Australian privacy law changes: what they mean for your website, tracking and forms

Start by checking which privacy obligations apply to your business and what your website collects and shares. Some reforms are in force now, and automated decision disclosures start on 10 December 2026. Other measures are still drafts. Review your tracking, forms and vendors now, with legal advice where the answer depends on your circumstances.

This guide is general information. Whether a rule applies to you needs legal review. An APP entity is an organisation or agency bound by the Australian Privacy Principles (APPs).

What has changed and what is still proposed

Australia's privacy rules are changing in stages. Each stage has a different legal status. Note the date whenever you check. This status was checked in October 2026:

The Privacy and Other Legislation Amendment Act 2024 became law on 10 December 2024. Most of its first stage changes took effect the next day. Its automated decision changes start on 10 December 2026. So the Act has more than one start date.

The last two dates are different events. The code's obligations start on a date still to be set.

Enforcement and the privacy tort

The statutory tort commenced on 10 June 2025. It covers intruding on someone's seclusion and misusing information about them. It can apply beyond APP entities.

Under the 2024 Act linked above, the invasion must be serious and intentional or reckless. The person must have had a reasonable expectation of privacy. The public interest in privacy must also outweigh competing interests.

Negligence alone isn't enough. Defences and exemptions apply too, including consent and lawful authority.

The Privacy Act's first civil penalties came in October 2025. The Federal Court ordered Australian Clinical Labs to pay $5.8 million for the Medlab breach:

The Office of the Australian Information Commissioner (OAIC) is the privacy regulator. Its announcement says those penalties used the earlier regime, with a lower maximum.

Today, a company's maximum for a serious interference is much higher. It's $50 million or three times the benefit obtained, whichever is greater. Where the benefit can't be worked out, 30% of adjusted turnover replaces the benefit figure. Adjusted turnover has its own definition in the Act.

The 2024 Act also added lower penalty tiers and infringement notices. They cover some less serious breaches, such as an unclear or out of date privacy policy. Treat the maximums above as context, not a forecast.

When you read about privacy enforcement, check which kind of outcome it was:

• a court penalty, like the Medlab order

• compensation paid to affected people

• a settlement agreed between the parties

• a regulator's determination, like the June 2026 pixel findings covered below

• an allegation that no court or regulator has decided

Which businesses and activities are covered

Turnover is only the start of the coverage question. OAIC guidance treats a small business as one with annual turnover of $3 million or less. Many are outside the Privacy Act. Some are covered regardless of turnover, including:

• health service providers

• businesses trading in personal information

• Commonwealth contracted service providers

• businesses related to one the Privacy Act covers

• businesses that choose to opt in

Turnover counts income from all sources. A business without a full year of trading projects its full year figure. The OAIC's checklist helps, though it isn't legal advice.

A newer ground started on 1 July 2026, under anti money laundering and counter terrorism financing (AML/CTF) law. Small businesses that become AML/CTF reporting entities are covered for activity tied to those duties. Customer due diligence is one example. That coverage doesn't reach their unrelated activities unless another ground applies.

The change can affect real estate agents, lawyers and accountants who provide designated services. Not every accountant or lawyer is covered just because of their profession. This AML/CTF change is separate from the privacy reform draft, and neither has removed the small business exemption.

Other rules can still apply, like state health privacy laws, surveillance laws and contracts. The small business exemption also doesn't permit misleading privacy promises. A qualified reviewer should handle questions across several jurisdictions.

What the August 2026 draft would change

The next big change is still a proposal. The government's privacy reform consultation opened on 31 August 2026 and closed on 18 September. It covered an exposure draft, the Privacy Amendment (Personal Data Protection) Bill 2026. The department says the Bill remains subject to further consideration by government.

The department's privacy reform consultation paper describes these website relevant proposals:

The detail behind three of those rows:

• Personal information would cover anything that "relates to" a person. Someone could be identifiable without a name.

• Every direct marketing message would need a simple way to opt out. Group targeting using personal information would count as direct marketing.

