Australian Telemarketing Law for AI Voice Agents in 2026

Most platforms, when asked about Australian compliance for AI voice agents, lead with the Spam Act 2003. They are pointing at the wrong law.

The Spam Act 2003 explicitly carves voice calls out. Section 5(3) reads, in plain words: a message sent by a voice call on a standard telephone service is not an electronic message for the purposes of this Act. The carve-out applies to human voice and synthetic voice equally. Tabcorp, Pizza Hut, CommBank, and Telstra have all paid Spam Act fines (a combined $14.6 million across the four). Every one of those was email or SMS. None was voice.

So if not the Spam Act, what governs your AI voice agent in Australia? Four things. Here is each one, in operator-tone English, with the cautionary tales priced in dollars.

The Spam Act 2003 myth

The Spam Act regulates commercial electronic messages. Section 5(1) defines what counts. Section 5(3) carves out voice calls on a standard telephone service. The drafters were explicit: voice calls have their own regime. So unless your campaign is sending SMS or email, the Spam Act is not your concern.

Where it does apply: SMS follow-ups from the same campaign. If your AI agent calls a prospect, then your platform fires a confirmation SMS or a follow-up email, that SMS or email is governed by the Spam Act 2003. Consent rules, sender identification, unsubscribe mechanism, all apply.

For the voice call itself, the law is the Do Not Call Register Act 2006.

Do Not Call Register Act 2006

The DNC Register Act regulates "telemarketing calls", which are calls where any purpose is offering, advertising, or promoting goods, services, land, business, or investment opportunities, or a supplier thereof. Lead-generation calls count. The Lead My Way ruling settled that.

Who must scrub. Any business making telemarketing calls to Australian numbers must wash their list against the DNC Register before dialling. That includes AI dialers. There are no AI exemptions.

Exemptions for designated callers. Government bodies, registered charities, religious organisations, registered political parties, independent MPs, election candidates, and educational institutions calling current or former students or their household. These callers can dial DNC-registered numbers, but they still have to comply with the Industry Standard 2017's calling hours and identification rules.

Existing customer relationship (ECR). Consent can be express or inferred from conduct. The classic example: a credit card holder may reasonably expect calls about home loans from the same bank. The relationship has to be active and the offer reasonably related. There is no fixed "12-month dormant" rule in the Act. A single purchase five years ago will not save you in court.

Penalty structure.

How to scrub. The register operator is Salmat, contracted by ACMA. You need a paid subscription. There are four washing channels: web upload for small lists, quick wash for HTTP, SFTP automated batch for large lists, and a SOAP realtime API for per-number checks suitable for AI predictive dialling.

The 30-day safe harbour. If you washed the list within 30 days prior to calling, and the register did not flag the number at wash time, you are protected from liability for that call. Practical implication: monthly wash minimum, weekly for high volume, realtime SOAP API for AI dialling.

Recordkeeping. Wash receipts, transaction IDs, subscription balance, results. Downloadable from the Wash History page for 30 days. Archive everything indefinitely. The civil-penalty limitation period is six years.

Calling hours: the ACMA Industry Standard 2017

The Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 is made under section 125A of the Telecommunications Act 1997. It applies to all telemarketing and research calls, including those exempt from the DNC Register Act (charities, political parties, etc.).

| Day | Telemarketing | Research |

|---|---|---|

| Monday to Friday | 9.00am to 8.00pm | 9.00am to 8.30pm |

| Saturday | 9.00am to 5.00pm | 9.00am to 5.00pm |

| Sunday | Prohibited | 9.00am to 5.00pm |

| National public holidays | Prohibited | Prohibited |

Calling times are measured in the recipient's local time, not the caller's. AU campaigns must handle five timezones (AEST, ACST, AWST, plus DST in NSW, VIC, SA, ACT, TAS over summer). An AI dialler has to geo-tag every number and gate dialling per the recipient's clock. A call dialled from a Sydney server to a Perth number at 6pm AEST is hitting the recipient at 4pm AWST and is fine; the same dial at 8pm AEST is hitting Perth at 6pm AWST, also fine; at 11pm AEST it is 9pm AWST and it is a breach.

Express prior consent from the account-holder lets you call outside these windows. Inferred consent is not enough. Public holidays mean federal public holidays only (New Year, Australia Day, Good Friday, Easter Monday, ANZAC Day, Christmas, Boxing Day). State-only holidays (Melbourne Cup, Labour Day variants) are not federally prohibited but most operators suppress them as courtesy.

The V Marketing $1.5M cautionary tale

In April 2025, the Federal Court fined V Marketing Pty Ltd $1.5 million and personally fined the sole director Michael Vazquez $60,000. The breach was 1,102,318 calls to DNC-registered numbers between March 2017 and September 2018. That includes 553,630 calls for the solar firm Balaska and 548,688 calls on V Marketing's own behalf.

Justice Logan's reasoning, in a quotable line, was that V Marketing had "no culture of compliance" despite multiple prior ACMA compliance alerts. The personal liability of the director is the part that should make every AU AI voice operator pay attention. Hiding behind a corporate structure does not work when the Federal Court goes looking for a culture of compliance and finds nothing.

Other recent enforcement worth knowing:

ACMA fired 1,055 compliance alerts in a single recent quarter. Enforcement appetite is rising, not falling.

