Your martech stack is a collection engine. The OAIC just said so.
The OAIC's APP 3 rewrite explicitly names AI inference, enrichment, scraping, and observation as collection events. The 'we didn't realise' defence has been retired.
Advisory
What's changing.
Data, privacy, measurement, and the regulatory landscape affecting digital marketing in Australia. Written for CMOs and CDOs who need to act, not just be aware.
Google just made your cookie banner the most important config
Google is removing Signals as a control on Google Ads cookies and IDs from 15 June 2026. Your cookie consent banner becomes the primary thing between user data and Google's ad business.
ACMA is enforcing, and the SMS Sender ID Register is coming
Over AUD 5.4 million in penalties for basic email and SMS compliance failures. The SMS Sender ID Register becomes mandatory 1 July 2026. Unregistered sender IDs will be blocked.
The OAIC is looking at your marketing data practices
The regulator has explicitly named advertising technology, AI, and excessive data collection as priority areas for 2025-26. The first compliance sweep is underway and the first civil penalty has been imposed.
Advisory: OpenClaw and AI agents
Don't deploy this in your business. Don't allow it on any device with access to company data or client information. The automation upside doesn't justify the liability.
4.7 million accounts gone, the social media age restriction and what it means for audience strategy
The under-16 social media ban is live. 4.7 million accounts removed. Audience sizes on major platforms have structurally shrunk in Australia.
Your marketing systems are a ransomware target, the 72-hour reporting obligation
The Cyber Security Act 2024 requires ransomware payment reporting within 72 hours. Marketing databases, CDPs, and CRMs are targets. Marketing teams need to be in the incident response plan.
Digital ID opens to the private sector in December 2026
15 million myIDs. 80 million verifications. From November 2026 the private sector can participate. This is the new identity layer.
AI in marketing, what Australia's standards-led approach means for your team
No standalone AI Act. Standards-led, not legislation-led. But the automated decision-making disclosure obligation is binding from December 2026, and the ACL already applies to misleading AI outputs.
Your measurement infrastructure is already degraded
Google kept cookies but GA4 is now a modelled system. iOS 26 strips click IDs. 75% ATT opt-out. Server-side tracking is no longer optional, it is baseline.
The fair and reasonable test, and why consent alone won't be enough
The second tranche of Privacy Act reforms introduces a test that is separate from consent. Having consent will not be sufficient if the use fails the test. This is the single largest structural risk to performance marketing in Australia.
The ACCC is coming for ad tech, digital platform competition reform
Australia is preparing an ex ante competition regime targeting dominant digital platforms. Ad tech and app marketplaces are first in line. Penalties up to 30% of turnover.
Consumer Data Right expansion, data portability is coming to lending
CDR is expanding into non-bank lending from mid-2026. The competitive dynamics of financial services marketing change when customer switching friction drops.
Privacy Act Tranche 1, the foundation shift
The first structural overhaul of the Privacy Act in decades is staging in through December 2026. Three changes matter directly to marketing and analytics teams.