Open workspace

Guide · Australian regulation

Australia's Privacy Act, for those who live off ads

Australia regulates privacy with a 1988 law and 13 principles that apply to companies and public bodies. The 2024 reform created the right to sue for serious invasion of privacy, new fines and a code for children. See what this changes for a site with Australian visitors.

Audit my site's privacyRead the guide
  • ✓Based on federal legislation and OAIC publications
  • ✓Examples of sites with ads, including Brazilian ones
  • ✓Read-only scan, no changes to the site
13Australian Privacy Principles that covered entities must follow
A$50Mfine ceiling for serious interference, or more when 3 times the benefit or 30% of adjusted turnover is higher
A$3Min annual turnover: below this, most small businesses fall outside the law
Dec 10, 2026deadline for registering the online privacy code for children

What it is

An old law with new rules

The Privacy Act 1988 is Australia's federal privacy law. At its center are the 13 Australian Privacy Principles, called APPs, which say how to collect, use, store, share and correct personal information. Enforcement is by the OAIC, the Office of the Australian Information Commissioner.

The law applies to federal government bodies and to organizations with annual turnover above 3 million Australian dollars. Some smaller companies are covered anyway, such as health service providers and those who pass personal data to third parties in exchange for some benefit without consent. Together, these organizations are called APP entities.

Foreign companies can also be reached when they have a link to Australia, for example by doing business in the country. Whether this includes a foreign site that only receives Australian visitors depends on the specific case, so it is worth following good practices anyway.

Personal information is any information or opinion about an identified or reasonably identifiable person. Sensitive information includes health, racial origin, political opinion, religion, sexual orientation, criminal record and genetic and biometric data, and as a rule it can only be collected with consent.

Checklist

What you need to meet

What the Privacy Act, the APPs and the Spam Act require of a site with ads that is covered by Australian law.

  1. Clear and up-to-date privacy policy

    The policy must be clear, up to date, free of charge, and say whether data goes to other countries. Google also requires it to say that third parties, such as Google, use cookies to show ads.

  2. Notice at the time of collection

    When you collect data, such as in a sign-up form or a newsletter, say what it is for and cover the other points of APP 5.

    Example

    We use your email only to send the weekly newsletter. See the privacy policy to learn how to access or correct your data.

  3. Let people stay anonymous

    As a rule, people may choose not to identify themselves or to use a pseudonym, unless the law requires otherwise or it is not practical.

  4. Consent for sensitive information

    Collecting sensitive information, such as health or religion, generally requires consent. Using sensitive information for direct marketing also requires consent.

  5. Easy opt-out from direct marketing

    Anyone who uses personal data for direct marketing must offer a simple way to ask to stop receiving it.

  6. Emails and SMS under the Spam Act

    Commercial messages require consent, correct identification of the sender and an unsubscribe option in every one. Unsubscribe requests must be honored within five business days.

    Example

    Sent by Example Company. Don't want to receive these anymore? Unsubscribe.

  7. Be careful when sending data abroad

    Before sending data outside Australia, take reasonable steps to make sure the recipient does not breach the principles.

  8. Report serious breaches

    When a breach may cause serious harm, notify the affected people and the OAIC, which has an online form for this.

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP or have its own message for Australia, so the links below are from the OAIC, the ACMA and Google.

The 13 principles

The APPs in six blocks

The principles follow the path of the data, from the moment it is collected to the request for correction.

Openness and anonymity

APP 1 and 2: have a clear and up-to-date privacy policy and, when possible, let the person interact without identifying themselves.

Collection and notice

APP 3 to 5: collect only what is necessary, by fair means, and tell the person who is collecting, for what and who it is shared with.

Use and direct marketing

APP 6 and 7: use the data for the original purpose and offer, in direct marketing, a simple way to opt out.

Sending abroad

APP 8: before sending data out of the country, take reasonable steps to ensure the recipient respects the principles.

Identifiers, quality and security

APP 9 to 11: do not adopt government identification numbers as your own, keep the data correct and protect it, deleting what is no longer needed.

Access and correction

APP 12 and 13: give access to the data the organization has about the person and correct what is wrong.

Consent, cookies and marketing

Where consent is required

Australia has no general rule requiring a cookie banner, like the European one. The law works with notice and transparency: the person must know that data is being collected and for what. Cookies and identifiers that allow someone to be recognized fall under these rules when the person is reasonably identifiable.

