My submission on the draft Privacy Bill

On 18 September, I lodged In Marketing We Trust’s submission to the Attorney-General’s Department on the Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026. This advisory records the submission and the practical issues we have asked the department to address.

Download the full submission (PDF, 10 pages).

The Attorney-General’s announcement on 31 August sets out the reform package. The AGD consultation page holds the draft and supporting papers. These are proposed changes to the law.

Who we are

I am CEO of In Marketing We Trust, a digital marketing analytics and performance optimisation agency. We build and operate marketing data systems, so our response draws on how these proposals would work in practice.

I also sit on the MAA Privacy, Data and AI Council. The Marketing Association of Australia (MAA) was formed through the merger of ADMA and AANA. Through the council, I contributed to MAA’s separate submission to this consultation (member access). IMWT’s submission sets out our agency’s own position alongside that industry contribution.

Our position

We support the Bill’s objectives and most of its drafting. Our central argument is that privacy duties need to sit with the organisation capable of fulfilling them. Otherwise, the risk is compliance on paper or more advertising moving into the largest platforms, without a corresponding privacy improvement.

What we tested

We reviewed the draft against 32 ordinary marketing activities. Our assessment identified seven where the advertiser needs a control held by a platform. These are expected operational effects. Annexure A records the activities, relevant provisions and likely responses.

Opt-outs

The consultation paper generally assigns platform-advertising opt-outs to the platform, unless it acts solely as a processor. We ask for that allocation to be clear in APP 7 itself. Where the advertiser is responsible, our proposed limit is communications it delivers itself to an identified individual.

Old customer data

The draft’s consent-to-trade rule would reach future disclosures of information already held. Consent collected for marketing may not cover that new purpose. We ask for APP 4.2 to apply to personal information collected on or after commencement, with specific drafting in the submission.

What an advertising platform is

A platform can follow a client’s instructions and use data for its own purposes. Whether it acts as a processor or controller affects both the trading rule and the opt-out duty. We ask AGD to clarify how those provisions work together when an upload serves both purposes.

Timing

Platforms build first; businesses then evaluate, install, migrate and change contracts. We ask for staged commencement, with trading and direct-marketing rules starting once platforms support them, and at least two years for the data-inventory and contracting changes.

Drafting matters and further engagement

Annexure B identifies drafting corrections, including an incorrect reference in a civil-penalty provision. We have offered to discuss the issues with the Privacy Reform Taskforce and make our provision review and use-case testing available.

A question about small businesses

Annexure C asks whether the new trading definition changes which small businesses lose the Privacy Act exemption when uploading customer lists for advertising. We have raised this for clarification; the submission treats it as an open question.

What happens next

We will now wait for further advice from the Attorney-General’s Department on the consultation and the next steps for the Bill.

I will follow up with a piece on what the proposed changes mean for digital marketing in Australia and how marketing teams can plan for the changes set out in the draft Bill.

For context, read my earlier pieces on the fair-and-reasonable test and the OAIC’s guidance on marketing data collection. The Australian privacy reform guide connects the proposals, enacted changes and regulatory guidance.