Australian Privacy Act compliance
In Australia, the risk isn’t the cookie. It’s the pixel.
Australia has no cookie consent law, so no banner is required by name. What the regulator does act on is tracking pixels quietly sending data to advertising platforms. ConsentBit holds those pixels until a visitor agrees, explains what each one does, and records the answer.
Google-certified CMP · IAB Europe registered CMP (ID 502) · 9 languages · Webflow, Framer, WordPress and any website builder
First visit to your site
We value your privacy
We use necessary cookies to run this site. With your permission, we’d also like to measure traffic and show relevant ads.
Until they choose, only necessary cookies run. The floating icon reopens their settings any time.
Meta and Google pixels wait for a yes.
Every choice recorded, with the date and time.
Australia’s privacy law, enforced by the OAIC.
The Privacy Act 1988 sets out 13 Australian Privacy Principles (APPs) covering how organisations collect, use, disclose and secure personal information. The Office of the Australian Information Commissioner (OAIC) enforces it. Businesses turning over A$3 million or less are generally outside the Act, with important exceptions.
Maximum civil penalty
A$50 million
or three times the benefit obtained, or 30% of adjusted turnover during the breach period, whichever is greatest.
In effect since
1988, with the 13 APPs from 2014
Small business threshold
A$3 million turnover, though health service providers and businesses trading in personal information are covered at any size
Five things the Privacy Act expects from your website
These come from the OAIC’s own guidance on tracking pixels, published in November 2024.
What OAIC requires
Collect only the minimum personal information you need (APP 3)
How ConsentBit handles it
Pixels in the Marketing category stay blocked until a visitor allows them.
What OAIC requires
Never collect sensitive information without consent (APP 3)
How ConsentBit handles it
Nothing loads until the visitor chooses, so health or similar data isn’t sent by default.
What OAIC requires
Don’t collect covertly. Be clear in your policy and notices (APPs 1 and 5)
How ConsentBit handles it
The banner names each category and what it does, and links to your policy.
What OAIC requires
Give a simple way to opt out of targeted advertising (APP 7)
How ConsentBit handles it
A preferences link reopens the panel, and withdrawing applies straight away.
What OAIC requires
Review your tracking tools regularly, not set and forget
How ConsentBit handles it
The cookie scan lists what each page loads, so you can check what is actually running.
The OAIC says the responsibility for a third-party pixel sits with the site that deploys it, not the platform that supplies it.
What a visitor sees, step by step
The banner asks before the advertising pixels fire.
They land on your site
The banner explains what is collected and why. Marketing pixels have not fired yet.
They choose
Accept all, Reject all, or pick categories in the preferences panel.
The choice takes effect
Allowed categories load. Anything they didn’t allow stays blocked, including third-party advertising pixels.
They can change their mind
A preferences link reopens the panel, which is the simple opt-out APP 7 asks for.
WHAT AUSTRALIA ASKS FOR, AND WHAT IT DOESN’T
No cookie law, but real obligations.
Australia never passed an equivalent of the EU’s cookie rules, which is why so many Australian sites have no banner. The Privacy Act still applies whenever a tracker collects personal information, and the OAIC has now acted on exactly that.
The Privacy and Other Legislation Amendment Act 2024 added a statutory tort for serious invasions of privacy and new penalty tiers, so the trend is towards more enforcement, not less.
Held until they agree
Here is what ConsentBit runs before a visitor chooses, and what changes after.
The regulator has started acting
On 24 June 2026 the Privacy Commissioner found that two health service providers, Medmate Australia and Monash IVF, interfered with people’s privacy by collecting sensitive information through third-party tracking pixels.
Turnover is not a safe harbour
The A$3 million small business exemption doesn’t apply to health service providers, businesses that trade in personal information, Commonwealth contractors or credit reporting bodies, whatever their size.
Selling into Europe as well? See what GDPR requires →
Put your tracking pixels behind a yes, free.
Records
A record of every choice, ready if the OAIC asks
Every choice is recorded with when it was made and which categories the visitor accepted or rejected. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
If a complaint lands, the question is what you collected and what the person agreed to. The log answers the second half.
FAQ
Australian privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies to Australian Government agencies and to businesses with an annual turnover above A$3 million. It also applies whatever your turnover if you are a health service provider, trade in personal information, are a Commonwealth contractor, a credit reporting body, or are related to a covered business.
Not by law. Australia has no cookie consent rule like the EU’s. A banner is still the practical way to meet the Privacy Act when your site uses tracking pixels, because it tells people what is collected and gives them the opt-out APP 7 expects.
They can. The OAIC says information such as an IP address, URL data or a hashed email can make someone reasonably identifiable when a platform matches it with what it already holds. It encourages organisations to err on the side of caution.
Sensitive information, which includes health, racial or ethnic origin, political opinions and sexual orientation, may only be collected with consent. On 24 June 2026 the Privacy Commissioner found two health providers had breached the Act by collecting it through pixels.
For serious or repeated interference with privacy, a court can order the greatest of A$50 million, three times the benefit obtained, or 30% of the company’s adjusted turnover during the breach period. The OAIC can also investigate on its own initiative and make determinations.
Thirteen principles covering open and transparent management of personal information, anonymity, collection, notification, use and disclosure, direct marketing, cross-border disclosure, data quality, security, access and correction. They are the operative rules of the Privacy Act.
GDPR requires consent before non-essential cookies; Australia does not. Australia exempts most small businesses, which GDPR never does. The common ground is sensitive data, transparency, and the expectation that people can opt out of targeted advertising.
See what GDPR requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Put your pixels behind a clear yes
Hold third-party pixels until a visitor agrees, give them a simple way to change their mind, and keep a record of every choice.
This page is a general overview of the Privacy Act 1988 and the Australian Privacy Principles, not legal advice. The Privacy Act covers far more than website tracking, including data breach notification, access and correction requests and overseas disclosure, which sit outside what a consent banner handles.