GoHighLevel SMS Compliance in Australia: ACMA Rules, Sender IDs & Opt-Outs (2026)

If you run SMS through GoHighLevel for Australian clients, the rules you need to satisfy are not the ones you read about on US-focused YouTube channels. There is no A2P 10DLC registration in Australia, but that does not mean sending is a free-for-all. The Spam Act 2003 sets out three obligations that apply to every commercial message you send, and the Australian carriers run their own filtering on top of that. Get either wrong and your messages either land you a complaint to ACMA or quietly disappear before the contact ever sees them.

I am a GoHighLevel Certified Admin based in Australia, and most of the deliverability problems I am asked to fix come down to the same handful of misconfigurations inside LeadConnector and Workflows. This guide walks through what the law actually requires, how the different Sender ID options behave on Australian networks, and how to wire consent gates, opt-out handling and quiet hours into your sub-accounts so that compliance is enforced by the system rather than by someone remembering to do it.

What the Spam Act 2003 actually requires

The Spam Act is administered by ACMA, and it applies to SMS, MMS and email sent to Australian numbers and addresses. It is built around three obligations, and you have to meet all three on every commercial message. There is no exemption for "just one text" or for messages you consider transactional but that also nudge someone toward a sale.

1. Consent

You must have the recipient's consent before you send. Consent comes in two forms. Express consent is where the person actively agreed to receive SMS from you — they ticked an unticked box, typed their number into a form that clearly stated SMS would follow, or replied to confirm an opt-in. Inferred consent is narrower than people assume: it exists where there is an existing business relationship and the message is directly relevant to it, or where someone has conspicuously published a business number without a notice saying they do not want unsolicited messages.

For GoHighLevel work, the safe default is express consent captured at the form. Record the source. If you are relying on inferred consent because someone is an existing client, keep the relationship documented in the contact record so you can show why the message was reasonable.

2. Identify the sender

Every message must make clear who is sending it and include accurate contact details for the business. A bare promotional text with no business name fails this test. In practice this means the business name belongs in the message body or in a recognisable alphanumeric Sender ID, and the account behind the number must be accurate.

3. A working unsubscribe facility

Every commercial message must contain a functional way to opt out, and you must action opt-outs within five business days. For SMS that means honouring STOP. The facility has to actually work — a STOP reply that no Workflow ever processes is a breach even though the word "STOP" appeared in the message.

Sender ID options on Australian networks

This is where Australia diverges sharply from the US. There is no 10DLC brand-and-campaign registration here. Instead you choose between an alphanumeric Sender ID, a dedicated long number, or a shared LeadConnector (Twilio) number — and the Australian carriers (Telstra, Optus, TPG) filter traffic on content and sending patterns regardless of which you pick.

The practical rule: if the contact needs to reply — and most genuine SMS use cases want a reply path — use a dedicated long number. Reserve alphanumeric Sender IDs for true one-way broadcasts, and remember that because they are one-way, you cannot rely on a STOP reply for opt-out. You must put an alternative unsubscribe method in the message itself.

Why Australia has no 10DLC but still filters

US senders register a brand and campaign through The Campaign Registry to send to 10-digit long codes. None of that machinery exists in Australia. What does exist is carrier-level content filtering. Telstra, Optus and TPG inspect message content and sending behaviour, and they silently drop or throttle messages that look like spam — shortened public URLs, certain finance and gambling keywords, all-caps shouting, or a sudden burst of identical messages from a new number.

The implication for GoHighLevel agencies is that "it sent successfully" in the conversation view does not mean it was delivered. Warm new numbers up gradually, vary message content where you can, and keep links on a branded domain rather than a generic link shortener. The same discipline that protects email reputation applies here — the principles in my GoHighLevel email deliverability checklist carry across to SMS more than people expect.

Configuring STOP and opt-out handling in GoHighLevel

GoHighLevel has built-in opt-out handling, but you should not leave it on default and assume it is doing the job. Here is the configuration I set up in every sub-account.

The unsubscribe custom field and tag

• Confirm the DND (Do Not Disturb) setting on the contact toggles correctly when a contact replies STOP — GoHighLevel sets DND for SMS automatically on recognised opt-out keywords.
• Create a dedicated tag such as sms-opted-out applied by a Workflow whenever an opt-out is detected, so suppression is visible at a glance and usable as a filter.
• Add a custom field recording the opt-out date. This is your evidence that you actioned the request inside the five-business-day window.

A Workflow that enforces it

Build a Workflow with a Customer Replied trigger filtered to SMS. Branch on the reply text: if it matches STOP, STOPALL, UNSUBSCRIBE, END, QUIT or CANCEL, set DND, apply the sms-opted-out tag, stamp the opt-out date field, and remove the contact from any active SMS campaigns. This belt-and-braces approach means a single missed keyword in the native handler still gets caught.

Quiet hours and sending windows

The Spam Act does not set fixed SMS curfew hours the way some marketing codes do, but sending commercial SMS late at night or on public holidays generates complaints, and complaints are what bring ACMA attention. Set sensible sending windows in your Workflows.

