Meta's new commercial terms: what Australian marketers should check
Before 30 October, confirm the wording, review the website permissions and get clear answers from Meta.
Advisory
Consequential changes in the internet, AI, algorithms, agents and the rules governing data: what they mean for organisations, and how to respond. Read each piece in the context of its publication and review dates.
Before 30 October, confirm the wording, review the website permissions and get clear answers from Meta.
New transparency obligations start on 10 December 2026. Marketing teams need to know which automated decisions affect customers, what data drives them and what their privacy policy must explain.
In Marketing We Trust's submission on the draft Privacy Bill has been lodged. We are awaiting further advice from the Attorney-General's Department, with practical implications for digital marketing to follow.
The OAIC's APP 3 rewrite explicitly names AI inference, enrichment, scraping, and observation as collection events. The 'we didn't realise' defence has been retired.
Google is removing Signals as a control on Google Ads cookies and IDs from 15 June 2026. Your cookie consent banner becomes the primary thing between user data and Google's ad business.
Over AUD 5.4 million in combined spam and gambling self-exclusion penalties. The SMS Sender ID Register becomes mandatory 1 July 2026. Unregistered sender IDs will be labelled Unverified.
The regulator has explicitly named advertising technology, AI, and excessive data collection as priority areas for 2025-26. The first compliance sweep is underway and the first civil penalty has been imposed.
Don't deploy this in your business. Don't allow it on any device with access to company data or client information. The automation upside doesn't justify the liability.
The under-16 social media restriction is live, with access removed to about 4.7 million accounts. That changes audience planning, but accounts are not unique people or a direct measure of advertising reach.
The Cyber Security Act 2024 requires ransomware payment reporting within 72 hours. Marketing databases, CDPs, and CRMs are targets. Marketing teams need to be in the incident response plan.
15 million Digital IDs. 80 million verified transactions. From November 2026 the private sector can apply to participate. This is the new identity layer.
No standalone AI Act. Standards-led, not legislation-led. But the automated decision-making disclosure obligation is binding from December 2026, and the ACL already applies to misleading AI outputs.
Google kept cookies, but modelling, consent choices and browser protections still leave measurement gaps. First-party data and server-side collection need to work alongside other ways of measuring effectiveness.
The proposed second tranche of Privacy Act reforms would introduce a test that is separate from consent. Having consent will not be sufficient if the use fails the test. This is the single largest structural risk to performance marketing in Australia.
Australia is preparing an ex ante competition regime targeting dominant digital platforms. Ad tech and app marketplaces are first in line. Penalties up to 30% of turnover.
CDR is expanding into non-bank lending from mid-2026. The competitive dynamics of financial services marketing change when customer switching friction drops.
The first structural overhaul of the Privacy Act in decades is staging in through December 2026. Three changes matter directly to marketing and analytics teams.