AI Cold Calling in Australia: What the Rules Allow and Where the Lines Are

Australian law doesn't ban AI cold calling. An AI voice agent can make outbound sales calls, but it has to follow the same telemarketing rules as a human caller, and in a few places the rules are stricter because the voice is synthetic. In practice that means washing your list against the Do Not Call Register, having consent you can prove where you rely on consent, saying who is calling and why as soon as the call starts, calling only at permitted times, and respecting cooling-off rights when a sale comes from an unsolicited call.

This article covers each of those for businesses thinking about outbound prospecting. It also explains why calling someone who has never contacted you is legally very different from calling back someone who just made an enquiry.

Cold outreach versus answering enquiries

When people talk about "AI calling", they usually mean one of two quite different things:

• Cold outreach: calling people who haven't asked to hear from you, often from a bought or scraped list.
• Enquiry follow-up: calling someone who has just filled in a form, asked for a quote or asked to be contacted.

The second is far easier to defend. The person reached out, the purpose of the call is clear, and you can usually show consent. Cold outreach is where most of the compliance risk sits: the Do Not Call Register, inferred consent, identification rules and unsolicited-sale cooling-off periods all apply most heavily there. If you're weighing up AI for outbound, it helps to be honest about which kind of calling you're actually planning.

Do Not Call washing: what it covers and what it doesn't

The register doesn't block calls. It's a list that businesses check their calling lists against, so they can remove registered numbers before dialling. If you skip that step, the AI will dial whatever you give it.

Which numbers can be registered

Home numbers, personal mobiles and fax numbers can be added to the register, but business numbers can't. A phone used for both business and personal calls can be registered as long as personal use is more than 50% of total use. So a sole trader's mobile in a B2B list may well be on the register. Don't assume a list is "business only" and skip the wash.

Registration is free, only needs doing once, and stays in place indefinitely unless the owner removes it. Old lists don't age out of the problem.

The 30-day window

Once a number has been on the register for 30 days, telemarketers can only call it with consent or if the caller is exempt. Calling a registered number isn't a breach if you washed your list in the previous 30 days and the number wasn't registered at that time. That gives you a working rule: wash at least every 30 days, keep a record of each wash, and don't load an unwashed list into an AI dialler.

The exemptions are narrow. They cover groups such as government organisations, registered charities, educational institutions calling current or past students, registered political parties, members of parliament and election candidates. A typical commercial business won't fall into any of them.

Why a published number is not consent

A common shortcut goes like this: "Their number is on their website, so they're happy to be called." The law says otherwise. Under the Do Not Call Register Act, consent can't be inferred merely because a phone number has been published.

Consent under the Act means express consent, or consent that can reasonably be inferred from the person's conduct and their business and other relationships. Inferred consent depends on a real relationship or conduct. A number found in a directory or on a website isn't enough. If a scraped number turns out to be on the register, its being public won't protect you.

Consent that holds up

If your outbound plan relies on consent, you need consent you can prove. The ACMA expects consent records to show how consent was obtained, the terms that applied, and the date and time it was obtained, and those records must be produced if the ACMA asks.

Some practical points:

• Consent expires. Express consent not given for a set or indefinite period is taken to be withdrawn 3 months after it was given, and the ACMA treats consent older than 3 months as stale unless the person agreed to a longer period under terms and conditions.
• Make the terms clear. The ACMA recommends express consent based on clear, readily accessible terms explaining what the marketing is for, who will use it, how long it will be used and how to withdraw.
• Avoid shortcuts. Don't use pre-checked tick boxes, bundled consent or refer-a-friend arrangements.
• "Stop calling" means stop now. If someone says they don't want calls from you, consent ends immediately and can no longer be inferred.

For AI calling, that last point is a system requirement. The agent has to recognise an opt-out, end the call, and write it back to your CRM so nobody, human or AI, dials that number again.

What an AI voice must say at the start of the call

This is where AI calling differs from human calling. Under the telemarketing standard, as soon as the call starts the caller must give their given name (unless the call is made solely using a recorded or synthetic voice), the business name of their employer, the name of the person causing the call to be made, and the purpose of the call.

A fully synthetic agent doesn't need to give a personal name. It does still have to open with the business, who the call is for and why it's calling. Script that opening first, before any pitch.

If asked, the caller must immediately give the contact details of the employer and of the person who caused the call, plus the name and contact details of whoever handles inquiries or complaints. And where recorded or synthetic voices are used, you must provide a way during the call to request those details, for example by pressing a button to talk to an operator. Before you go live, check that your AI setup has a working escalation path or a reliable way to give those details on request.

Calling times and hanging up when asked

The standard sets permitted calling times. Calls outside them are allowed only if the account holder or their nominee gave express consent in advance to that particular call on that day or at that time, and you can show this to the ACMA. An AI dialler can call around the clock, so lock calling windows into its configuration and account for time zones across states. Check the current hours with the ACMA rather than relying on memory.

Consumer Affairs Victoria says telemarketers must hang up immediately at the consumer's request and not call back for at least 30 days. An AI that keeps pitching after a "no" creates both a compliance problem and a reputation problem.

Cooling-off rights when the sale was unsolicited

If your AI cold calling actually closes sales with consumers, consumer law applies as well. The ACCC's examples of unsolicited sales include a salesperson phoning a consumer to sell a product, contacting someone who gave their details for another purpose such as a competition, and a consumer returning a salesperson's missed call. That last example matters for AI diallers that leave missed calls: a callback from the consumer doesn't turn the sale into a solicited one.

Consumers who enter an unsolicited consumer agreement have 10 business days to change their mind, starting the first business day after they sign or receive the agreement. That period extends to 3 months if the salesperson calls outside allowed hours, doesn't give their name or the business's name and address, or doesn't say why they're calling. So a sloppy AI opening is more than a telemarketing breach. It can also leave a sale open to cancellation for months. There are further requirements around agreement documents and disclosures, so get advice from a lawyer before you close consumer sales over the phone.

If a vendor makes the calls for you

If a third party makes telemarketing calls on your behalf, your contract must include express provisions requiring compliance with the Do Not Call Register Act. Ask any provider:

• Who washes the list, how often, and where are the wash records kept?
• How are opt-outs captured and synced back to us?
• What does the agent say in the first seconds of the call?
• How can a recipient reach a human or get complaint details?
• How are calling hours enforced across time zones?
• Where are consent records and call recordings stored, and can we export them?

A practical checklist before you start

• Decide whether you're doing cold outreach or enquiry follow-up, and design around that.
• Wash every list against the register at least every 30 days and keep the evidence.
• Don't treat published numbers as consent.
• Record how, when and on what terms consent was given, and retire stale consent.
• Script the opening: business name, who the call is for, purpose.
• Build in a way to reach a human or get contact and complaint details.
• Enforce calling windows and immediate opt-outs.
• Get legal advice on cooling-off obligations if you close consumer sales on the call.

Where AI fits best

For most businesses, the strongest and lowest-risk use of AI calling isn't cold prospecting. It's reaching people who have already raised their hand, quickly. Dialessa is an AI voice agent that calls new enquiries within a minute, books the appointment, and follows up past leads whose consent is still current, so the speed advantage goes into conversations people asked for. If you're still set on cold outreach, the rules above are workable, but test your setup against them and check anything you're unsure of with the ACMA or a lawyer before you scale.