An AI voice agent books an appointment. Your CRM fires a confirmation SMS. The recipient replies "Stop". Your platform ignores it because the code only checks for uppercase. Three weeks later, ACMA sends a please-explain letter and your business is facing an $18,000 infringement notice for a single ignored opt-out. This happens more often than you think.

The Spam Act 2003 doesn't care whether your SMS system is human-managed or fully automated. If someone asks to stop receiving messages, you have five working days to action it. If your AI keeps texting them after that, you're in breach. The penalty ceiling is $2.75 million for a body corporate. Here's what every Australian SMS bot must handle to stay compliant, and why testing for "STOP" alone is commercial negligence.

The Spam Act unsubscribe requirement in plain English

Section 16 says every commercial electronic message must include a functional unsubscribe facility. For SMS, that means a reply mechanism. The person must be able to send a message back, and you must process it within five working days. There's no prescribed format. They can write "STOP", "Unsubscribe", "Remove me", "Don't text me again", or something far less polite. All are legally valid opt-outs.

Your system must recognise them, log the timestamp, suppress future sends, and do it without forcing the person to reply in uppercase or follow a script. Case-sensitivity isn't a defence. Neither is "our platform only supports keyword triggers". You built the system; you own the compliance gap.

Soft declines vs hard stops

Not every negative reply is an unsubscribe demand. Someone might reply "not today" or "maybe next week" or "call me instead". These are soft declines. They're asking for a pause or a channel switch, not permanent removal. A well-designed AI bot distinguishes between the two.

We listened to a conversation last Thursday where a Sydney physio client replied "no thx" to a recall SMS. The agent understood it as a polite brush-off, logged it as a soft decline, and suppressed that campaign thread but kept the contact live for future booking confirmations. Two months later, the same person rebooked online and received an appointment reminder without complaint. That's the difference between intelligent intent parsing and blunt keyword matching.

Hard stops include any variation of "stop", "unsubscribe", "remove", "opt out", "fuck off", "leave me alone", or similar. The language is often direct. Your bot must handle profanity without breaking. If it can't tell the difference between "not interested this time" and "never contact me again", you need a better parser or a human review layer.

What silent-stop best practice looks like

When someone opts out, don't send a confirmation SMS unless the law requires it for that message type. The Spam Act doesn't mandate a "you've been unsubscribed" reply. Sending one after an angry opt-out is technically another message to someone who just told you to stop. It's also annoying.

Better practice is to process the request, update the CRM suppression list, log the event, and stay silent. If your platform sends automated confirmations, make sure the unsubscribe handler bypasses that logic. We've seen systems that respond to "STOP" with "Reply CONFIRM to complete your unsubscribe request". That's not compliant. The opt-out is immediate. You don't get to add friction.

For audit purposes, keep a timestamped record of every opt-out: the original message, the reply text, the action taken, and the date. If ACMA investigates, you need proof you acted within five working days. A CRM tag isn't enough. You want a separate compliance log that can be exported and reviewed.

The real cost of getting this wrong

ACMA enforcement is rare, but when it happens, the penalties are steep. In 2022, a Queensland car dealership paid $25,000 in infringement notices after continuing to SMS people who had opted out. The business argued the messages were "service reminders", not marketing. ACMA disagreed. The Spam Act defines commercial messages broadly, and appointment reminders often fall inside the scope if they promote future bookings or upsell services.

Beyond fines, there's reputational damage. A recipient who opts out and keeps getting messages will escalate. They'll post the exchange online, complain to the practice manager, or leave a review mentioning "harassing texts". For a clinic, gym, or trades business, that's brand poison in a local market where word travels fast.

The fix is straightforward. Test your SMS system with every common opt-out phrase you can think of. Send "stop", "Stop", "STOP", "unsubscribe", "no thanks", "remove me", "piss off". Check that each one triggers suppression. Check that no confirmation SMS fires unless legally required. Check that the CRM tag or suppression flag is set immediately, not in a nightly batch sync. If any of those fail, your platform isn't ready for live commercial use.

What to do right now

Log into your AI voice agent or SMS platform. Find the unsubscribe handler. Test it with at least ten opt-out variations, including mixed case and profanity. Verify that suppression happens in real time and that no follow-up message is sent. If your platform doesn't support intent-based parsing, add a human review queue for ambiguous replies or switch to a system that does.

If you're running SMS campaigns through VoxReach, the inbound SMS handler already parses common opt-out language and logs hard stops automatically. You can review the suppression list in the dashboard under compliance logs. If you're using a different platform, check the vendor's Spam Act compliance documentation. If they don't have one, that's a red flag.

Sign up at app.voxreach.com.au/signup to test unsubscribe handling with a free 90-second demo call and SMS. Or ring +61 2 5926 2202 to talk to Frank, our live AI broker, on the same platform.