Australian privacy · A living reference
Track Australian privacy reform: legislation, OAIC guidance, consultations and industry responses, with a focus on marketing, advertising, data and AI.
The first tranche is enacted and the privacy tort is in force. The next reform package remains an exposure draft in the official consultation record reviewed; consultation closed on 18 September 2026. Automated-decision transparency starts on 10 December 2026. The Children’s Code must also be registered by that date; its final text and commencement need to be checked when published.
It is a sequence of changes to Australia’s framework for handling personal information. The Privacy Act Review supplied the reform agenda; the 2024 Act implemented an initial set of measures, while later proposals and guidance continue to develop.
This hub concentrates on the implications for marketing, advertising, data and AI. Its timeline records the evidence. Related writing contains Paul’s published analysis.
The law already enacted. The 2024 amendment Act has staged commencement dates. The new tort began on 10 June 2025; automated-decision transparency has a 10 December 2026 start. The tort is a court-based remedy with specific conditions, not a general entitlement to compensation for every privacy complaint.
The proposed next tranche. The August 2026 consultation concerns an exposure draft. The Minister’s announcement identifies fair-and-reasonable handling, stronger consent, controls on trading in personal information and a proposed erasure right for large digital platforms. Those proposals need to be followed through any subsequent bill, passage and commencement.
Paul’s 18 September submission for IMWT supports the reform objectives and focuses on whether advertisers can perform the duties assigned to them when the necessary controls sit with platforms. The post summarises the arguments and links to the full submission.
Implementation and regulatory practice. The OAIC’s APP 3 update, tracking-pixel guidance and enforcement priorities explain how existing requirements apply to contemporary practices. Guidance updates should be read in that context. The Children’s Code is a separate instrument being developed under the Privacy Act.
| Source | What it contributes |
|---|---|
| Attorney-General’s Department | Reform policy, exposure drafts and consultations. |
| Parliament and the Federal Register of Legislation | Legislative progress, enacted text and commencement provisions. |
| OAIC | Privacy regulation, guidance, enforcement and development of the Children’s Code. |
| ADMA | Data-driven marketing perspectives and submissions. |
| AANA / Marketing Association of Australia | Advertising and marketing advocacy, policy resources and member alerts. |
AANA and ADMA announced their unification on 11 June 2026. The AANA site now identifies the organisation as the Marketing Association of Australia. Historical sources retain the name under which they were issued.
Industry positions are part of this record. For example, ADMA’s August 2025 submission calls for proportionate reform, while AANA’s policy hub sets out concerns about targeting and consent. These positions are attributed to their authors.
Use the year and milestone filters to move between legislation, consultations, guidance, enforcement and industry contributions. Every entry links to the Australian source supporting it. The dates ahead panel identifies the next scheduled steps.
The Privacy Reform collection holds the broader body of writing. The related articles below provide starting points on the Children’s Code, automated decisions and regulatory enforcement.
Latest developments
Newest first. Work backwards through the developments and their original dates.
A selected Australian source record, checked on 7 October 2026. Newest developments appear first; 2023–24 entries provide context. Industry views, regulatory guidance and changes to the law are labelled separately.
Share this view using the address in your browser.
24 milestones · newest to oldest
Updated APP 1 guidance, fact sheets and a flowchart explain the disclosure obligation commencing on 10 December 2026 for qualifying decisions.
OAIC · enacted obligation, future commencement
Read the SignalIMWT supports the reform objectives and asks for clear platform responsibilities, a consent-to-trade transition for existing customer data and commencement dates that account for supplier dependencies.
IMWT · response to the proposed second tranche
Read the AdvisoryThe published deadline for responses passes. The consultation page says the bill remains subject to further government consideration.
Attorney-General’s Department · proposed second tranche
The government releases the Personal Data Protection exposure draft, covering a fair-and-reasonable test, consent, trading in personal information and erasure proposals.
Attorney-General · proposed second tranche
The Privacy Commissioner publishes findings from a scan of 50 health-service websites and follow-up engagement, including gaps in organisations’ knowledge of their pixels.
