SMS laws by country: US, Canada, Australia & New Zealand
Each of these countries has its own law for business texts, with its own consent rules, opt-out deadlines and sending rules. This page explains what each one requires before you hit send, whether you text from a registered number or from your own SIM through VoidFix.
- Consent and opt-out rules side by side
- A checklist and sample message for each country
- Links to the official regulator guidance
Not legal advice. This is a plain-English summary of the main rules as of November 2026. Laws change and some industries (healthcare, finance, debt collection, political messaging) have extra rules. You, the sender, are responsible for compliance, so check with a lawyer in each country you text.
SMS rules compared: US vs Canada vs Australia vs New Zealand
The short version. The rules for each country are explained in full further down.
| United States | Canada | Australia | New Zealand | |
|---|---|---|---|---|
| Main law | TCPA + FCC rules, state "mini-TCPA" laws | CASL | Spam Act 2003 | Unsolicited Electronic Messages Act 2007 |
| Enforced by | FCC, FTC, state attorneys general, and private lawsuits | CRTC | ACMA | Department of Internal Affairs (DIA) |
| Consent for marketing texts | Prior express written consent | Express or implied consent | Express or inferred consent | Express, inferred or deemed consent |
| Implied consent from existing customers | Not enough for marketing texts | Yes, for 2 years after a purchase or 6 months after an enquiry | Yes, if they would reasonably expect your texts | Yes, if inferred from your business relationship |
| Identify sender in every marketing text | Yes (carrier rules) | Yes: name plus mailing address and a phone, email or web contact | Yes: business name and contact details | Yes: who authorised it and how to contact them |
| Opt-out in every marketing text | Yes | Yes | Yes | Yes |
| Deadline to honour an opt-out | 10 business days (FCC rule); do it immediately | 10 business days | 5 working days | 5 working days |
| Legal sending hours | 8am to 9pm recipient's time; 8am to 8pm in some states | None in CASL | None in the Spam Act | None in the UEMA |
| Do Not Call register covers texts? | Yes, the National Do Not Call Registry | No, texts fall under CASL | No, the register covers calls and faxes | No national register in law |
US SMS laws: TCPA, Do Not Call and state rules
The US has the strictest rules of the four: federal law, carrier rules and state laws all apply at once.
The laws
- TCPA (Telephone Consumer Protection Act) and the FCC's rules at 47 CFR 64.1200.
- National Do Not Call Registry, which the FCC confirmed in 2023 covers marketing texts.
- State laws such as Florida's FTSA and Oklahoma's OTSA, which are often stricter than federal rules.
- CTIA guidelines, the carriers' own rules, which carriers enforce by filtering and blocking.
Consent
- Marketing texts: prior express written consent. That means a signed agreement (a ticked web-form box counts as an e-signature) saying they agree to receive marketing texts from your business at that number, and that agreeing is not a condition of purchase.
- Informational texts such as reminders and order updates: prior express consent, usually given when they hand you their number for that purpose.
- Consent given to a lead seller or a list broker does not cover you.
Opt-out
- Since 11 April 2025, FCC rules let people opt out by any reasonable means. Replies such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE count, and so does plain language like "don't text me".
- You must honour an opt-out within 10 business days. Do it straight away.
- You may send one confirmation text with no marketing in it, within 5 minutes of the request.
- Carriers also expect your number to answer the keyword HELP.
Sending hours and frequency
- Federal rule: no marketing texts before 8am or after 9pm in the recipient's local time.
- Florida and Oklahoma: 8am to 8pm, and no more than 3 marketing texts in 24 hours on the same subject.
- Time zones come from the recipient's location, not yours. When in doubt, go by area code and send late morning to early evening.
OTPs and transactional texts
One-time passcodes, booking confirmations and delivery alerts that the person asked for need prior express consent, but not written consent. Keep them free of promotions: add a coupon to an order update and it becomes a marketing text that needs written consent. Carriers expect high-volume OTP traffic on registered short-code or toll-free routes.