• Most APPs wouldn't apply to processors acting on documented instructions. APP 1 and APP 11 still would.

The draft doesn't simply require consent for all advertising. Its direct marketing rules and its proposed consent for trading personal information do different jobs. The Spam Act's rules for emails and texts are a separate matter. The draft keeps the small business exemption.

The proposed 72 hour period would run from awareness of reasonable grounds to believe an eligible breach occurred. It isn't current Australian law. The current process sits in the breach section below.

Useful preparation now includes building an inventory, cutting data you don't need and recording decisions. Don't implement a draft clause as though Parliament had passed it.

What the children's privacy code draft means

A children's privacy code is coming. Its final form isn't settled yet. The OAIC released an exposure draft of the Children's Online Privacy Code on 31 March 2026. Consultation closed on 5 June.

The OAIC must register the final code by 10 December 2026. The draft itself leaves its commencement date to be drafted.

The draft concerns children, meaning people under 18. It would bind:

• APP entities providing online services that children are likely to use, or that mainly involve children's activities

• some other providers of services mainly about children's activities, unless they provide a health service

The service types come from online safety law. One of them, designated internet services, includes most apps and websites. Social media sits in a separate category. Even so, the draft isn't a rule for every website a child might visit. Carriage service providers are excluded.

Proposed themes include:

• high privacy settings by default

• handling that serves the child's best interests

• age appropriate explanations and controls

• consent and its withdrawal

• requests about a child's information

• privacy impact assessments, with a published register

• staff training at least once a year

Under its consent rules, the draft lets a child consent from age 15, with exceptions. That isn't a general Australian age of consent. It's also separate from the social media minimum age scheme. Instead of checking every user's age, a service could apply the code's protections to all users.

Don't start collecting identity documents from every visitor on the strength of a draft. Work through what the service actually does. For an example tutoring service for teenagers, that might mean asking:

• Can students message tutors or share files?

• Does joining need a birth date or school, or just an email?

• Do ad pixels or monitoring tools belong on lesson pages?

A lawyer still needs to assess real coverage against the final code.

Prepare for automated decision disclosures

From 10 December 2026, some privacy policies need new detail about automated decisions. The OAIC explains the trigger. It applies where an APP entity arranges for a computer program to make a decision using personal information. It also covers a program doing something substantially and directly related to making that decision.

The decision must be one that could reasonably be expected to significantly affect a person's rights or interests. Automation alone doesn't trigger the duty.

Test the conditions against real systems. These are example prompts, not verdicts:

Human review may not remove a decision from scope if the program stays substantially and directly involved. Software that only records a decision a person made is a different matter. For each system, record:

• the system and what it does

• the personal information it uses

• the decision it makes or informs

• the possible significant effect

• the human role

• the policy owner

Privacy policies and website terms sets out the required disclosure content. The new rule is about transparency. It doesn't create a general ban, or a right to demand human review. Get legal sign off on whether it applies and on the wording.

Tracking, pixels and remarketing

Inspect every tracking tool on the site, including:

• GA4 and other analytics

• Google Ads and other ad tags

• the Meta Pixel and similar pixels

• CRM (customer relationship management) integrations

• remarketing audiences

Vendor names alone tell you little. For each tool, work through what happens to the data:

Start by tracing one route:

This example route is the simple part. Map email copies, logs and any advertising disclosures alongside it.

The OAIC's tracking pixel guidance dates from 4 November 2024. It puts responsibility on the business that deploys a pixel. Pixel data can identify someone when matched with platform data, even through a hashed (scrambled) email address. Sensitive information should only be collected with express consent, and generally shouldn't reach third party platforms.

In June 2026, the OAIC found privacy breaches by telehealth provider Medmate and fertility clinic Monash IVF. The determinations are dated 11 June. Tracking health website visitors to target them with social media ads was found to be collecting sensitive information. Those are findings about the cases examined. They aren't a blanket ban on analytics or a fine on every healthcare site.

