Automated decisions: what marketers need to do
New transparency obligations start on 10 December 2026. Marketing teams need to know which automated decisions affect customers, what data drives them and what their privacy policy must explain.
Topics
Who controls access, sets the rules and authorises action online, and what choices people and organisations retain.
New transparency obligations start on 10 December 2026. Marketing teams need to know which automated decisions affect customers, what data drives them and what their privacy policy must explain.
How identifiers, devices and matching shape targeting and measurement across search, social, the open web, streaming and other advertising environments.
The OAIC has been busy. It has published new guidance, fact sheets and a flowchart on AI and automated decision-making transparency, ahead of obligations commencing on 10 December 2026. The requirements concern privac…
In Marketing We Trust's submission on the draft Privacy Bill has been lodged. We are awaiting further advice from the Attorney-General's Department, with practical implications for digital marketing to follow.
The government has released the Digital Duty of Care exposure draft, proposing stronger safety responsibilities for online services. Its “My Feed, My Way” proposal would give social media users a choice over personali…
Track Australian privacy reform: legislation, OAIC guidance, consultations and industry responses, with a focus on marketing, advertising, data and AI.
The OAIC's APP 3 rewrite explicitly names AI inference, enrichment, scraping, and observation as collection events. The 'we didn't realise' defence has been retired.
Google is removing Signals as a control on Google Ads cookies and IDs from 15 June 2026. Your cookie consent banner becomes the primary thing between user data and Google's ad business.
The OAIC has released the draft Children's Online Privacy Code. Its proposed direct-marketing rules require consent, consistency with the child's best interests, and personal information collected directly from the ch…
The regulator has explicitly named advertising technology, AI, and excessive data collection as priority areas for 2025-26. The first compliance sweep is underway and the first civil penalty has been imposed.
The under-16 social media restriction is live, with access removed to about 4.7 million accounts. That changes audience planning, but accounts are not unique people or a direct measure of advertising reach.
On the surface, the OAIC's first compliance sweep looks narrow. It is not. The regulator is shifting from reactive complaint handling to proactive market enforcement.
The intent is sound. The mechanism is blunt. Once minors present as adults to evade the ban, the safety systems that protect them stop working.
AI-generated avatars presented as genuine customers erode trust and risk breaching Australian Consumer Law. A note on what this means for marketers and platforms.
GraphQL defines what is requested. gRPC defines how it is delivered. SOAP-based systems used additional standards to express terms. None yet define why. That missing layer is what comes next.
MCP is the internal wiring that makes the agent capable. AIP is the diplomatic code that makes the agent trustworthy. One enables thought. The other governs action.
The proposed second tranche of Privacy Act reforms would introduce a test that is separate from consent. Having consent will not be sufficient if the use fails the test. This is the single largest structural risk to performance marketing in Australia.
Australia is preparing an ex ante competition regime targeting dominant digital platforms. Ad tech and app marketplaces are first in line. Penalties up to 30% of turnover.
The first structural overhaul of the Privacy Act in decades is staging in through December 2026. Three changes matter directly to marketing and analytics teams.