Australia's Privacy Act Reforms: What They Mean for Your Marketing Data

Australian privacy reform has been "coming soon" for so long that many marketing teams stopped listening. That is now a mistake. The first tranche is law, a second tranche finally exists as draft legislation, and the draft goes straight at what performance marketers rely on: pixels, hashed emails, custom audiences and the data flowing between them.

The difficulty is separating what binds you today from what is still a proposal. This guide sets out both as at October 2026, with a status table, a two-part compliance checklist and answers to the questions we are asked most. It is a practitioner's reading, not legal advice.

Law Versus Proposal at a Glance

The single most common error we see in reform commentary is treating the tranche 2 draft as if it had passed. It has not. The table below separates the two. "In force" and "Commences" rows are enacted law; "Exposure draft" rows are proposals with no commencement date.

Two cautions on reading it. First, "No date set" means exactly that: the draft's commencement table is blank, and nothing guarantees the final bill will look like the draft. Second, a proposal can still be good practice now. Several of the draft measures describe what the OAIC already expects under current guidance, which is why the checklist further down mixes both.

What Is Already Law: Tranche 1

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024, with most provisions commencing the following day. Four parts matter for marketers.

• Enforcement has teeth. The OAIC can now issue infringement notices for conduct after 11 December 2024, and civil penalties now sit in tiers, including a lower tier for administrative failures such as a deficient privacy policy.
• A statutory tort for serious invasions of privacy commenced on 10 June 2025, letting individuals sue directly for intrusion or misuse of information. The bar is high (intentional or reckless, and serious), but careless handling of sensitive audience data is where a test case could come from.
• The OAIC must register a Children's Online Privacy Code by 10 December 2026. It released an exposure draft of the code on 31 March 2026 and consultation closed on 5 June. If under-18s are likely to use your services, expect tighter rules on profiling and targeting them.
• From 10 December 2026, privacy policies must explain where personal information is used in automated decisions that could significantly affect someone's rights or interests. Read the OAIC's guidance before assuming a system is out of scope.

The infringement notice list deserves a closer look than it usually gets. It includes the privacy policy requirements in APP 1 and the direct marketing opt-out provisions in APP 7. In other words, the two most mundane marketing compliance tasks, keeping the privacy policy accurate and honouring unsubscribes, are exactly where the OAIC can now act quickly. An opt-out that suppresses someone in your email platform but leaves them in a Customer Match list synced the same night is the kind of gap that used to be theoretical.

The automated decisions obligation is under two months away. Most ad targeting will not meet the "significant effect" threshold, but automated lead scoring that rejects applicants, personalised pricing and eligibility screening plausibly could. Inventory those systems now: the privacy policy update is the visible end of a longer exercise, because you cannot describe decisions you have not mapped.

Current law already covers more of the ad stack than many teams assume. The OAIC's guidance on tracking pixels says pixel data can be personal information where the platform can match it with other information, gives a hashed email as an example, expects pixels to be configured to collect the minimum necessary, and says sensitive information must not flow to platforms through them. None of that waits for tranche 2.

What Is Proposed: The Tranche 2 Exposure Draft

On 31 August 2026 the Attorney-General's Department released the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, with consultation closing 18 September. It is not law, its commencement dates are blank, and it remains subject to further consideration by government. Treat this section as direction of travel.

The direction is clear, though. A new fair and reasonable test would govern every collection, use and disclosure, and it applies even where you have consent. The factors include whether a reasonable person would expect the handling, whether you are transparent about the means and purposes, whether the purpose could be met with less information or non-personal information, whether the individual has genuine choice, whether the privacy impact is proportionate to the benefits, and, for children, their best interests as a primary consideration. Consent itself gets a statutory definition (voluntary, informed, current, specific and unambiguous), which retires the pre-ticked box and the bundled "by using this site you agree" banner.

Personal information would be redefined as information that relates to an identified or reasonably identifiable individual, with the notes naming identifiers, location data, and "characteristics, behaviours, traits, preferences or patterns of activity". A person would be reasonably identifiable if they could be identified by combining the information with other information that is reasonably available. Collection would expressly include information you generate or derive yourself, so inferred segments and propensity scores are in scope.

Notably, the draft leaves the small business exemption in place, although businesses that trade personal information still fall outside it. It also proposes a right to erasure on large digital platforms, which matters less for advertisers directly than for the platforms they buy from.

Where It Lands on Your Marketing Stack

Three proposals bite hardest. First, direct marketing would be redefined to cover any marketing where an individual is selected, identified or otherwise targeted, as an individual or as a member of a class, using their personal information. Custom audiences and retargeting fall squarely inside, each needing a simple opt-out, and each communication would need to carry information on how to opt out. How that last requirement maps onto a display impression or a sponsored post is not spelled out, and is one of the questions we expect consultation to have raised.

