Short version: The rules on how Australian businesses use personal data for marketing are tightening. A new transparency obligation starts on 10 December 2026, and a second round of Privacy Act reforms went out for consultation in August 2026. If passed as drafted, it would require consent before personal information is shared to support direct marketing. Google kept third-party cookies in Chrome, so the push to change isn't coming from browsers. It's coming from regulation and customer trust. Businesses that own consented first-party data will be in the strongest position.
This article is general information, not legal advice. Check your specific obligations with a privacy lawyer.
What's already changed
The Privacy and Other Legislation Amendment Act 2024 was the first tranche of reform. One of its obligations starts on 10 December 2026. From then, businesses covered by the Privacy Act must explain in their privacy policy when a computer program uses personal information to make, or substantially help make, decisions that could significantly affect a person's rights or interests. The policy must cover the kinds of personal information used and the kinds of decisions made (OAIC).
Most routine ad targeting is unlikely to meet the "significantly affects" threshold. But automated pricing, credit, eligibility or application screening may. If you use AI or automated tools in any of those, review your privacy policy now.
What's proposed next
On 31 August 2026, the Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with around 40 proposals. Consultation closed on 18 September 2026 (Russell Kennedy). The proposals most relevant to marketing:
- A "fair and reasonable" test for collecting, using and disclosing personal information. It weighs seven factors, including reasonable expectations, transparency, data minimisation and genuine choice (Russell Kennedy).
- A broad definition of direct marketing. It covers marketing directed at someone using their personal information, whether they're targeted individually or as part of a wider audience. It expressly includes email, SMS, targeted social media ads and online behavioural advertising (Gadens).
- Consent before "trading" personal information. This would include disclosures that support or inform direct marketing. Gadens gives cookies and pixels in programmatic advertising as an example (Gadens).
- A 72-hour deadline to notify the regulator of an eligible data breach, and precise geolocation data treated as sensitive information (Russell Kennedy).
The draft does not remove the small business exemption. Businesses with annual turnover of $3 million or less remain generally exempt (Gadens).
Why "we're under $3 million" isn't the end of it
The exemption has exceptions. A small business is covered regardless of turnover if, among other things, it's a health service provider or it's trading in personal information. That means providing a benefit to collect personal information, or disclosing it for a benefit (OAIC, small business). Health and social assistance is also Australia's fastest-growing industry, up 6.6% in 2024–25 (ABS). So a large share of new small businesses fall straight into the covered category.
Every business, exempt or not, still deals with the platforms' own rules and with customers who expect their data to be handled well.
What customers think
The OAIC's 2023 community attitudes survey found (OAIC, ACAPS 2023):
- Only 32% of Australians feel in control of their data privacy.
- 47% had been told their information was involved in a data breach in the previous year.
- 25% had been unable to unsubscribe from marketing communications, and 21% had received unsolicited direct marketing.
- 89% believe online tracking, profiling and targeted advertising aimed at children is unfair and unreasonable.
When people feel this way, a broken unsubscribe link or a pre-ticked box doesn't just break a rule. It loses you a customer.
Cookies aren't going away, but that's not the point
In April 2025, Google confirmed it would keep its current approach to third-party cookies in Chrome and not roll out a new prompt (Google Privacy Sandbox). Some businesses took that as a reason to wait. The draft reforms target what you do with personal information, whatever the technology. Pixels, customer lists and behavioural targeting are all in scope of the proposed definitions.
A first-party data playbook for SMBs
- Audit what you collect. List every form, pixel, tag and integration on your site, plus what each one sends and to whom. Remove anything you don't use. Data minimisation is one of the proposed fairness factors.
- Get consent you can prove. Use clear opt-ins on forms and checkouts, store the time and wording of each consent, and make unsubscribing a single click.
- Centralise in a CRM. One clean customer record per person, synced to email, ads and sales, is worth more than ten disconnected tools.
- Use platform tools built for first-party data. Google's Customer Match lets you reach your own customers across Search, YouTube, Gmail and Display. Lists expire after 540 days unless refreshed, so sync them regularly rather than uploading once (Google Ads Help). Server-side conversion tracking and enhanced conversions improve measurement without relying on third-party cookies.
- Update your privacy policy. Make it plain English, say what you collect and why, and add the automated decision-making disclosures if they apply to you from 10 December 2026.
- Build audiences from behaviour, not just lists. Segment by what customers bought, enquired about or engaged with, then use those segments to target, exclude and personalise.
The opportunity
Stricter rules hurt businesses that rely on borrowed data. They help businesses with a direct, consented relationship with their customers. Their audiences are more accurate, their measurement is more reliable, and their marketing is less exposed to whatever the next rule change brings.
Round15 helps Australian small and medium businesses set up consented first-party data, analytics and audience activation across Google, Meta and email. Book a free consultation to review your current data set-up.
Sources are linked throughout. Proposed reforms may change before or after they are introduced to Parliament. Written November 2026.
