Privacy Collection Notice, and website messaging accurately describe what you do. If your Privacy Policy says "we do not use your data for marketing" but you send weekly promotional emails, you have a problem that no unsubscribe link will fix.

Review your documents whenever you add a new marketing channel, migrate to a new platform, or change what types of marketing you send. At a minimum, your Privacy Policy should name each marketing channel you use and explain how customers can opt out.

Where Artificer Legal can help

Configuring an opt-out process is partly a technical task and partly a legal drafting task. Artificer Legal practitioners can assist you with:

• Drafting and reviewing Privacy Policies, Privacy Collection Notices, and Cookie Policies so that your marketing opt-out commitments are accurately described and legally sound.
• Reviewing your standard consent capture (checkout tick-boxes, sign-up forms, terms of service) to confirm you are collecting consent in a way that is valid under both the Spam Act 2003 (Cth) and the Privacy Act 1988 (Cth).
• Reviewing your vendor and agency contracts to confirm they impose the right opt-out processing obligations and return suppression data to you.
• Advising on channel-specific obligations — for example, whether push notifications or in-app messages attract Spam Act obligations in your particular circumstances.
• Responding to ACMA or OAIC enquiries if a complaint has been made about your marketing practices.

If you are rolling out a new marketing channel, switching platforms, or have received a complaint, it is worth getting early advice rather than discovering a gap after the fact.

Getting your suppression list right is the thing that matters most

Every other element of opt-out compliance depends on a single underlying condition: when someone unsubscribes, they actually stop receiving marketing. Beautiful unsubscribe wording and a well-drafted Privacy Policy mean nothing if the suppression list is out of date, siloed inside one platform, or not read before each send. The step that most often fails in practice is Step 4 — centralising suppression. Businesses add new platforms, run a one-off campaign through a different tool, or engage an agency without passing across the current suppression data, and the opt-out record is broken.

Key points:

• Opt-out notices are mandatory under the Spam Act 2003 (Cth) for commercial emails and SMS, under APP 7 of the Privacy Act 1988 (Cth) for direct marketing generally, and under the Do Not Call Register Act 2006 (Cth) for telemarketing.
• Email and SMS unsubscribe links must remain functional for at least 30 days after sending, and requests must be actioned within five business days.
• The opt-out must be free (or cost no more than the standard service charge), simple (one step), and must not require the recipient to log in or create an account.
• A centralised suppression list that all marketing systems read before each send is the operational foundation of the whole system.
• Your Privacy Policy, Privacy Collection Notices, and any preference centre must accurately describe the opt-out options you actually offer.
• Never resubscribe a person who has opted out without fresh, recorded consent.