Consent doesn't erase your other duties or a platform's own restrictions. Opting out alone won't fix sensitive tracking. An ordinary page address plus an identifier can reveal health context, so review:

• event names

• page titles and query strings

• referrers

• form text

• customer identifiers

Never send raw health, legal or financial enquiry text to general advertising analytics.

Server side tracking and conversion APIs belong on the map too. Browser checks won't show what they send. Hashed identifiers sent this way can still be matched to people. A first party endpoint can still forward data to an outside platform. Check where the data ends up and whether the law and the vendor's rules allow that use.

Setup detail lives in conversion tracking setup and GA4 for small businesses. Remarketing audiences need the same scrutiny.

Call tracking and session replay

Call tracking covers several different things:

• dynamic number insertion, which swaps the number a visitor sees

• call metadata, like time and duration

• recorded audio

• transcripts

Each creates different information and risk. A recording announcement doesn't automatically satisfy every Australian surveillance or listening device law. Ask your legal reviewer which state laws apply and what notice or consent they need.

Decide who can access recordings and how long you keep them. Offer another way to make contact where the approved process requires it. Operational detail sits with call tracking.

Session replay records how visitors use a page. Test its masking with dummy content. Default settings may miss custom fields, embedded frames or details in page addresses. Exclude sensitive intake pages where the approved design needs it.

AI transcription, chat summaries and vendor model training terms belong in the inventory if you use them. An ordinary analytics contract may not cover optional AI features.

Consent tools and cookie banners

A banner is only as good as what happens behind it. Whether you need consent depends on:

• your privacy duties

• how sensitive the information is

• the purpose

• overseas laws that apply to you

• platform terms

A notice isn't consent, nor can a banner cure an unlawful disclosure. Four different things often get blurred together:

• the consent management platform (CMP) screen visitors see

• the choice it records

• the tag blocking that enforces the choice

• the Google consent mode signal

Google consent mode has two forms. Basic mode stops Google tags loading until a visitor interacts with the banner. In advanced mode, tags load straight away and send measurements without cookies while consent is denied. The right setup depends on your approved legal and technical design.

Google says you're responsible for getting consent. It also says third party tags should follow the visitor's choice. Test the whole implementation like this:

Check each state against the design:

For each state, record the requests you actually saw and any fix you made.

Use a technically competent tester with approved access. Never use real visitors' data for a demonstration. Check that refusal and withdrawal stay easy on a phone.

Include embedded tools like maps, video and chat. Check anything your server forwards too. Tags without built in consent checks need their own settings, for example in Google Tag Manager. A common mistake is checking that the banner appears and stopping there. Test what the tags do.

Choose a tool by your requirements and its real integration support. A certification or a consent mode integration isn't a legal compliance certificate. Banner design also raises consumer law questions. Clear choices and consumer law works through them.

Forms, notices and the data lifecycle

Forms collect the data you're most directly responsible for. Under APP 5, an APP entity takes reasonable steps to notify people at or before collection. If that isn't practicable, it notifies them as soon as practicable afterwards. For a normal web form, plan the notice at the point of collection.

Three documents do different jobs:

• A privacy policy describes your general practices.

• A collection notice explains this particular collection.

• Consent, where it's needed, covers a particular proposed use.

A common mistake is assuming a privacy policy link does the collection notice's job. Ticking "I accept the privacy policy" doesn't authorise every later advertising use either. Use a drafting record like this, and let a reviewer decide what's needed in context:

Ask only for what you need. Don't invite sensitive details in a general enquiry box. A warning helps. It won't stop accidental disclosure or replace secure intake. Keep optional marketing separate from the enquiry itself.

Form design covers minimal, usable fields. Email and SMS rules sit in the website compliance checklist. Then follow each copy of the data:

• the website database or CMS

• email inboxes

• the CRM

• automation logs

• exports

• backups

For each, record who can access it, why it's kept and how access or correction requests get handled. Confirm who's asking before releasing a record. Ask for the minimum needed. Sight ID rather than copying it where you can.