Watch the state laws. Besides Florida and Oklahoma, Maryland and several other states have their own texting laws, and since 1 September 2025 Texas treats marketing texts as telephone solicitations under its registration law (SB 140). If you text a specific state heavily, check its rules. Carriers also filter "SHAFT" content (sex, hate, alcohol, firearms, tobacco) and cannabis, so age-gate that content or avoid it.
US checklist
- Opt-in form names your business, says texts are marketing, says consent isn't required to buy, and states frequency, "Msg & data rates may apply", HELP and STOP
- Check marketing lists against the National Do Not Call Registry and your own internal do-not-text list
- Send a confirmation text right after someone opts in
- Put your business name in every message
- Honour every opt-out, in any wording, and stop texting that number
- Send only between 8am and 8pm in the recipient's time zone (the strictest state window)
- Keep consent records (time, source, wording, number) for at least 5 years
Sample: US opt-in confirmation
Business name, what they'll get, how often, cost notice, HELP and STOP: everything carriers look for in one text.
Canada SMS laws: CASL
Canada's Anti-Spam Legislation treats any text that encourages someone to buy something as a commercial electronic message (CEM). CASL is unusual because it sets out exactly what every marketing message must contain.
The laws
- CASL, enforced by the CRTC (Canadian Radio-television and Telecommunications Commission).
- PIPEDA and, for Quebec residents, Law 25, which cover how you collect and store phone numbers.
- Texts fall under CASL, not the National Do Not Call List, which covers telemarketing calls.
Consent
- Express consent: an active opt-in, never a pre-ticked box. When you ask, you must say why, who is asking (your name and contact details) and that they can withdraw at any time. It lasts until they withdraw.
- Implied consent: an existing business relationship. It lasts 2 years after a purchase or contract and 6 months after an enquiry, then it expires.
- You carry the burden of proving consent.
What every marketing text must include
- Your business name, and the client's name if you send on someone else's behalf.
- Your mailing address, plus a phone number, email or web address.
- An unsubscribe method.
- Where that won't fit in a text, a short link to a page with the full details and unsubscribe option is accepted.
Opt-out
- Unsubscribing must be free, quick and easy, such as replying STOP or tapping a link.
- Process it within 10 business days.
- The unsubscribe method and your contact details must keep working for at least 60 days after the message is sent.
OTPs and transactional texts
A passcode or security code with no commercial content is not a CEM at all. Some messages are exempt from the consent rule but still need your identification and an unsubscribe option: quotes the person asked for, order and delivery confirmations, warranty, recall and safety notices, and factual updates about their account or subscription.
Hours and language. CASL sets no sending hours. The CRTC's telemarketing hours (weekdays 9am to 9:30pm, weekends 10am to 6pm) are a sensible limit for texts too. If you text consumers in Quebec, the Charter of the French Language means your commercial messages should be available in French.
Canada checklist
- Opt-in form with an unticked box, a stated purpose, your name and contact details, and "you can withdraw consent at any time"
- Track implied-consent expiry dates (2 years after a purchase, 6 months after an enquiry) and stop texting those contacts or ask for express consent before they expire
- Every marketing text includes your name, contact details and an unsubscribe method (or a link to them)
- Process unsubscribes within 10 business days; same day is better
- Keep the unsubscribe method working for 60 days after each send
- Keep consent records: date, method, the exact wording shown, and the number
Sample: CASL-ready marketing text
Sender name, mailing address, a web contact and two ways to unsubscribe.
Australia SMS laws: the Spam Act 2003
The Spam Act comes down to three rules for every commercial message: consent, identify and unsubscribe. ACMA enforces it actively, with a close eye on broken or missing unsubscribe options.
The laws
- Spam Act 2003 and the Spam Regulations 2021, enforced by ACMA (Australian Communications and Media Authority).
- Privacy Act 1988, including APP 7 on direct marketing.
- The Do Not Call Register covers calls and faxes, not texts.
- Carriers block scam-like texts under the industry code on scam calls and SMS (C661), and the new SMS Sender ID Register covers alphanumeric sender names.
Consent
- Express consent: they actively agreed, through an unticked box, a form, or a recorded verbal yes.
