Website Compliance Essentials in Australia: Privacy, Cookies and Data Transparency for Marketers

You run a website, collect enquiries and track visitors with a handful of tags. Then a customer asks whether your site meets Australian privacy, cookie and data rules, and you cannot answer with confidence. You are not alone.

Privacy law has changed quickly since 2024, and more changes land this December. This guide shows you which rules apply, what regulators now check, and how to audit your site.

Does the Privacy Act Apply to Your Business?

Start here, because your answer decides how much work you face.

The $3 Million Small Business Exemption Explained

The Privacy Act 1988 generally exempts businesses with annual turnover of $3 million or less. If you sit below that line, the Australian Privacy Principles (APPs) usually do not bind you.

The Government agreed in principle in 2023 to remove the exemption. However, the Tranche 2 exposure draft released on 31 August 2026 leaves it in place, so it still stands for now.

Who Is Caught Regardless of Turnover

Some businesses lose the exemption whatever their size. You are covered if you provide a health service, trade in personal information or run a credit reporting business.

Since 1 July 2026, accountants, lawyers, real estate agents and other businesses with anti-money laundering duties also fall under the Act for those activities. A small physio clinic, for example, is covered.

Exempt but Still Exposed: Privacy Tort, Spam Act and Consumer Law

Exemption does not end your risk. Since 10 June 2025, individuals can sue you over serious, intentional or reckless privacy invasions, and the tort applies to small businesses. The Spam Act covers every business that sends marketing messages. The Australian Consumer Law also bans misleading conduct, so a false “we never share your data” claim creates risk for you.

What Australian Law Requires of Your Website

Several laws overlap on your website, so knowing who enforces what helps you set priorities.

The Australian Privacy Principles That Matter Most for Websites

Six principles do most of the work. APP 1 requires a clear, current privacy policy. APP 3 limits what you collect. APP 5 requires a notice when you collect. APP 7 controls direct marketing. APP 8 adds duties when you disclose data overseas, including to overseas ad platforms. APP 11 requires you to secure data and destroy it when you no longer need it.

Who Enforces What: OAIC, ACMA and ACCC

Three regulators can contact you. The Office of the Australian Information Commissioner (OAIC) enforces the Privacy Act. The Australian Communications and Media Authority (ACMA) enforces the Spam Act and the Do Not Call Register. The Australian Competition and Consumer Commission (ACCC) enforces the Australian Consumer Law.

Penalties and the Real Cost of Non-Compliance

If you seriously or repeatedly interfere with privacy, you face a penalty of up to $50 million, three times the benefit you gained, or 30% of your adjusted turnover, whichever is greater.

A non-compliant privacy policy can draw a $66,000 infringement notice for a company. Breaches also hurt your budget, because IBM’s 2026 report puts the average Australian breach at A$4.22 million.

Privacy Law Changes in 2026: What’s in Force and What’s Coming

Some changes already bind you, some start this December, and others remain proposals.

Already in Force: Statutory Tort, Tiered Penalties and Infringement Notices

The Privacy and Other Legislation Amendment Act 2024 gave the OAIC lower-tier civil penalties and infringement and compliance notices. It also created the privacy tort.

Early in 2026, the OAIC reviewed about 60 businesses’ privacy policies. That sweep shows the regulator checks basic transparency, so treat your policy as a live document.

December 2026 Deadlines: Automated Decision-Making and the Children’s Online Privacy Code

From 10 December 2026, new APP 1.7 to 1.9 rules apply if the Privacy Act covers you. If a computer program uses personal information to make, or directly support, a decision that could significantly affect someone’s rights or interests, your privacy policy must say so.

The OAIC must also register the Children’s Online Privacy Code by that date. The draft targets online services likely to be used by children and requires parental consent for under-15s. If you personalise offers with AI, read our guide to AI-powered personalisation, privacy and consent in Australia.

Tranche 2 Exposure Draft: What Marketers Should Watch

The Government released the Privacy Amendment (Personal Data Protection) Bill 2026 as an exposure draft on 31 August 2026. It is not law yet. If it passes as drafted, you would need consent before you trade personal information, including through cookies and pixels in programmatic ads.

It would also cover targeted social and behavioural ads as direct marketing. If you buy programmatic advertising, map your data flows now.

Privacy Policies and Collection Notices That Comply

Your privacy policy is the first document a regulator reads, so it must match what your site actually does.

What Your Privacy Policy Must Include

APP 1 requires a clear, up-to-date policy. List the kinds of personal information you collect, how you collect it and why. Explain how people can access and correct their data and how they can complain.

State whether you disclose information overseas and, where practicable, name the countries. From December, add your automated decisions if they meet the test above.

Privacy Policy vs. Collection Notice

Your policy covers the whole business. A collection notice covers one moment, such as your quote form. APP 5 requires you to take reasonable steps, at or before collection, to tell people who you are, why you collect the data, who receives it and what happens if they withhold it. Place a short notice and a policy link beside every form.