OAIC · selected health-service sample
The scan took place in October–November 2024. This is the publication date of the findings, not a new 2026 scan or a population-wide measure.
The published consultation period ends. The OAIC’s next work includes considering submissions and assessing implementation impacts before finalising the Code.
OAIC · proposed Code
The OAIC invites views on guidance for the already-legislated APP 1 transparency obligation. Submissions are due on 15 June.
OAIC · guidance development
The OAIC expands APP 3 guidance with contemporary examples involving AI, scraping, pixels and data broking. It describes the changes as clarification of existing requirements.
OAIC · APP 3
AANA’s public regulatory archive lists a member alert on the exposure draft, recording industry engagement during the consultation.
AANA · member alert
Only the public listing and excerpt were reviewed. The member-only analysis is not represented here.
The OAIC opens consultation on proposed safeguards for covered online services used by children, including direct-marketing and deletion provisions.
OAIC · proposed Code
Read the SignalADMA publishes Peter Leonard’s discussion of pixel tracking and data governance, emphasising exposure under existing requirements while further reform develops.
ADMA · marketing data governance
A targeted review of around 60 businesses across six sectors is announced for January 2026, focusing on policies for in-person data collection.
OAIC · APP 1.4
This is the announcement date. The source sets January 2026 as the planned sweep period and does not report findings.
Read the Field NoteThe Federal Court orders Australian Clinical Labs to pay $5.8 million over the 2022 Medlab breach. The OAIC reports this as the first civil penalties under the Act.
Federal Court · pre-existing obligations
The OAIC announcement is dated 9 October and says the orders were made the previous day. The case concerns a 2022 breach; the penalty is not attributed to the 2024 reforms.
ADMA’s response argues for proportionate reform and raises concerns about overlapping marketing rules. These are the association’s policy positions.
ADMA · response to the 2025 issues paper
1 August is the date printed on the submission, not a verified upload or receipt date.
The OAIC’s 2025–26 regulatory priorities identify pixel tracking, data brokerage, AI-related risks, and excessive collection and retention.
OAIC · enforcement focus
The OAIC seeks industry, civil-society and academic views to inform the draft Code, with submissions closing on 31 July.
OAIC · Children’s Online Privacy Code
The consultation page records 12 June 2025 for the issues-paper update. Its later page-update date is not treated as the consultation launch.
A new court-based avenue for serious invasions of privacy takes effect. It has its own thresholds and exceptions; the OAIC does not administer the tort.
Courts · statutory tort
Most Schedule 1 changes and the doxxing offences commence. The tort and automated-decision transparency provisions have later dates.
2024 Act · specified provisions
The 2024 Act is enacted. Its commencement table gives different dates for different provisions.
Federal Register of Legislation · Act No. 128
The bill passes Parliament. The Attorney-General’s Department records that it advances 23 proposals from the government’s review response.
Parliament · first tranche
The regulator publishes guidance on applying existing privacy obligations to third-party pixels, including minimisation, sensitive information and overseas disclosure.
OAIC · existing law and marketing technology
The Privacy and Other Legislation Amendment Bill 2024 is introduced in the House of Representatives. It is the first legislative tranche following the review.
Parliament · first tranche
The government publishes its response. Agreement to a proposal sets a policy direction; implementation still requires the relevant legal steps.
Attorney-General’s Department · reform foundation
The Attorney-General releases the review report, establishing the proposals that later reform stages draw on.
Attorney-General’s Department · reform foundation
No matching milestones are recorded here. An empty result is an evidence gap. Try another selection or reset the filters.
Evidence checked through 7 Oct 2026.
Dates identify the event stated in the source. Publication dates, submission dates and legal commencement dates are distinguished where they differ.
The Federal Register’s commencement table is used for the 2024 Act: Royal Assent on 10 December; most substantive initial provisions on 11 December.
Industry submissions and commentary express the named organisation’s position. They do not establish the law or Paul’s view. Member-only material is not summarised beyond publicly available text.
This is a selected reform and implementation timeline, not a complete register of Australian privacy decisions. Future deadlines are shown separately from completed milestones.