APP 11 requires reasonable steps to destroy information, or remove identifying details, once it's no longer needed. That applies unless a law or court order requires keeping it. It covers archived and backup copies too.

Don't promise instant, total deletion. Backups need a documented retention and restore approach. Deleting one live CRM record doesn't remove every copy. Record how a restored record gets brought back into line.

Overseas providers and integrations

A provider's headquarters tells you little about where your data goes. Keep these separate:

• where data is stored

• where it's processed

• who can access it for support

• onward recipients

• the legal entity you contract with

Ask the provider what applies to your product, contract and configured region. An Australian data centre doesn't prove every access stays in Australia.

APP 8 covers overseas disclosure. Sending data to a provider can be a use or a disclosure. It depends on the facts, including who keeps effective control.

Where APP 8.1 applies, take reasonable steps so the recipient doesn't breach the APPs. Some exceptions apply. You can also stay accountable for the overseas recipient's handling. A generic checkbox isn't a liability waiver. Keep one record per provider:

Name recipient countries accurately where practicable. The European Union isn't a country. Not every service sends everything to the United States either.

Google Analytics documents EU specific collection. Data from EU devices is collected on EU servers, then forwarded for processing. That isn't an Australian storage option. Ask for current vendor documentation before claiming any data residency.

A software provider or agency handling your data doesn't take over all of your duties.

Respond to a website or vendor data breach

The notification scheme applies to organisations and agencies the Privacy Act covers. For them, a website incident isn't automatically a notifiable breach. A breach involves unauthorised access to, disclosure of or loss of personal information. A failed plugin or a short outage may involve none of those.

Under the current scheme, a breach is eligible if it's likely to result in serious harm. Remedial action that prevents that risk takes it out of scope. If you suspect one, take all reasonable steps to assess it within 30 calendar days. Don't wait for day 30 if the answer is clear sooner.

Once you believe an eligible breach has occurred, act as soon as practicable. Notify affected people and give the OAIC a statement. Exceptions can apply. Don't substitute the draft 72 hour period or another country's deadline.

Both the statement and the notices need:

• your organisation's name and contact details

• a description of the breach

• the kinds of information involved

• recommended steps people should take in response

A password reset or a clean backup restore can stop the disruption. Neither shows whether personal information was accessed. A common mistake is treating a restored backup as proof nothing was taken.

For a vendor incident, get:

• the timing

• the affected datasets and people

• evidence of access or copying

• the mitigation so far

• any onward parties involved

Record who coordinates the assessment and any notification. If a breach involves several entities, only one needs to notify the OAIC. Don't simply assume the supplier will handle everything.

Keep a decision record with the uncertainty, reviewer, time and reason. That includes a decision not to notify. Contracts and sector rules can add duties. For prevention and recovery, read up on WordPress security.

A 30 day privacy work plan

A month gives you a structured start. Urgent incidents and legal dates still come first.

Track each week in a simple table:

The legal reviewer handles applicability and wording. The technical owner handles implementation and tests. The business owner sets purposes and gives approval. A common mistake is buying a consent tool before anyone has mapped where the data goes.

Apply the checks to your industry

Each sector has its own pressure points:

Confidential legal or financial details still deserve protection. Only call them sensitive information where the Privacy Act definition applies. Sector rules can add to the general ones. For the marketing side by sector, see SEO for medical practices, SEO for law firms and ecommerce SEO.

Keep a change record

Laws, vendors and your own website keep changing. Keep a running record:

Recheck legal updates at each milestone, including when the final code is registered and starts. Ongoing technical ownership belongs in your website maintenance plan.

What we recommend at Elev8d

Frequently asked questions

Next steps

Pick the step that fits where you are.

Written by Ajay K.Co-founder, Elev8d

Ajay is the co-founder of Elev8d and writes most of what you will read here. Psychology grad turned marketer, which is a fancy way of saying he cares about why people click, not just where things rank. Every guide is written in plain English for Australian businesses, tested on real campaigns before it earns a spot on this site.