Common Privacy Policy Mistakes to Fix Now

Copied templates often cause problems. Look for policies that never mention Meta Pixel or Google Analytics, “we never share data” claims while your ad tags do exactly that, and missing overseas disclosure. Fix any gap between your policy and your practice first.

Cookies, Tracking Pixels and Analytics

Cookies confuse many marketers because Australian law treats them differently from European law.

Is There a Cookie Law in Australia?

No. Australia has no cookie-specific statute and no GDPR-style rule that forces a consent prompt for every cookie. However, the Privacy Act still applies whenever your cookies or pixels collect personal information, and the OAIC published tracking pixel guidance in November 2024. Our guide to privacy-first measurement for paid media shows how to keep your reporting accurate.

When Cookie and Pixel Data Counts as Personal Information

Data counts as personal information when it relates to an identifiable or reasonably identifiable person. A pixel that sends an email address, a customer ID or browsing history linked to a profile meets that test.

Picture an online homewares shop: if its pixel sends a shopper’s email and cart contents to an ad platform, the shop discloses personal information. Tranche 2 would broaden the definition further.

Lessons From the OAIC Tracking Pixel Determinations

In June 2026, the OAIC found that Medmate and Monash IVF interfered with privacy through tracking pixels. Both breached APPs 3.3, 5.1 and 7.1. The OAIC ordered them to stop using the pixels until they had proper consent mechanisms.

The lesson for you is simple: a generic cookie banner does not cover sensitive information, so audit every pixel on any health-related page.

Do You Need a Cookie Banner? A Decision Framework

Ask yourself four questions. Do your ad pixels send personal data to third parties? Does your site collect sensitive information? Do children use it? Do you target EU or UK visitors? One “yes” means you should use a consent banner with equal-weight accept and reject buttons.

For EU and UK traffic, Google also requires Consent Mode v2 for its advertising features, usually through a Google-certified consent management platform. That is a platform rule, not an Australian law.

Expect lower tracked volumes afterwards, so read why last-click attribution fails service businesses before you judge results.

Email, SMS and Targeted Advertising Compliance

Marketing channels carry the clearest rules, so mistakes here are easy for regulators to spot.

Spam Act Essentials: Consent, Sender ID and Unsubscribe

The Spam Act requires consent, sender identification and a working unsubscribe in every commercial message. You must prove consent, and you cannot send a message to ask for it.

Honour unsubscribes within five working days and keep the link working for 30 days. Your CRM and retention platform should log consent and suppress opt-outs automatically.

Retargeting, Lookalike Audiences and Customer Match

These tactics share customer data with ad platforms, so APP 7 applies. You can generally use personal information you collected directly if people would reasonably expect marketing and you offer an opt-out.

If you collected it from someone else, or people would not expect marketing, each message must explain how to opt out. Sensitive information needs consent. See how Performance Max and Advantage+ use your customer data before you upload lists.

Data Sharing With Agencies and Ad Platforms: Who Is Responsible?

You stay accountable. Under the Spam Act, even when someone else sends your messages, you still need consent. Write data-handling terms into every agency and platform contract, and ask where each supplier stores audience lists. Put the same questions to your PPC agency.

How to Audit Your Website for Compliance

A structured audit shows you where your real risks sit before a regulator or customer finds them.

Map Your Data and Scan Your Tracking Stack

List every place your site collects data, such as forms, checkout, live chat, bookings and analytics. Then scan for tags, cookies and pixels with a browser tool or cookie scanner. Record what each tag collects, where it sends data and who owns the account.

Review Forms, Notices and Consent Language

Check each form for a collection notice, a policy link and an unticked marketing box. Remove bundled consent, where one tick covers several purposes. Our web design and development team can rebuild forms and consent banners so they stay easy to use.

Check Vendors, Breach Readiness and Retention

List every vendor that holds customer data, including your CRM, email platform and plugins, and confirm where each stores it. If the Privacy Act covers you, the Notifiable Data Breaches scheme requires you to assess a suspected breach within 30 days. Then set a retention rule, because data you delete cannot leak.

Prioritise Fixes and Schedule Reviews

Rank your findings by risk. Fix sensitive data collection and missing unsubscribe links first, then notices, then policy wording. Review your site every six months and after any new tool, campaign or law change.

Working With an Agency on Compliance

Compliance spans marketing, web and legal work, so clear roles save time.

What Your Marketing Agency Should Handle (and What It Shouldn’t)

A good agency audits your tags, configures consent tools, cleans your lists and documents your data flows. It should not give legal advice or certify your policy as compliant. If you want help with the technical and marketing side, Conquerra Digital can run the audit with you and flag where you need a lawyer.

When to Bring in a Privacy Lawyer

Call a privacy lawyer if you handle health data, serve children, send data overseas at scale or suspect a breach. Also involve one before you rewrite your policy for the December changes. You supply the data map, and the lawyer judges the legal position.

Your 30-Day Website Compliance Action Plan

In week one, map your data and scan your tags. In week two, fix your forms, notices and privacy policy. In week three, adjust consent and tracking. In week four, check email, SMS and vendor terms, then diarise your reviews. If you want a second opinion, contact our team.

FAQs