- Inferred consent: an existing relationship where they would reasonably expect your texts, such as a current customer receiving related offers.
- A text asking for consent is itself a commercial message, so you can't text people to ask.
- Never send to bought or rented lists.
Identify
Every commercial message must clearly identify the business that authorised it and include accurate contact details. Those details must stay valid for at least 30 days after you send. If you send on behalf of clients, name the client, not just your agency.
Unsubscribe
- Every commercial message needs a working unsubscribe, such as "Reply STOP to opt out".
- It must be free (or cost no more than a standard reply text) and must not require a login, password or fee.
- Honour it within 5 working days.
- It must keep working for at least 30 days after the message is sent.
OTPs and transactional texts
Purely factual messages such as passcodes, appointment reminders and delivery updates don't need consent or an unsubscribe, but they must still identify you. Add even a small promotion ("use code SAVE10 next time") and the whole message becomes commercial. Government bodies, registered charities, political parties and schools get similar exemptions for some messages.
Sending hours. The Spam Act sets no hours for texts. The telemarketing standard for calls (weekdays 9am to 8pm, Saturday 9am to 5pm, never on Sundays or national public holidays) is the benchmark customers and ACMA expect, so schedule campaigns inside it.
Australia checklist
- Record how and when each person consented, or why consent can reasonably be inferred
- Business name and contact details in every message, including reminders and OTPs
- "Reply STOP to opt out" (or similar) in every commercial message
- Process opt-outs within 5 working days, with no login or fee
- Keep the opt-out and contact details working for 30 days after each send
- Send weekdays 9am to 8pm and Saturday 9am to 5pm, recipient's local time
Sample: Spam Act-ready marketing text
Consent, identify, unsubscribe: all three in under 160 characters.
New Zealand SMS laws: the UEMA
The Unsolicited Electronic Messages Act 2007 works much like Australia's Spam Act, with consent, identification and unsubscribe for every commercial text. The Department of Internal Affairs runs an anti-spam team that investigates complaints.
The laws
- Unsolicited Electronic Messages Act 2007 (UEMA), enforced by the DIA.
- Privacy Act 2020, which covers how you collect, use and store numbers.
- Fair Trading Act 1986, which bans misleading claims in your messages.
- There is no national Do Not Call register in law. Industry opt-out lists are voluntary.
Consent
- Express: they clearly agreed to receive your texts.
- Inferred: reasonably inferred from their conduct and your business relationship.
- Deemed: the number was published conspicuously in a work capacity, without a "no marketing" note, and your message relates to that work. This rarely applies to personal mobiles.
- Using address-harvesting software, or lists built with it, is illegal.
Identify
Every commercial message must include accurate information about who authorised it and how to contact them. If you send for a client, the client must be identified.
Unsubscribe
- Every commercial message needs a working, free unsubscribe, such as "Reply STOP".
- Honour it within 5 working days.
- Once someone unsubscribes, their consent is gone, even if they first agreed on a form.
OTPs and transactional texts
The UEMA excludes messages that only give a quote the person asked for, confirm or complete a transaction, give warranty, recall or safety information, or give factual information about an account or subscription. OTPs, booking confirmations and delivery updates usually fall here. Add a promotion and the message becomes commercial.
Sending hours. The UEMA sets no hours. Keep marketing texts to normal daytime hours on weekdays and Saturdays, and avoid Sundays and public holidays. Most complaints come from badly timed messages.
New Zealand checklist
- Record whether each contact gave express consent or why consent can be inferred
- Name the business that authorised the message and give a way to contact it
- Include a free unsubscribe in every commercial text
- Process unsubscribes within 5 working days
- Never use scraped or harvested number lists
- Handle numbers under the Privacy Act 2020: collect for a stated purpose and keep them secure
Sample: UEMA-ready marketing text
Who sent it, how to reach them, and a free way out.
Rules that apply wherever you text
These hold in every country above, whatever route your texts take.
Your own SIM is not an exemption
Sending from a SIM in your own Android phone through VoidFix skips US A2P 10DLC registration, but these laws regulate the message and the sender, not the route. The same consent, identification and opt-out rules apply. How SIM sending and A2P differ.
