Australia has no cookie law like the UK's or the EU's, so many Australian websites have no banner at all. That used to be a reasonable reading. The privacy regulator's guidance on tracking has made it a risky one.
No cookie law, but the Privacy Act applies.
There's no Australian rule that says "ask before setting cookies". What applies instead is the Privacy Act and its Australian Privacy Principles, whenever tracking collects personal information. And the Office of the Australian Information Commissioner says it often does: identifiers, IP addresses and page addresses can make someone reasonably identifiable once they reach an advertising platform that already knows them.
What the regulator expects.
- Notice when tracking happens. Under Australian Privacy Principle 5, people must be told about collection at or before the time it happens. The OAIC says a privacy policy alone doesn't do that for tracking pixels, and suggests a banner or pop-up when a visitor first arrives.
- An opt-out from retargeting. Ads based on pixel data count as direct marketing, so visitors need a simple way to say no, and it has to work.
- Consent for sensitive information. If tracking could reveal health, sexuality, ethnicity or similar details, you need an express yes first. In June 2026, the regulator ruled against two health providers on exactly this point, as covered in tracking pixels and the Privacy Act.
So the Australian model sits between the US and Europe. For most sites, a clear notice and a working opt-out are what's expected. For sensitive topics, it's opt-in, like Europe.
Who it applies to.
Most businesses with an annual turnover of 3 million Australian dollars or less are exempt from the Privacy Act.
There are exceptions: health service providers are covered whatever their size, and so are some others, such as businesses that trade in personal information. The exemption is unchanged in the government's August 2026 draft reforms, but it's been under review for years. See Australia's privacy reforms.
Visitors from overseas.
If you have visitors from the UK or the EU, their rules can apply too, and they're stricter: analytics and advertising tags usually wait for a yes. Google also requires Consent Mode v2 for advertising to visitors in Europe. One container can treat each region differently, as shown in region-specific consent in Tag Manager.
A sensible setup for most Australian sites.
- A banner on arrival that says what's tracked and why, with a link to the detail.
- A choice to turn off advertising and retargeting, which actually stops those tags.
- Opt-in consent before any tag runs on pages about health or other sensitive topics, or no advertising tags there at all.
- Stricter defaults for UK and EU visitors, if you have them.
- A test of every option, checking the network requests, not just the banner.
Whether the Act applies to you, and what your notices say, is for your lawyers. Marc Alexander sets up banners, Consent Mode and tags to match, for Australian businesses. The GA4 mini audit checks what fires before anyone chooses.