Consent is required in specific situations, such as collecting sensitive information and using the data for a purpose different from the original. For the OAIC, consent must be informed, voluntary, current and specific, and the person must have the capacity to give it.

In direct marketing, APP 7 allows using personal data when the person would expect that use, as long as there is a simple way to opt out and the opt-out request is respected. Commercial emails and SMS also follow the Spam Act 2003, which requires consent, identification of the sender and an unsubscribe option in every message.

With children, the rule is going to get tougher. The draft online privacy code for children, published in March 2026, provides for consent before using children's data for targeted advertising on services they are likely to access.

The 2024 reform and fines

What the 2024 law brought

The Privacy and Other Legislation Amendment Act 2024 received royal assent on December 10, 2024. Part of the rules took effect the next day and part has its own deadlines.

Lawsuit for serious invasion

Since June 10, 2025, a person can sue someone who seriously invaded their privacy, by intrusion or misuse of information. It also applies to those who are not APP entities.

Code for children

The OAIC must register, by December 10, 2026, a code for social networks and online services that children are likely to access.

Automated decisions

From December 10, 2026, the privacy policy must explain when decisions that affect the person are made using automated systems.

Tiered fines

In addition to the ceiling for serious interference, there are lower tiers and infringement notices for failures such as not having a clear and up-to-date privacy policy.

Ceiling for serious cases

Since December 2022, the maximum is the greater of 50 million Australian dollars, 3 times the benefit obtained and 30% of adjusted turnover in the period.

First court-ordered fine

In October 2025, Australian Clinical Labs was ordered to pay 5.8 million Australian dollars for security failures and failure to notify a breach.

People's rights

What the Australian visitor can ask for

Australian law speaks in principles, but in practice they become rights that the site must honor.

Access

Ask for the data the organization holds about them. The request can only be denied in the cases provided by law.

Fix

Ask for wrong, outdated, incomplete or misleading data to be corrected.

Stay anonymous

Interact without identifying themselves or with a pseudonym, when feasible, such as when simply reading articles.

Opt out of marketing

Ask not to receive direct marketing and ask where the organization got their data.

Complain to the OAIC

If the organization does not resolve the complaint, take the case to the OAIC, which can investigate and determine measures.

Sue

Go to court for serious invasion of privacy, based on the right created by the 2024 reform.

Obligations

What a site covered by the law needs to do

  1. Keep a clear privacy policyExplain what types of data you collect, how you collect them, for what, how the person accesses and corrects the data, how they complain and whether the data goes to other countries. From December 2026, include automated decisions.
  2. Give notice at the time of collectionOn newsletter, signup or comment forms, say who is collecting, why and who the data will be shared with.
  3. Provide a way out of marketingEvery commercial email or SMS needs a simple way to unsubscribe, and the request must be respected.
  4. Protect and disposeAdopt reasonable security measures and delete or anonymize what is no longer needed.
  5. Respond to breachesAssess a possible breach quickly, within 30 days, and, if it could cause serious harm, notify the OAIC and the people affected as soon as possible.
  6. Take care of sending abroadBefore sending data to vendors outside Australia, take reasonable steps to ensure they follow the principles. The organization remains responsible for what the vendor does.

Timeline

The dates that matter

From the original law to the obligations that begin at the end of 2026.

  1. 1988

    The Privacy Act is born

    The federal privacy law is passed, initially aimed at the public sector.

  2. March 12, 2014

    The 13 APPs come in

    The Australian Privacy Principles take effect for government and covered companies.

  3. February 22, 2018

    Breach notification

    The regime that requires notifying the OAIC and people about breaches with a risk of serious harm begins.

  4. December 2022

    Bigger fines

    The ceiling for serious interference rises to the greater of 50 million, 3 times the benefit and 30% of adjusted turnover.

  5. December 10, 2024

    Reform enacted

    The Privacy and Other Legislation Amendment Act 2024 is enacted. New fines and OAIC powers take effect the next day.

  6. June 10, 2025

    Lawsuit for serious invasion

    The right to sue for serious invasion of privacy takes effect.

  7. March 31, 2026

    Children's code draft

    The OAIC publishes the draft online privacy code for children and opens public consultation until June 5.