Second, disclosing personal information for direct marketing would count as trading it, which requires consent. There is an exception for disclosures to a processor acting on your behalf. Under the draft, a processor acts on your behalf only where it follows your instructions, for your purposes, and those instructions are documented in writing. Whether Meta and Google are processors or independent recipients when they receive your Conversions API events and Customer Match lists is the question that decides how much of your setup needs consent. Where a platform also uses the data to improve its own models or targeting, the processor argument gets harder. The draft does not answer it.

Third, the identifiability language ends the comfortable fiction that a hashed email is anonymous. Hashing is a security control, not de-identification: a hashed email exists precisely so the platform can single someone out. Plan as though every hashed identifier, click ID and pixel event is personal information.

A fourth, quieter change is the fair and reasonable test applied to derived data. A propensity model built on browsing behaviour, used to build predictive audiences, would be a collection of personal information in its own right, and would need to pass the same proportionality and expectation factors as the raw data.

Your Compliance Checklist

The work that prepares you is the same work that improves measurement, so there is no reason to wait. A measurement plan is the natural home for the inventory, and a server container is where you strip fields, honour opt-outs and control what each vendor receives, which is where consent mode and server-side consent management earn their keep. We have split the list so you can see which items current law requires and which prepare you for the draft.

Do Now: Current Law

1. Map every tag, pixel, server-side event and audience upload: what it carries, which platform receives it and on what legal basis.
2. Update your privacy policy to describe pixels, conversion APIs, audience uploads and any profiling, in plain language.
3. Add automated decision disclosures to the privacy policy before 10 December 2026 if lead scoring, pricing or eligibility tools could significantly affect people.
4. Test that a single opt-out reaches every channel, including suppression lists synced to Meta, Google and LinkedIn.
5. Remove sensitive information from pixels and events, including health-related page URLs and form fields, or get express consent first.
6. Configure pixels and conversion events to send the minimum needed, and limit them to the pages that actually need them.
7. Review platform terms and run a privacy impact assessment on each major data flow, then schedule a recheck rather than set and forget.

Prepare For: Proposed Tranche 2

1. Classify each vendor as a likely processor or independent recipient, and put written instructions in place where you rely on processor status.
2. Rebuild consent capture so it would meet all five proposed elements, with timestamped records you can pass downstream.
3. Build an opt-out from targeting, not just from email, that removes people from custom and lookalike seed audiences.
4. Inventory derived data such as scores, segments and inferred interests, and record why each is needed.
5. Draft a short fair and reasonable assessment template for new campaigns and data uses, covering expectation, necessity and proportionality.

Frequently Asked Questions

Is a hashed email personal information?

Under current law, very likely yes when it is shared with an ad platform. The OAIC's tracking pixel guidance names a hashed email as an example of an identifier that can make someone reasonably identifiable once the platform matches it. The tranche 2 draft would remove most remaining doubt by naming identifiers in the definition. Treat hashing as a security measure, not anonymisation.

Do I need consent for Meta CAPI or Customer Match?

Under current law there is no general consent requirement for non-sensitive personal information, but you need a clear privacy policy and collection notice, a use the person would reasonably expect, and express consent for any sensitive information. The platforms' own terms also put responsibility on you to have the right to share the data. If the draft passes as written, sharing data for direct marketing would be trading and need consent unless the platform qualifies as your processor, which is unsettled.

Does the small business exemption still apply?

Yes. The exemption for businesses with annual turnover of $3 million or less still applies, and the exposure draft does not remove it. It has never covered health service providers or businesses that disclose personal information for a benefit without consent, and the draft keeps an equivalent trading carve-out. Platform terms and customer expectations apply regardless of the exemption, so small businesses running audiences should not treat it as a free pass.

When does tranche 2 start?

Nobody can say yet. As at October 2026 it is an exposure draft whose consultation closed on 18 September, its commencement table is blank, and the government has said it remains subject to further consideration. A bill would still need to be introduced and passed, and we would expect transition periods, but neither is confirmed.

Does this affect retargeting?

Retargeting is lawful today, subject to the existing APPs, the OAIC's pixel guidance and the Spam Act for email and SMS. Under the draft, retargeting would clearly be direct marketing, so each person would need a simple way to opt out, and disclosing data to a platform to target them could be a trade needing consent. How the opt-out notice would work inside a display or social ad is not yet clear.

What changes on 10 December 2026?

Two things from tranche 1. The automated decision-making transparency requirement for privacy policies commences, and the OAIC's deadline to register the Children's Online Privacy Code falls, although the code's own commencement date has not been set. Nothing from the tranche 2 draft takes effect on that date.

The businesses that will handle tranche 2 calmly already own their data flows rather than renting them from vendor scripts, as we argued in first-party data and server-side tracking. If you want that foundation built properly, our first-party data infrastructure and server-side tagging work is designed for exactly this. Get in touch.