Privacy reform and marketing in 2026: where Australia stands and what multi-market brands should do
Updated: Nov 3
First published 29th September 2024. Updated 25th October 2026 to cover the 2024 reforms and the 2026 exposure draft.
When we first wrote about Australia's privacy reforms in 2024, the legislation was still a set of proposals. Since then the first tranche has become law and the second has been released as an exposure draft. For brands that operate in more than one market, the bigger picture matters as much as the detail: privacy rules are converging on similar principles, even where the specific obligations differ.
What has already changed in Australia
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10th December 2024. Its main changes for marketers:
A statutory tort for serious invasions of privacy, in force since 10th June 2025, giving individuals a direct right to sue
Stronger enforcement, including new tiers of civil penalties and infringement notices for the Privacy Commissioner
Transparency about automated decisions. From 10th December 2026, privacy policies must explain when personal information is used in automated decisions that significantly affect individuals
A Children's Online Privacy Code, which the Information Commissioner is developing for services likely to be accessed by children
What the second tranche proposes
In 2026 the government released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with consultation closing on 18th September 2026. It is not yet law and may change. The proposals most relevant to marketing include:
A fair and reasonable test for collecting, using and disclosing personal information, which applies even where consent has been given
A defined meaning of direct marketing, with opt-outs required in each communication
Consent for trading in personal information, subject to exceptions
Wider definitions, so information generated or inferred about a person can count as collected and precise location tracking data is treated as sensitive
Several reforms agreed in principle in 2023, including removal of the small business exemption, do not appear in the draft.
The international picture
For brands selling across markets, Australia is one of several regimes moving the same way:
The EU and UK apply the GDPR and UK GDPR, with consent requirements for non-essential cookies and tracking. Google requires Consent Mode for personalised advertising to users in the European Economic Area and the UK
The United States has no single federal privacy law, but a growing number of states have comprehensive privacy laws with opt-out rights for targeted advertising and the sale of data
Platforms are setting their own rules. Browser restrictions on third-party cookies, app tracking permissions and email sender requirements change what is possible regardless of local law
The common direction is clear: more transparency, more choice for individuals and less tolerance of data collected without a clear purpose.
Building one approach that holds up
Rather than meeting the minimum in each market separately, most multi-market brands are better served by one consistent standard set close to the strictest regime they operate under.
Map the data. Know what personal information is collected, where it goes, which tools receive it and why
Apply a fair and reasonable test now. Ask whether each use would be expected by the customer and is proportionate to the benefit. It is good practice in every market and likely to become law in Australia
Use a consent management platform properly. Configure regional consent, connect it to Google Consent Mode and platform tags and test that tags respect the choices people make
Move measurement server-side. Server-side tagging and conversion APIs give more control over what is shared with each platform, while keeping measurement accurate
Review automated decisions. Identify where personalisation, scoring or eligibility rules affect people significantly and prepare the transparency Australian law will require from December 2026
Keep marketing permissions clean. Record how and when consent was given and make opting out simple in every channel
Privacy compliance is often framed as a cost to marketing. In practice, clean consented first-party data is now one of the most valuable assets a marketing team can hold. It improves measurement and platform performance and it travels across markets.
This article is general information, not legal advice. Businesses should seek advice on their specific obligations in each market.
Sources: Privacy and Other Legislation Amendment Act 2024 (Cth); Herbert Smith Freehills Kramer, The draft tranche 2 Privacy Act reforms, September 2026; Office of the Australian Information Commissioner; IAPP US State Privacy Legislation Tracker; Google Ads Help, About consent mode
