The OAIC is looking at your marketing data practices

The Office of the Australian Information Commissioner has explicitly named advertising technology, artificial intelligence, and excessive data collection as priority areas for 2025-26. The regulator is no longer issuing guidance and waiting; it is actively investigating.

The compliance sweep

In January 2026, the OAIC launched its first privacy compliance sweep, reviewing the privacy policies of approximately 60 entities across six sectors that collect information in person. Non-compliant privacy policies face compliance notices, infringement notices, and penalties of up to AUD 66,000 per contravention.

This is a targeted sample covering rental and property, chemists, licensed venues, car rentals, car dealerships, and pawnbrokers and second-hand dealers. It tests APP 1.4 policy requirements. Ad tech is a broader regulatory priority, rather than the defined scope of this particular sweep.

The enforcement precedent is set

On 8 October 2025, the Federal Court ordered Australian Clinical Labs to pay AUD 5.8 million, the first civil penalties under the Privacy Act. The current maximum for a body corporate’s serious interference with privacy is the greatest applicable amount of AUD 50 million, three times the benefit obtained where it can be determined, or 30% of adjusted turnover during the breach turnover period where it cannot. That maximum does not apply to every privacy-policy defect.

The penalty framework is live, the first penalty has been imposed, and the numbers are material enough to require board-level attention. Read alongside the OAIC’s stated priorities, the message to ad tech, AI, and data-heavy marketing operations is direct.

What to do before the regulator gets to you

Three areas need immediate attention.

Privacy policies. The compliance sweep is reviewing privacy policies as a primary indicator. If your policy does not accurately describe the personal information you collect, its purposes and usual disclosures, it may fail existing requirements. The additional disclosures for qualifying automated decisions commence on 10 December 2026; they are not a blanket requirement for every marketing algorithm. (And honestly, most of the ones I read still aren’t.)

Consent mechanisms. The OAIC’s tracking-pixel guidance calls for due diligence, transparency and data minimisation. Consent requirements depend on the information and its use, with sensitive information subject to stronger rules. Where consent is required, it must be informed, voluntary, current and specific; a pre-ticked box is not a reliable substitute.

Data retention. Excessive data collection and retention is a named priority. If you are collecting more data than you need, or retaining it longer than necessary, the regulatory risk is direct and immediate.

The OAIC’s 2025-26 priorities read as a diagnostic checklist in their own right. The question is whether your organisation passes it without remediation, or only after.