Spam in the spotlight: ACMA raises the stakes for business messaging

Australia's regulatory focus on spam is intensifying.

Since our first edition of Sparke Bytes in December 2024, Sparke Helmore's Technology, Cyber & Privacy team has flagged spam as one of the rapidly changing compliance areas that is no longer a back-office concern. Recent developments from the Australian Communications and Media Authority (ACMA) confirm that the pressure is only growing.

The ACMA's enforcement record

In 2020, the ACMA stepped up its enforcement of spam-related offences under the Spam Act 2003 (Cth) (Spam Act), issuing significant penalties for breaches. Since then, penalties have escalated markedly — Kogan was fined $310,800 in 2021, Latitude Finance faced a penalty of nearly $1.55 million in 2022, and the largest enforcement to date saw the Commonwealth Bank of Australia agree to pay a $7.5 million penalty after the ACMA found it had sent over 170 million marketing messages without a functioning unsubscribe mechanism, including more than 34 million emails sent without the necessary consent.

Since 2022, the ACMA has included spam on its list of enforcement priorities, with a particular emphasis on unsubscribe rules — a shift from 2019 when the primary focus was consent.

What the law requires

The Spam Act requires businesses to obtain consent from recipients before sending commercial electronic messages, clearly identify themselves and provide contact information, provide a functional and prominent unsubscribe option, and avoid deceiving recipients with misleading subject lines or false identities.

Critically, if even one part of a message is intended to advertise or promote goods or services, it is likely to be treated as a commercial electronic message — as Ticketek discovered in October 2023, when a banner advertisement on event tickets exposed the company to scrutiny under spam regulations.

The next frontier: SMS Sender IDs

The ACMA's focus has now expanded beyond email to SMS, with a significant new regime taking effect on 1 July 2026.

Branded sender IDs — the name displayed at the top of an SMS, such as , 'StarTrack' or 'Bunnings’ — allow businesses and organisations to clearly identify themselves when sending appointment reminders, account alerts, delivery updates, security codes and other messages.

From 1 July, SMS sent using an unregistered branded sender ID will display the word 'Unverified' instead of the brand name and will be grouped with messages from other unregistered senders, including potential scams.

Australians lost more than $13.8 million to text message scams in the first nine months of 2025 alone, with many of those scams relying on impersonating trusted sender names such as NAB, AusPost or myGov.

The new SMS Sender ID Register is designed to break that chain of deception by creating a verified channel between businesses and their customers.

Australian Telecommunications CEO Luke Coleman says, ’the telecommunications industry has worked closely with the regulator to develop a smooth process for everyone.’  ACMA Chair Nerida O'Loughlin has issued an urgent call to action for all organisations that use sender IDs — including banks, medical and dental surgeries, retailers, utilities and not-for-profits — to contact their telco provider as soon as possible. ’If a legitimate organisation does not register their sender ID, their messages could be mistaken for a scam, disrupting customer communications and affecting brand reputation’, Ms O'Loughlin said.

Registration is free, but the verification process, particularly for those without ABNs, can take several weeks, and timelines are expected to extend further as the deadline approaches.

The takeaway

Ongoing protection of consumers is an arms race against the black hats.  And new systems and methods are needed to defeat online fraud and scams.  This latest protection method is an important step in that direction but requires businesses that use SMS to message their customers to act now.

Note: This article is for informational purposes only and does not constitute legal advice. Please contact Sparke Helmore's Technology, Cyber & Privacy team for advice specific to your circumstances.