Identification and termination

At the start of every telemarketing call, the agent must state:

1. The name of the employer of the person making the call (or themselves if self-employed).

2. The purpose of the call.

3. Who caused the call to be made (the principal). If your AI agent dials for "Acme Solar" via outsourcer "DialPro", both must be identified.

Research calls only need items 1 and 2.

Caller ID must be enabled with a number functional for return contact. Same identification information must be available on the return-call line. "Private" or "withheld" or non-routable CLI is a breach.

On termination request. If the recipient asks to be removed or asks the call to end, the agent must end promptly, record the do-not-contact request, and not call again on behalf of the same principal. The Industry Standard's transparency framing also implies a path to a human on request: the 2007 Standard required a mechanism to speak to an operator during automated voice calls, and the 2017 Standard carries that forward.

State-by-state recording rules

DNC Register and Industry Standard are federal. Call recording sits under state Listening Devices Acts and Surveillance Devices Acts. There are seven of them.

| State | Consent | Statute |

|---|---|---|

| NSW | All-party | Surveillance Devices Act 2007. Up to 5 years jail. |

| VIC | One-party | Surveillance Devices Act 1999. |

| QLD | One-party | Invasion of Privacy Act 1971. |

| WA | All-party | Surveillance Devices Act 1998. |

| SA | All-party | Surveillance Devices Act 2016. Up to 3 years / $15K. |

| TAS | All-party (narrow lawful-interest exception) | Listening Devices Act 1991. |

| ACT | All-party | Listening Devices Act 1992. |

| NT | One-party | Surveillance Devices Act 2007. |

Mobile numbers travel. You cannot reliably know the recipient's state from their number alone. The practical rule for AI voice agents is to default to all-party disclosure at call start. "This call may be recorded for quality and training" covers NSW, WA, SA, TAS, and ACT. It is harmless in VIC, QLD, and NT. It also satisfies APP 5 notification under the Australian Privacy Act.

The AI-specific regulatory gap

Here is the gap that most operators have not noticed. As of May 2026:

This regulatory gap is the story. Australian operators using AI voice agents are governed by laws written for human callers, with no AI carve-outs. The lack of bespoke rules does not mean lighter regulation. It means every existing law applies in full.

Where the gap can bite hardest: deceptive answers to "is this a recording?" or "are you a person?". The Industry Standard does not specifically require AI disclosure. But Australian Consumer Law section 18 (misleading or deceptive conduct in trade or commerce) almost certainly catches it. Recent ACL amendments lifted corporate civil penalties to $50 million per breach. An AI agent that says "I'm Sara from Acme" without disclosing it is AI when asked is risking a section 18 claim that dwarfs the DNC Register penalties.

Best practice: train your AI agent to answer truthfully when asked. "I'm a virtual assistant" is borderline if a reasonable person could interpret it as human. "I'm Sara, an AI assistant calling from Acme" is clearly safer.

Frequently asked questions

My AI agent dialled an existing customer who is on the DNC. Am I covered?

Probably yes, if the relationship is active and the offer is reasonably related to the relationship. The ECR exemption is broader than people think but narrower than they hope. A single purchase five years ago will not protect you. A live credit card holder being called about home loans from the same bank will. Document the relationship and the connection between the offer and the relationship.

Do I have to disclose that the call is AI?

There is no statutory rule requiring it under the DNC Act or Industry Standard 2017. But Australian Consumer Law section 18 catches misleading conduct, and a deceptive answer to "are you a recording" or "are you a person" is misleading. We tell every Waboom client to disclose AI identity in the opening line. It is the safest position.

What if the prospect said yes to "calls about your account" two years ago?

Inferred consent has no fixed expiry. The test is whether the relationship is still active and whether the offer is reasonably related. Two years dormant on a once-only purchase will not survive scrutiny. Two years on an ongoing service contract probably will. Document both ends of that judgement.

Do calls under five seconds count for DNC scrubbing?

For wash purposes, every dial counts. For DNC enforcement, the calls that matter are completed telemarketing calls. ACMA can investigate based on consumer complaints, dial logs, and ACMA-initiated test campaigns. Hanging up after one second does not magic away a contravention if the number was on the DNC register and the wash receipt is missing.

Can I rely on Twilio's caller ID setup?

Yes for basic CLI presentation, but the recipient's return-call line still has to give the same identification information (name of employer, purpose, principal). Twilio routes the bit. You provide the words.

What if our agent dials Perth at 8pm Sydney time?

Perth is two hours behind AEST. 8pm AEST is 6pm AWST, which is within the Industry Standard's weekday window. 11pm AEST is 9pm AWST, which is a breach. The dialler has to gate per recipient's local clock, not the server clock. AWST does not observe daylight savings; AEDT does. In summer the offset becomes three hours.

What about Sundays for charity calls?

Sunday telemarketing is prohibited for non-exempt callers. Charities are exempt under the DNC Register Act, but the Industry Standard 2017 applies to charity calls too, and the Industry Standard prohibits Sunday telemarketing for everyone. A charity calling on a Sunday is in breach of the Industry Standard regardless of DNC exemption. Sunday research calls (9am to 5pm) are allowed for everyone including charities.

Where can I find the laws?

Spam Act 2003 at austlii.edu.au. Do Not Call Register Act 2006 at legislation.gov.au. Industry Standard 2017 at legislation.gov.au. The DNC Register industry portal is donotcall.gov.au.