Privacy Act Tranche 1, the foundation shift
The first structural overhaul of the Privacy Act in decades is staging in through December 2026. Three changes matter directly to marketing and analytics teams.
Collections
Privacy reform and its commercial implications
A connected reading path through privacy reform and its consequences for marketing, advertising and measurement.
Begin with the published background below. Each piece reflects its publication date; proposals and historical commentary should be read in that context. New consultation responses and impact studies will join this collection as they are published.
Reading path
The fair and reasonable test, and why consent alone won't be enough
The proposed second tranche of Privacy Act reforms would introduce a test that is separate from consent. Having consent will not be sufficient if the use fails the test. This is the single largest structural risk to performance marketing in Australia.
What the OAIC's privacy sweep signals for marketers
On the surface, the OAIC's first compliance sweep looks narrow. It is not. The regulator is shifting from reactive complaint handling to proactive market enforcement.
The OAIC is looking at your marketing data practices
The regulator has explicitly named advertising technology, AI, and excessive data collection as priority areas for 2025-26. The first compliance sweep is underway and the first civil penalty has been imposed.
Your martech stack is a collection engine. The OAIC just said so.
The OAIC's APP 3 rewrite explicitly names AI inference, enrichment, scraping, and observation as collection events. The 'we didn't realise' defence has been retired.
Signal loss is accelerating, and waiting for legislation is the wrong play
Marketing effectiveness is being eroded by a structural decline in signal quality across the major platforms. The performance impact is happening before the regulatory impact.
Your measurement infrastructure is already degraded
Google kept cookies, but modelling, consent choices and browser protections still leave measurement gaps. First-party data and server-side collection need to work alongside other ways of measuring effectiveness.
Children's Online Privacy Code: draft launched
The OAIC has released the draft Children's Online Privacy Code. Its proposed direct-marketing rules require consent, consistency with the child's best interests, and personal information collected directly from the ch…
Australian privacy reform: timeline and guide
Track Australian privacy reform: legislation, OAIC guidance, consultations and industry responses, with a focus on marketing, advertising, data and AI.
Digital Duty of Care: the draft is out
The government has released the Digital Duty of Care exposure draft, proposing stronger safety responsibilities for online services. Its “My Feed, My Way” proposal would give social media users a choice over personali…
My submission on the draft Privacy Bill
In Marketing We Trust's submission on the draft Privacy Bill has been lodged. We are awaiting further advice from the Attorney-General's Department, with practical implications for digital marketing to follow.
The OAIC has been busy: new AI transparency resources
The OAIC has been busy. It has published new guidance, fact sheets and a flowchart on AI and automated decision-making transparency, ahead of obligations commencing on 10 December 2026. The requirements concern privac…
Automated decisions: what marketers need to do
New transparency obligations start on 10 December 2026. Marketing teams need to know which automated decisions affect customers, what data drives them and what their privacy policy must explain.