The recipient's country decides
The law where your customer lives applies, and often the law where you are too. Use a local SIM in the country you are texting, and when one list spans several countries, apply the stricter rule.
You have to prove consent
In all four countries the burden of proof is on the sender. Store when, where and how each person opted in, with the exact wording they saw. A spreadsheet of numbers with no history won't protect you.
Carriers and SIM plans have their own rules
Carriers can filter or suspend a number that sends spam-like traffic even if you are legally compliant. Many consumer SIM plans limit commercial bulk use, so read your plan's terms or ask your carrier about a business plan.
VoidFix tools that help you follow the rules
These help you meet the requirements above. Compliance is still your responsibility: the tools can't collect consent for you or decide what the law requires.
Unsubscribe management
Mark contacts as unsubscribed in Contacts and Groups, or unsubscribe a contact through the API from your own opt-out flow. Lead management.
Keyword auto replies
Set up auto replies for STOP, HELP and other keywords, so every opt-out gets one clear confirmation. Auto replies.
Message scheduling
Schedule campaigns to land inside each country's sending window instead of whenever you hit send. Message scheduling.
Number Warmup
Ramps up sending on a new SIM gradually, so carriers see normal behaviour instead of a sudden flood.
Spintax
Varies the wording of each text so a campaign isn't hundreds of identical messages, while your business name and STOP line stay in every version. Spintax.
Delivery reports
See delivered or failed for every text in real time, so you notice a filtered SIM or a problem campaign quickly.
SMS compliance questions customers ask us
Do these laws apply when I send from my own SIM through VoidFix?
Yes. The TCPA, CASL, the Spam Act and the UEMA regulate the message and the sender, not the technology. A marketing text sent from a SIM in your own phone needs the same consent, identification and opt-out as one sent through any SMS API.
Which country's law applies: mine or my customer's?
Usually the law where the recipient is, and often the law where you are as well. CASL covers messages sent to or from computers in Canada, Australia's Spam Act covers messages with an Australian link, and New Zealand's UEMA covers messages with a New Zealand link. If you text more than one country, follow the stricter rule for each list.
Do I need consent to send one-time passcodes and appointment reminders?
A purely factual message the person asked for, such as a one-time passcode or a reminder for a booking they made, is not a marketing message in Canada, Australia or New Zealand, so the marketing consent and unsubscribe rules do not apply to it. In Australia it must still identify you. In the US you still need the person's prior express consent, which they usually give by entering their number for that purpose. Add any promotion to the message and it becomes a marketing text with all the rules.
Is honouring the word STOP enough?
No. US FCC rules that took effect on 11 April 2025 say people can opt out by any reasonable means, including words such as quit, end, revoke, opt out, cancel and unsubscribe, or a plain-language reply like "please stop texting me". Canada, Australia and New Zealand also expect any clear request to be honoured. Treat any clear request as an opt-out.
How long should I keep proof of consent?
In every one of these countries, the sender has to prove consent. Keep the date, time, source, the exact wording the person agreed to, and their number for as long as you text them, and for several years after. The TCPA has a four-year limitation period, so five years is a sensible minimum for US contacts.
Is this page legal advice?
No. It is a plain-English summary of the main rules as of November 2026, written to help you ask the right questions. Laws and regulator guidance change, and your industry may have extra rules. Check with a lawyer in each country you text.
Official sources
- United States: FCC, Telemarketing and robocalls; 47 CFR 64.1200; National Do Not Call Registry; CTIA, Messaging Principles and Best Practices (PDF)
- Canada: Government of Canada, Canada's anti-spam legislation; CRTC, CASL frequently asked questions
- Australia: ACMA, Avoid sending spam; Spam Act 2003
- New Zealand: Department of Internal Affairs, Spam and unsolicited messages; Unsolicited Electronic Messages Act 2007
- Related on this site: SMS without A2P registration and SMS compliance best practices
Text customers the right way
Connect one Android phone and send 50 test texts free for 7 days, with opt-out handling, scheduling and Warmup included. No credit card required.