Australia's Do Not Call Register and AI Voice Calls: What the Law Requires (2026)
Australia's Do Not Call Register rules focus on telemarketing calls made to Australian numbers. A genuinely inbound AI receptionist usually sits outside that activity because the customer called the business. But direction alone is not a complete compliance test: an outbound callback, sales follow-up, recorded message, market-research call, SMS, or email may be governed by a different rule, consent exception, or industry standard.
The Do Not Call Register Act 2006 does not create a special exemption merely because software or an AI-generated voice places the call. Classify the purpose, recipient, number, consent, exemption, content, and channel before launch. This guide explains the practical boundary between Trillet's inbound-only D2C receptionist and a separately reviewed outbound campaign. It is general information, not legal advice; use ACMA's current telemarketing and e-marketing guidance and obtain advice for the actual campaign.
What the Do Not Call Register Actually Governs
The Do Not Call Register is a national opt-out register for eligible Australian telephone and fax numbers. ACMA's current consumer guidance says home numbers, personal mobile numbers, and fax numbers may be registered. A business number is not ordinarily eligible, although a number used more than 50% for personal purposes may be. ACMA also says telemarketers generally may call a registered number after it has been listed for 30 days only if consent or an exemption applies.
Businesses commonly "wash" outbound lists against the register before telemarketing. That check identifies registered numbers, but it is not the entire legal analysis. The caller must also determine whether consent is current, whether an exemption actually applies, who is responsible when a service provider calls on its behalf, and which records prove the decision. A number being absent from the register does not remove the separate calling-time, identification, caller-ID, termination, privacy, or consumer-law requirements.
The register does not cover SMS or email; commercial electronic messages sit under the Spam Act 2003. It also does not replace the rules that apply to telemarketing and research calls regardless of whether the destination number is registered. Keep the register check, consent evidence, calling script, source list, suppression history, and vendor instructions as separate controls.
Does the DNCR Apply to AI-Generated Voice Calls?
An outbound call does not escape the law because the speaking voice was generated by AI. The legal classification turns on the call's purpose and content, the destination, consent or exemption, and the parties responsible for making or authorising it. An AI system promoting goods or services to consumers should therefore be assessed as telemarketing rather than treated as a new unregulated channel.
The telemarketing industry standard adds operational duties such as permitted calling times, caller identification, contact information, caller-ID transmission, and ending the call when requested. Research calls also have rules even though their purpose may differ from sales. Do not infer that a number absent from the register can be called at any time or with an anonymous automated voice.
A receptionist answering a call that a customer placed to the business is ordinarily not making a telemarketing call to that customer. However, the later workflow can change the analysis. A requested appointment confirmation is different from an unsolicited promotional follow-up. A callback may be covered by the caller's request or consent, but it still needs a lawful, documented scope. A marketing SMS sent after an inbound call is not converted into a transactional message simply because the relationship began inbound.
What to do: map every step after the incoming call. Record whether the customer requested a callback or message, what they agreed to receive, which number or address may be used, and when consent can be withdrawn. For U.S. calls, use the separate FCC AI voice call regulations guide; do not assume Australian consent or register checks satisfy another country's law.
ACMA's Role and the Penalties for Getting It Wrong
ACMA administers the register and enforces Australia's telemarketing and spam rules. Available responses depend on the legislation and conduct and can include warnings, infringement notices, enforceable undertakings, Federal Court proceedings, and substantial financial penalties. Current maximums and enforcement outcomes can change, so use ACMA's current enforcement material rather than copying an old penalty figure into a risk assessment.
Responsibility does not disappear when a business outsources calling. The Trillet Terms similarly make the customer responsible for lawful basis, consent, suppression lists, opt-outs, disclosures, calling times, scripts, and recipient classification. High-volume or regulated outbound campaigns may require additional review, carrier registration, written approval, or a separate agreement.
For a small business, the practical takeaway is scope control. A genuinely inbound receptionist avoids the list-washing issue for the answered call, but privacy, recording, AI disclosure, consumer protection, and industry-specific obligations can still apply. Before any outbound campaign, identify the purpose and recipients, wash the list where required, document consent or exemption, apply the industry standard, and obtain advice on uncertain cases.
Where the Spam Act 2003 Fits In
The Spam Act 2003 governs commercial electronic messages such as marketing SMS, email, and some instant messages, rather than ordinary voice calls. ACMA's current spam guidance tells senders to obtain consent, identify the sender, and provide a functional unsubscribe facility. The business remains responsible when a platform or marketing provider sends on its behalf.
Content and purpose matter. A requested appointment confirmation that contains only necessary service information may be treated differently from a promotional follow-up, but adding an offer can change the analysis. Do not label a message "transactional" solely because it was triggered by an inbound call. Keep proof of the request or consent, identify the sender, make marketing opt-out effective, and honour withdrawal across connected systems.
Trillet D2C supports configurable SMS follow-up, but SMS is separately billed and requires an appropriate consent workflow. An emailed call summary sent to the business is not permission to market to the caller. Review templates and destinations before launch.
