‍What Australian law requires before anyone, or anything, makes a call

Not legal advice. General information only. Verify with a lawyer, and check current ACMA guidance.

The thing most people get wrong

The Spam Act does not cover phone calls.

The Spam Act 2003 applies to commercial electronic messages such as email, SMS, MMS and instant messaging. Voice calls are governed separately, principally by the Do Not Call Register Act 2006 (Cth) and the associated telemarketing industry standard.

This distinction matters because the obligations are different. An unsubscribe link has no relevance on a phone call, and the consent reasoning that may support cold email does not automatically transfer to voice outreach.

Part 1: The law

Do Not Call Register Act 2006 (Cth)

The Do Not Call Register allows numbers to be registered so they cannot receive telemarketing calls. Calling a registered number for telemarketing purposes is prohibited, subject to limited exemptions.

Business numbers are covered

A common misconception is that the Register only applies to residential numbers and that business-to-business calling is unaffected.

That has not been the position since 2010. Business and government numbers can also be registered.

List washing before calling

Numbers must be checked against the Register before a campaign begins, either through the Register service or an accredited provider.

Registrations are ongoing, meaning a list checked in the past may no longer be compliant today.

Exemptions

Limited exemptions exist for certain organisations and call types, including some calls made by charities, government bodies, educational institutions and political parties.

There are also exemptions for calls that are not considered telemarketing calls.

An exemption is a specific legal category, not simply a description of intent. If the purpose of the call is to promote or sell something, it is generally considered a telemarketing call.

Telemarketing industry standard

Separate from the Do Not Call Register itself, the telemarketing industry standard sets additional requirements, including:

• Permitted calling hours with stricter limits on weekends and restrictions on national public holidays
• Identification of the caller and the organisation they represent
• Contact details provided when requested
• Calling line identification not being withheld
• Promptly ending the call when requested

Australia operates across multiple time zones, so permitted calling hours must be assessed based on the recipient's location, not the caller's location.

Privacy Act 1988 (Cth)

Phone numbers are considered personal information under the Australian Privacy Principles.

Businesses must consider requirements around:

• Collection of personal information
• Notification and transparency
• Accuracy of data
• Security of information
• Destruction when no longer required

The Notifiable Data Breaches scheme may also apply if personal information is compromised.

Recording calls

Call recording laws are state and territory based and vary across Australia.

Before recording conversations, confirm the requirements for each jurisdiction you are calling into.

Regulators: ACMA (Do Not Call Register and telemarketing standards) and OAIC (privacy obligations)

Part 2: AI-placed calls

The same obligations apply whether a call is made by a human or an automated system.

The Do Not Call Register requirements still apply. Permitted calling hours still apply. Identification requirements still apply. Privacy obligations still apply.

Requirements around specifically disclosing that a caller is AI-generated are still developing in Australia. There is currently no single settled rule that covers every situation.

Businesses should confirm the current position rather than relying on assumptions.

Part 3: Our operating practice

Operating practice, not legal advice.

We disclose the AI early

Not because a specific rule currently requires it, but because recipients who discover they are speaking with an AI system midway through a conversation may feel misled.

Trust is more valuable than short-term engagement rates.

We wash the list before every campaign

Not once per client.

A compliant process requires checking numbers before each campaign, not relying on an old list check.

We provide a path to a human

Anyone who prefers to speak with a person should have that option.

We review conversations

You remain responsible for what an automated system says on your behalf.

Transcripts should be reviewed to ensure the system represents the business accurately.

We apply opt-outs across channels

A request such as "don't call me again" is recorded immediately and respected across email, SMS, LinkedIn and phone, not just voice.

We treat voice as part of a sequence

Voice outreach is rarely valuable as a standalone channel.

Often, the impact is indirect: someone who does not answer a call may recognise the name later and become more receptive to a follow-up email or LinkedIn message.

Voice outreach compliance checklist

Before any calling campaign

☐ List washed against the Do Not Call Register for this campaign
☐ Numbers sourced from a legitimate and explainable source
☐ Calling hours confirmed against the recipient's timezone
☐ Calling line identification enabled
☐ Script identifies the caller and organisation at the start
☐ Recording requirements confirmed for relevant states and territories

If the caller is automated

☐ Current AI disclosure requirements confirmed
☐ A pathway to a human is available
☐ Transcripts are reviewed regularly

Ongoing

☐ Do-not-call requests recorded and applied across channels
☐ Register checked again before new campaigns
☐ Personal data stored securely and deleted when no longer required

Summary

Voice outreach is governed by different rules from email and SMS.

The most common misconception, that business numbers sit outside the Do Not Call Register, has been incorrect since 2010.

The practical requirements are straightforward:

• Wash the list
• Call within permitted hours
• Identify yourself
• Stop when asked
• Handle personal information properly

AI does not remove these obligations. If anything, it increases the importance of having clear processes, transparency and accountability.

Key legislation:
Do Not Call Register Act 2006 (Cth)
Telemarketing and research calls industry standard
Privacy Act 1988 (Cth)
Australian Privacy Principles
Notifiable Data Breaches scheme
State and territory surveillance devices legislation

Regulators:
ACMA · OAIC

‍