New Zealand has no cookie law, so many New Zealand websites run GA4 and advertising pixels with no notice at all. The Privacy Act 2020 still applies to that tracking, and a change that took effect on 1 May 2026 widened what businesses have to tell people.
The Privacy Act and tracking.
The Privacy Act 2020 is built around information privacy principles. They apply to personal information, meaning information about an identifiable person. Analytics and advertising tags often collect it: identifiers, IP addresses and browsing history can identify someone, especially once they reach a platform that already knows them.
The principles that matter most for websites:
- Telling people (IPP 3). When you collect personal information from someone, you must take reasonable steps to make sure they know what's collected, why, and who receives it.
- Indirect collection (IPP 3A). Since 1 May 2026, if you collect personal information about people from someone other than them, you generally have to make sure they're told too. Audiences and data you receive from other companies are the kind of thing it covers.
- Overseas disclosure (IPP 12). Sending personal information to a company overseas, as almost every analytics and ad platform is, needs comparable safeguards or one of the exceptions.
- Using only what you need. Collect information for a lawful purpose connected with what you do, and no more than you need for it.
What that means for your site.
New Zealand doesn't require opt-in consent for analytics cookies the way the UK and EU do. What it expects is openness: people should be able to find out, easily and at the right time, what your tags collect and where the data goes.
- A notice that's easy to find. A short banner or notice on arrival, linking to a privacy statement that names your analytics and advertising tools, does that far better than a line buried in a long policy.
- A way to say no to advertising. Not strictly required in every case, but it's good practice and expected by visitors who see the same rules on overseas sites.
- Care with sensitive pages. Advertising pixels on pages about health, finance or other sensitive topics are where the risk concentrates. Australia's regulator ruled against two health providers over this in 2026, and New Zealand's principles point the same way.
GST in GA4 revenue.
Consumer prices in New Zealand are normally shown including GST at 15%, because a price that leaves it out without saying so can mislead customers under the Fair Trading Act. GA4 expects revenue without tax. If your store sends the prices it displays, GA4 overstates revenue by the GST, about 13% of each GST-inclusive figure.
Send item prices and value excluding GST, with GST in the tax parameter and currency: "NZD". The details are in GST and GA4 revenue, written for Australia, where the same problem applies at 10%.
Visitors from overseas.
If you have customers in Australia, the UK or the EU, their rules may apply too. The UK and EU require a yes before most tracking, and Google requires Consent Mode v2 for advertising to European visitors. One container can treat each region differently: see region-specific consent in Tag Manager.
What to check.
- List every tag on your site, what it sends and where the company is based.
- Make sure your privacy statement names them, and add a notice on arrival.
- Keep advertising pixels off sensitive pages.
- Check whether you receive personal information from other companies, which IPP 3A now covers.
- Check your purchase events send revenue without GST.
How the Act applies to your business is for your lawyers. Marc Alexander sets up GA4 and Tag Manager for Australian and New Zealand businesses, and the GA4 mini audit shows what your tags send today.