Privacy Act Tranche 1, the foundation shift

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. It is a substantial reform of the Privacy Act 1988, and its provisions are staging in through December 2026. Three changes matter directly to marketing and analytics teams.

Automated decision-making transparency

From 10 December 2026, organisations must disclose in their privacy policies the types of personal information used in substantially automated decisions, the nature of those decisions, and where they could reasonably be expected to significantly affect individuals’ rights or interests.

Algorithmic targeting, personalisation, lead scoring and dynamic pricing should be assessed against that threshold; they are not automatically covered simply because software is involved. If your marketing stack includes programmatic advertising, recommendation engines, or predictive analytics, those systems need to be audited and documented before the obligation commences (and most marketing stacks I’ve seen are nowhere near ready).

Children’s Online Privacy Code

The OAIC must develop and register a Children’s Online Privacy Code by 10 December 2026. At this note’s January 2025 date, the code’s detailed rules were still to be developed. It would be premature to treat particular direct-marketing conditions as settled obligations. Existing privacy requirements still apply to children’s information.

Statutory tort for serious invasion of privacy

The new statutory tort was scheduled to commence on 10 June 2025; it was not yet available when this note was dated. It concerns serious invasions of privacy meeting the statutory conditions, rather than every harmful data breach. This adds a distinct route to liability alongside existing protections. Marketing teams are now a primary source of privacy risk, not a peripheral one.

What this means for your marketing operations

Every organisation using automated systems in marketing needs to do three things before December 2026.

Audit every automated decision-making system in the marketing stack. Document how each works, what data it uses, and what decisions it makes.

Update privacy policies for in-scope ADM practices in plain language. The disclosure obligation sits on the organisation, not the vendor.

Review any audience segments or campaigns that include minors. Assess compliance against the incoming Children’s Code and adjust before the code is registered.

The existing serious-interference penalty framework, strengthened in 2022, carries substantial corporate penalties (the greater of AUD 50 million, three times the value of any benefit obtained, or 30% of adjusted turnover). The Privacy Act is now a material business risk, not a compliance formality, and the December 2026 dates are not negotiable.