Australia's Privacy Act is being rebuilt in two stages. The first is law already. The second was published as a draft at the end of August 2026, and it would change how every business has to think about tracking.
Already law: the first tranche.
The Privacy and Other Legislation Amendment Act 2024 passed in late 2024. Most of it took effect on 11 December 2024. For anyone running analytics and advertising, the parts that matter are:
- A right to sue. Since 10 June 2025, people can take a business to court for a serious invasion of privacy, without waiting for the regulator.
- Stronger enforcement. The Information Commissioner has more options, including fines for less serious breaches, not just the largest cases.
- Automated decisions. From 10 December 2026, privacy policies must explain where personal information is used in automated decisions that significantly affect people.
- Children. The regulator must register a Children's Online Privacy Code by 10 December 2026, setting rules for online services likely to be used by children.
In draft: the second tranche.
On 31 August 2026, the Attorney-General released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026. It's a draft, not law, and it may change. Its biggest idea is a single test: all collection, use and disclosure of personal information would have to be fair and reasonable in the circumstances.
That matters for tracking because consent alone wouldn't settle it. A business could have a ticked box and still be in breach if the way it used the data wasn't objectively fair. Profiling visitors for advertising in ways they wouldn't expect is the kind of practice the test is aimed at.
The draft keeps the small business exemption for businesses with a turnover of 3 million Australian dollars or less, though removing it has been discussed for years.
What it means for your tags.
- Notice and opt-out matter now. The regulator's guidance on tracking pixels already expects both, and its June 2026 rulings against two health providers show it will act. See tracking pixels and the Privacy Act.
- Less data is safer data. Under a fairness test, tags that send more than they need are harder to defend.
- Records help. Knowing what each tag sends, and why, is what you'd need to show that your tracking is fair and reasonable.
What to do now.
- List your tags and what each sends, page by page.
- Remove tags nobody uses, and data fields no report needs.
- Add notice on arrival and an opt-out that reaches your advertising tags.
- Keep advertising tags off sensitive pages.
- Watch the draft. If it becomes law, the fairness test will apply to tracking you already run.
How the reforms apply to your business is for your lawyers. Marc Alexander makes GA4 and Tag Manager match their decisions, for Australian businesses. The GA4 mini audit gives you the list of what's running today.