Automated decisions: what marketers need to do
New transparency obligations start on 10 December 2026. Marketing teams need to know which automated decisions affect customers, what data drives them and what their privacy policy must explain.
Event / source date: . Source document
If your marketing systems decide who gets an offer, what they pay or which opportunities they see, the OAIC’s new guidance deserves a closer look.
As I noted in September, the regulator has published resources on automated decision-making (ADM) and AI transparency. The practical job for marketers is to understand what their systems decide about people.
What changes
From 10 December 2026, businesses and agencies covered by the Australian Privacy Principles must add disclosures to their privacy policies for qualifying automated decisions. The rules apply where they arrange for software to use someone’s personal information to make a decision, or provide a substantial and direct input to one, that could reasonably be expected to significantly affect that person’s rights or interests. The OAIC’s announcement sets out the test.
For those decisions, the policy must describe the kinds of personal information used, the kinds of decisions made entirely by software, and the kinds substantially and directly supported by software.
Rule-based systems count alongside AI. Having a person approve the result does not automatically put it outside scope. These are privacy-policy disclosures; they do not create a blanket requirement to label every AI-generated ad. Existing privacy obligations still apply.
What it means for marketers
The useful question is: what changes for the customer because of this decision?
The OAIC’s guidance specifically flags targeting that affects prices or access to significant goods and services, or limits employment opportunities. Its fact sheet illustrates how small personalised price differences for essential goods can accumulate into a significant impact.
I’d start the marketing review here:
- Personalised pricing: does personal information change what someone pays for essential or otherwise significant goods and services?
- Lead scoring and eligibility: does a score influence access to credit, insurance, education or another significant service?
- Targeting and exclusions: could the audience rules prevent someone seeing a job opportunity or accessing significant goods or services?
These are assessment priorities, not a claim that every score, discount or audience segment is covered. Consider the consequences for children and people experiencing vulnerability, and benefits as well as adverse effects.
What to do now
- Map the decisions. Bring marketing, data and privacy leads together. Record each decision, the personal information used, the system or vendor, the human involvement and the customer consequence. Include existing systems.
- Assess the threshold. Work through the OAIC flowchart below. Record why each use is in or out of scope. The OAIC recommends including the required disclosures if you remain in doubt.
- Get useful answers from vendors. Ask what information drives each decision and how recommendations influence the outcome. Buying the software does not automatically transfer your transparency obligation to its supplier.
- Publish specific disclosures by 10 December. Give your privacy lead the evidence to describe the relevant information and decision categories in plain language. Assign an owner to keep that explanation current as campaigns, models and settings change.
I’d begin with one customer journey: follow the data from audience selection through eligibility and price. It is a manageable way to find the decisions your privacy policy needs to explain.
Check whether the obligation applies
Follow each Yes down the chart. A No leads out of this particular transparency obligation. The OAIC’s decision sequence and explanatory notes are reproduced below in the Paulthinks style.
OAIC / Automated decisions
When a decision
needs disclosure.
APP 1.7–1.9
Transparency obligation
Seven questions. Follow the orange path. A No at any gate takes this use out of scope.
Start
Question 1. Is the entity an APP entity?
Out of
scope
Question 2. Does the APP entity collect or use personal information?
Out of
scope
Question 3. Has the APP entity arranged for a computer program (including a third-party capability) to inform or make a decision?
Out of
scope
Substantially and directly related to making a decision
Question 4. Is the APP entity’s use of the computer program substantially related to making the decision?
Question 5. Is the APP entity’s use of the computer program directly related to making the decision?
Out of
scope
Conditions met
Decision is substantially and directly related to making the decision
Significantly affects rights or interests of an individual
Question 6. Does the decision impact on the rights or interests of an individual?
Question 7. Is the impact on the individual’s rights or interests significant?
Out of
scope
Conditions met
Decision significantly affects the rights or interests of an individual
In scope
Information required in APP entity’s privacy policy
“Out of scope” refers only to APP 1.7–1.9; other privacy obligations may apply.
Text and decision logic adapted from the OAIC’s APP 1.7–1.9 Transparency Obligation flowchart and redesigned by Paulthinks.
Office of the Australian Information Commissioner website – www.oaic.gov.au. © Commonwealth of Australia. Text used under CC BY 4.0; see the OAIC copyright terms.
Updated 07 October 2026