• Use the Wait step's window settings, or a dedicated time-window condition, to hold messages until business hours in the contact's timezone — a practical default is 9am to 6pm on weekdays.
• Account for Australian time zones across sub-accounts. AEST, ACST and AWST are not the same, and a 7pm send in Perth can be a 9pm send if your sub-account timezone is set to Sydney.
• Appointment reminders are the one place where slightly wider windows are defensible because they are service messages the contact expects. I cover the reminder timing logic in detail in my guide to appointment reminder Workflows that reduce no-shows.

Using Workflows as consent gates and suppression

The most reliable way to stay compliant is to make it impossible to send to someone who has not consented or who has opted out. You do that with gates inside your Workflows rather than relying on list hygiene.

Consent gate at entry

At the top of any SMS-sending Workflow, add an If/Else condition that checks a consent indicator — a "SMS consent" custom field set to yes at the form, or a sms-consent tag. Contacts without it exit the Workflow before any message step. This stops a stray import or a manually added contact from receiving messages they never agreed to.

Suppression check before every send

Before each SMS action, check that DND is not set and the sms-opted-out tag is absent. GoHighLevel respects DND on send, but adding the explicit check keeps your reporting honest and prevents the Workflow from continuing to process an opted-out contact through later steps.

Conversation AI

If you run Conversation AI on a number, make sure the bot itself recognises opt-out intent and hands off to the suppression Workflow rather than cheerfully replying to "stop messaging me". When I build booking bots — the kind described in my walkthrough on Conversation AI bots for appointment booking — opt-out detection is part of the bot's instructions, not an afterthought.

Message content that trips carrier filters

Even with perfect consent, content gets messages blocked. Australian carrier filters react to:

• Public link shorteners (bit.ly and similar) — use a branded short domain instead.
• All-caps words and excessive punctuation or emoji.
• High-risk keywords around finance, lending, crypto and gambling.
• Identical high-volume bursts from a cold number with no warm-up.

Write messages that read like a person sent them, include the business name, and keep one clear call to action. That tends to satisfy both the carrier filters and the "identify the sender" obligation at the same time.

Keeping records of consent

If ACMA ever asks, "successfully sent" is not evidence of consent. Keep the source. In GoHighLevel that means relying on the contact's recorded source, the form submission timestamp, and a consent custom field. For express consent captured at a form, the submission record is your proof. Retain it for the life of the relationship and a reasonable period after. Treating consent as data you can produce on request — rather than a checkbox you ticked once — is the difference between a quick response to a complaint and a problem.

Common mistakes to avoid

• Using an alphanumeric Sender ID for a campaign that asks people to reply, then wondering why no replies (or STOPs) arrive — alphanumeric is one-way only.
• Leaving opt-out handling on native defaults with no backup Workflow, so an unrecognised keyword slips through and the contact keeps receiving messages.
• Sending in Sydney time to contacts across the country, landing promos at 9pm in the eastern states and even later by local feel.
• Relying on inferred consent for cold lists scraped or imported from elsewhere — inferred consent is narrow and rarely covers bought data.
• Using public link shorteners that carriers associate with spam, then blaming GoHighLevel for low deliverability.
• Not recording the opt-out date, so you cannot demonstrate you actioned the request within five business days.
• Blasting a brand-new dedicated number at full volume with no warm-up, triggering carrier throttling on day one.

If you want your GoHighLevel SMS set up to stay compliant with ACMA rules and actually reach the inbox, book a strategy call with the HL Growth Partner team.

Book Your Strategy Call →

Frequently asked questions

Does Australia require A2P 10DLC registration like the US?

No. A2P 10DLC and The Campaign Registry are US-only. Australian senders do not register brands or campaigns to send SMS. However, Telstra, Optus and TPG run their own content and behaviour filtering, so you still need clean message content, a warmed-up number and good sending discipline to reach the inbox.

What is the difference between express and inferred consent under the Spam Act?

Express consent is where someone actively agreed to receive your SMS — typically by submitting a form that clearly stated SMS would follow, or by replying to confirm an opt-in. Inferred consent is narrower: it applies where there is an existing business relationship and the message is relevant to it, or where a business number was conspicuously published without a no-contact notice. For most GoHighLevel work, capture express consent at the form.

Can I use an alphanumeric Sender ID and still handle STOP replies?

Not by reply, because alphanumeric Sender IDs are one-way and recipients cannot text back. If you use one, you must provide an alternative opt-out method in the message body, such as an unsubscribe link or a number to call. For anything conversational, use a dedicated two-way long number instead.

How quickly do I have to action an opt-out?

Within five business days of the request. In GoHighLevel, set DND on opt-out, apply a suppression tag, and stamp an opt-out date custom field so you have evidence the request was actioned inside that window. A backup Workflow that catches opt-out keywords the native handler misses is strongly recommended.

Why do my GoHighLevel messages show as sent but never arrive?

"Sent" in the conversation view only confirms the message left LeadConnector, not that the carrier delivered it. Australian carriers silently filter messages with public link shorteners, high-risk keywords, all-caps content, or sudden bursts from a cold number. Warm new numbers up gradually, use a branded short domain, and write messages that read naturally to improve delivery.