Inbound AI Receptionist vs. Outbound AI Campaign: The Line That Matters
Direction is the useful first question, not the only question.
| Workflow | Starting position | What to verify |
|---|---|---|
| Customer calls the business; AI answers | Ordinarily inbound reception, not a telemarketing call made to the customer | Recording and AI notices, privacy, approved data, industry rules, fallback |
| Customer asks for a callback | Documented requested follow-up may support the call | Scope, timing, number, consent withdrawal, whether promotional content is added |
| Business calls a lead to promote services | Assess as outbound telemarketing | Register status, consent or exemption, industry standard, caller ID, scripts, opt-out |
| Market or social research call | Different purpose from sales, but still subject to applicable industry-standard rules | Calling times, identification, termination, purpose, commissioned caller |
| Promotional SMS or email | Commercial electronic message | Consent, sender identification, unsubscribe, suppression records |
This table is a triage aid, not a substitute for the statutory definitions.
Trillet D2C is inbound-only. It can answer calls that reach its configured route, including through missed, busy, declined, or all-call forwarding, subject to the carrier and setup. It does not include outbound campaigns. That reduces the relevance of register washing to the answered inbound call but does not make the subscription automatically compliant with every recording, privacy, disclosure, or professional rule.
The Trillet AI Receptionist is $49/month with 150 included voice minutes and $0.20 per additional minute. SMS and applicable telephony or number charges are separate. The plan has a 28-day plan money-back guarantee under its terms. Trillet holds SOC 2 Type II and ISO 27001 certifications, but those do not guarantee that a customer's calling or messaging workflow complies with ACMA, the DNCR Act, the Spam Act, GDPR, HIPAA, TCPA, or another regime. For Australian privacy questions, see the Privacy Act guide for AI answering services.
A Practical Compliance Posture for 2026
The right posture depends on the complete workflow. Inbound answering may avoid the outbound telemarketing rules for that call, but it can still involve personal information, recordings, messages, regulated data, or a later outbound contact.
Inbound AI receptionist (answering missed calls):
- Document that the workflow is inbound-only and identify any callback or messaging exceptions.
- Use the AI and recording notices required for the call and jurisdiction; do not imply the AI is human where that would be deceptive.
- Determine which privacy, surveillance-device, professional, and sector rules apply to recordings and personal information.
- Minimise collection, restrict summary recipients, set retention, and keep a human fallback.
- Keep requested confirmations factual and do not add marketing without the required consent and unsubscribe path.
Outbound AI calls or messages (do not attempt without advice):
- Classify the call from its purpose and content rather than assuming every outbound call is identical.
- Check the number against the register where required and document the consent or exemption relied on.
- Follow applicable calling times, caller identification, caller-ID, termination, suppression, and opt-out requirements.
- Approve the script, recipients, lawful basis, AI/recording notices, escalation, and evidence before launch.
- Apply the Spam Act separately to commercial SMS and email.
- Use qualified advice for a high-volume, regulated, debt-collection, financial, healthcare, political, or otherwise sensitive campaign.
Frequently Asked Questions
Does the Do Not Call Register apply to my AI receptionist?
A genuinely inbound receptionist is ordinarily not making a telemarketing call to the customer, so register washing is not normally relevant to that answered call. Privacy, recording, AI disclosure, consumer, and industry rules may still apply. A later callback, promotional call, SMS, or email must be classified separately.
Are AI-generated voice calls legal in Australia?
There is no single permission covering every AI voice call. Inbound reception, requested callbacks, outbound sales, research, debt collection, and regulated communications have different rules. AI does not create an exemption from the DNCR Act or industry standard. Confirm purpose, consent, register status, notices, timing, identification, and any sector law.
What is the penalty for calling numbers on the Do Not Call Register?
Penalties and enforcement options depend on the contravention and can be substantial. ACMA can investigate and use statutory enforcement tools, including infringement notices, enforceable undertakings, and court proceedings. Check the current legislation and ACMA enforcement material for the amount and rule relevant to the conduct; do not plan from an old headline maximum.
Does the Spam Act cover AI voice calls?
The Spam Act governs commercial electronic messages such as marketing SMS and email, not ordinary voice calls. Voice telemarketing is assessed under the DNCR framework and applicable industry standard. A platform using both channels must assess them separately; a promotional SMS generally needs consent, sender identification, and a working unsubscribe facility.
Does Trillet's AI receptionist handle Australian compliance?
Trillet D2C is an inbound-only receptionist and provides tools that can support a configured workflow. It does not guarantee ACMA, DNCR, Spam Act, GDPR, HIPAA, or TCPA compliance. The customer remains responsible for consent, notices, scripts, recording, privacy, suppression, opt-outs, regulated data, and supervision. SOC 2 Type II and ISO 27001 are security certifications, not calling-law approvals.
Updated September 2026: Replaced the direction-only compliance test with a workflow test; clarified register eligibility, consent, industry-standard and Spam Act duties; removed automatic compliance, stale penalty, and cross-regime claims; aligned D2C pricing, SMS, and customer responsibility with the public Terms.