  8. December 10, 2026

    Code and automated decisions

    Deadline to register the children's code and start of the obligation to explain automated decisions in the policy.

For people with AdSense or Ad Manager

What changes in practice for revenue

Google does not require a certified CMP or the IAB TCF for Australia. That requirement applies to the European Economic Area, the United Kingdom and Switzerland. Australian traffic keeps receiving personalized ads without the TCF message.

The work, then, is in transparency. The privacy policy must say that the site uses cookies and ad partners, that data may go outside the country and how the person exercises their rights. A visible link to ad preferences helps the visitor understand and choose.

Think of a Brazilian finance site in Portuguese that receives Brazilians living in Sydney and Melbourne. If the company has turnover below 3 million Australian dollars, it may be outside the law, but the small business exception does not apply to those who pass personal data to third parties in exchange for a benefit without consent. Those who share identifiers with ad partners should assess this point carefully.

For children's content, get ready for the 2026 code. Google offers age-based treatment in ad tags, which turns off personalization for requests marked as child.

In practice

What is and is not allowed in Australia

Everyday examples from content, job and finance sites with an Australian audience.

Allowed

  • Showing Google personalized ads without the TCF message to visitors from Australia
  • Sending a newsletter to people who signed up, with an unsubscribe link in every send
  • Using measurement cookies, as long as the privacy policy explains this clearly
  • Letting the visitor read articles without signing up, respecting the right to anonymity
  • Using the same banner as other regions, if it also meets Australian rules

Not allowed

  • Sending commercial email without consent and without an option to unsubscribe
  • Collecting health data in a quiz without asking for consent
  • Ignoring requests to opt out of marketing
  • Using a generic privacy policy that does not mention partners or sending abroad
  • Personalizing ads on children's content without using age-based treatment

Common errors

Where sites slip up most

Common failures on sites with Australian traffic.

Relying on the small business exception without checking

Low turnover is not enough if the site passes personal data to third parties in exchange for a benefit without consent.

Outdated policy

The policy must be clear and current. Failing at this is one of the infringements that can lead to an infringement notice after the reform.

Forgetting the Spam Act

Commercial newsletters and SMS without consent or without unsubscribe violate the spam law, in addition to the privacy principles.

Quizzes and forms that ask for sensitive data

Questions about health, religion or sexual orientation require consent and extra care.

Ignoring sending abroad

The data goes to partner servers outside Australia. The policy must say so and the site remains responsible.

Leaving the children's code for later

Sites with a child audience should review targeted advertising and consent before the code is registered, expected for December 2026.

In ConsentMode

What the audit checks for Australia

  • Opens the site as a visitor from Australia and records whether there is a banner, what it offers and which cookies and pixels fire before the choice.
  • Identifies the CMP from the page code, when there is one, and reads the Consent Mode signals sent to Google.
  • Checks whether the privacy policy includes types of data, purposes, ad partners, sending abroad, access, correction and complaints.
  • Checks whether the ad tags use age-based treatment on pages with a child audience.
  • Delivers screenshots and a fix plan by priority.
Run an auditSee everything that is checked

Frequently asked questions

Do I need a cookie banner for Australia?

Australian law does not require a banner like the European one. It requires transparency and, in some cases, consent. Google also does not require a certified CMP for this audience. A clear notice and a complete policy are the minimum.

My site earns little. Does the law apply to me?

Most companies with turnover up to 3 million Australian dollars fall outside, but there are exceptions, such as those who pass personal data to third parties in exchange for a benefit without consent. Assess your case.

What is the lawsuit for serious invasion of privacy?

It is a right created by the 2024 reform and in force since June 10, 2025. A person can sue someone who seriously invaded their privacy, and the court can order compensation, an end to the conduct or an apology.

Is the children's code already in force?

Not yet. The draft was published in March 2026 and the OAIC must register the code by December 10, 2026. It is expected to apply to social networks and online services that children are likely to access.

Who enforces?

The OAIC, the Office of the Australian Information Commissioner. It receives complaints, investigates, issues notices and can take serious cases to court to seek a fine.

Does a data breach have to be reported?

Yes, when it could cause serious harm. The organization assesses the case within 30 days and, once the risk is confirmed, notifies the OAIC and the people affected as soon as possible.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See how your site appears to an Australian visitor

The audit opens the site from Australia and shows what to fix in the banner, tags and policy, without changing anything.

Start the audit