The useful part of digital sovereignty is not theory. It is control you can actually enforce.
My view is simple: if you want more online freedom in Australia, start with direct marketing you did not ask for and can stop. Most people reach for the wrong tool. They file broad privacy complaints, argue on the phone, or block one sender while ten more keep coming.
In many cases, the better first move is the Spam Act 2003 (Cth), enforced by the Australian Communications and Media Authority (ACMA). If the message is a commercial electronic message, the sender generally needs consent, sender identification, and a working unsubscribe facility. That unsubscribe must remain functional for at least 30 days after the message is sent, and unsubscribe requests must usually be honoured within 5 working days.
That is not abstract digital-rights talk. That is a specific rule, a regulator, and a deadline.
Shane St Reynolds has spent years dealing with online harm, content removal and cyber issues. One lesson keeps repeating: the person who knows which legal lever to pull first usually gets a better result than the person with the loudest grievance.
What counts as a commercial electronic message
The Spam Act covers more than email. It also applies to SMS, MMS and other commercial electronic messages with an Australian link. If the purpose is to offer, advertise or promote goods, services, land, business opportunities or investments, treat it as potentially covered.
Three concrete checks matter:
- Consent: Did you actually agree to receive these messages, or is the sender relying on inferred consent from an existing relationship?
- Identification: Does the message clearly identify the individual or business who authorised the sending?
- Unsubscribe: Is there a functional electronic unsubscribe facility?
If one of those is missing, the sender may have a problem.
A common mistake is assuming, “I once bought something from them, so they can message me forever.” No. Existing dealings can support inferred consent in some circumstances, but they do not cancel the unsubscribe rules. Once you opt out, that request must be processed.
The 5-day rule is where most people regain control
The counter-intuitive point is this: the strongest part of the regime is often not whether the first message should have been sent. It is whether the sender keeps going after you have opted out.
That is where readers usually lose time. They click unsubscribe, then they delete the next five messages without preserving evidence. Then, weeks later, they cannot prove when they opted out or what happened after.
If you care about digital sovereignty, treat your unsubscribe like service of a legal notice. Create a record.
A practical 10-minute evidence process
- Open the message and identify the sender. Save the full email header if possible, or screenshot the SMS showing the sender ID or number.
- Use the unsubscribe facility once. Click the link, reply STOP if instructed, or use the stated method exactly as written.
- Capture proof. Screenshot the unsubscribe page, confirmation message, or sent SMS reply.
- Record the date. Note the day you opted out. The key period is 5 working days.
- Do not engage in side arguments. Do not ring the call centre to debate consent unless necessary. Preserve the clean opt-out record.
- Keep every further message after day 5. Screenshot each one with date and time visible.
- Check whether the unsubscribe link still works. The facility should remain functional for at least 30 days after the original message was sent.
- Lodge a report with ACMA. Use the evidence bundle, not a rant.
That process gives you something regulators and internal compliance teams can assess quickly.
Exact wording you can copy
If there is no working unsubscribe, send one direct reply and keep it short:
Remove this address/number from all marketing and promotional messages immediately. I withdraw any consent to receive commercial electronic messages. This opt-out request is made on [date].
If messages continue after 5 working days, add this:
I opted out on [date]. You have continued sending commercial electronic messages after the opt-out period. Confirm removal from all marketing lists and any related databases used on your behalf.
The phrase “used on your behalf” matters. Many businesses outsource campaigns. You want the principal business to deal with the whole chain, not just one sending platform.
When the Privacy Act matters, and when it is the wrong first move
The Privacy Act 1988 (Cth) and the Office of the Australian Information Commissioner (OAIC) do matter. If an organisation mishandles your personal information, uses it for direct marketing in ways that breach the Australian Privacy Principles, or refuses a proper opt-out in circumstances covered by privacy law, those are real issues.
But a lot of Australians make this harder than it needs to be. They jump straight to “privacy breach” without first using the more targeted anti-spam rules. For email and SMS marketing, ACMA is often the sharper first regulator because the complaint is narrower and easier to evidence.
The OAIC is still relevant where the conduct goes beyond spam: unauthorised disclosure, refusal to give access to personal information, failure to correct records, or broader misuse of data. If the problem is reputational harm, impersonation, doxxing, or harmful online material, other tools may fit better, including content-removal steps through Takedown or broader commentary and analysis through Shane’s law and justice writing.
Questions to ask before you complain
- Was the message commercial? Be precise. Regulatory complaints improve when the category is clear.
- Did I opt out using the method they provided? If yes, on what date?
- Has 5 working days passed? Weekends do not count as working days.
- Do I have screenshots? No screenshots, weaker complaint.
- Is the sender clearly identified? Anonymous or vague sender details are a red flag.
- Is there a functioning unsubscribe? If the link is dead or the reply path fails, that matters.
- Am I dealing with one business or a lead-generation chain? If several brands are involved, identify each one.
Those seven questions sort the issue faster than pages of outrage.
The mistake businesses make, and why it matters to you
Many businesses think buying a list, scraping addresses, or relying on old consent is a marketing issue. It is also a governance issue. Boards and owners should care because regulatory findings on spam and data practices are not just annoying; they are evidence of poor internal controls.
If you run a business, ask your marketing team three blunt questions:
- Show me how consent was collected.
- Show me how opt-outs are recorded across all platforms.
- Show me how third-party senders are supervised.
If they cannot answer, the exposure is already there.
This is one reason digital sovereignty is not only personal. It is institutional. A country does not remain free online if ordinary people are constantly pushed around by systems no one audits.
What to do when the messages are tied to search harm or reputational damage
Sometimes the marketing itself is not the real problem. The real problem is what happens when your name, business or mobile number has been harvested, indexed or circulated across sites you never dealt with directly. At that point, unsubscribe rights may stop only one stream of traffic.
Then you may need parallel action: identify the source, send removal requests, preserve search evidence, and work out whether the issue is spam, privacy, platform abuse, impersonation, or defamation. That is where a proper strategy matters more than another angry email. If this area interests you, the broader argument about escaping manipulative digital systems is touched on in EX MATRIXE LIBER SUM.
General information only
This article is general information, not legal advice for your specific facts.
Book a consultation if the problem is persistent or wider than spam
If you are dealing with repeated direct marketing, online harm, reputation damage, or a platform refusing to act, I can help you work out which lever to pull first and what evidence to preserve.
Book a consultation at https://shanestreynolds.com/contact, email [email protected] or call 08 6263 6236.