My submission on the draft Privacy Bill
In Marketing We Trust's submission on the draft Privacy Bill has been lodged. We are awaiting further advice from the Attorney-General's Department, with practical implications for digital marketing to follow.
Advisory · #data
13 advisory articles tagged data
Your martech stack is a collection engine. The OAIC just said so.
The OAIC's APP 3 rewrite explicitly names AI inference, enrichment, scraping, and observation as collection events. The 'we didn't realise' defence has been retired.
Google just made your cookie banner the most important config
Google is removing Signals as a control on Google Ads cookies and IDs from 15 June 2026. Your cookie consent banner becomes the primary thing between user data and Google's ad business.
ACMA is enforcing, and the SMS Sender ID Register is coming
Over AUD 5.4 million in combined spam and gambling self-exclusion penalties. The SMS Sender ID Register becomes mandatory 1 July 2026. Unregistered sender IDs will be labelled Unverified.
The OAIC is looking at your marketing data practices
The regulator has explicitly named advertising technology, AI, and excessive data collection as priority areas for 2025-26. The first compliance sweep is underway and the first civil penalty has been imposed.
Your marketing systems are a ransomware target, the 72-hour reporting obligation
The Cyber Security Act 2024 requires ransomware payment reporting within 72 hours. Marketing databases, CDPs, and CRMs are targets. Marketing teams need to be in the incident response plan.
Digital ID opens to the private sector from 30 November 2026
15 million Digital IDs. 80 million verified transactions. From November 2026 the private sector can apply to participate. This is the new identity layer.
AI in marketing, what Australia's standards-led approach means for your team
No standalone AI Act. Standards-led, not legislation-led. But the automated decision-making disclosure obligation is binding from December 2026, and the ACL already applies to misleading AI outputs.
Your measurement infrastructure is already degraded
Google kept cookies, but modelling, consent choices and browser protections still leave measurement gaps. First-party data and server-side collection need to work alongside other ways of measuring effectiveness.
The fair and reasonable test, and why consent alone won't be enough
The proposed second tranche of Privacy Act reforms would introduce a test that is separate from consent. Having consent will not be sufficient if the use fails the test. This is the single largest structural risk to performance marketing in Australia.
The ACCC is coming for ad tech, digital platform competition reform
Australia is preparing an ex ante competition regime targeting dominant digital platforms. Ad tech and app marketplaces are first in line. Penalties up to 30% of turnover.
Consumer Data Right expansion, data portability is coming to lending
CDR is expanding into non-bank lending from mid-2026. The competitive dynamics of financial services marketing change when customer switching friction drops.
Privacy Act Tranche 1, the foundation shift
The first structural overhaul of the Privacy Act in decades is staging in through December 2026. Three changes matter directly to marketing and analytics teams.