The way marketing departments in Australia handle customer information – from collection and deletion to how it is put across to the client – may be altered by the 2026 Privacy Act reforms. One should not make of the proposed Privacy Amendment (Personal Data Protection) Bill 2026 a finished rulebook though. Until one has had a chance to review the legislation, regulations and any guidance that will be finalised, it is wiser to get ready for what is coming and hold off on making hard and fast legal pronouncements.
There is no mistaking the practical consequences for Australian firms. Closer examination will be heaped on everything from consent and first-party data to cookies, tracking pixels, AI, third parties and your CDP. In my experience doing tourism and guest-experience work, I have found people do not mind being communicated with if there is some utility to it. They are put off when a business appears to know more than it lets on or makes an issue of privacy like a mozzie at the ear. That is why data privacy in AI marketing deserves close attention. I am Henry Northwood.
Is it law?
Not in the sense of a compliance deadline you can take for granted. The 2026 reforms are best seen as an ongoing matter of policy and legislation. The Attorney-General’s Department, the Office of the Australian Information Commissioner and the Government could yet put out an exposure draft, consultation paper or some other form of implementation guidance.
One must appreciate the difference. An exposure draft might put forward some wording and a consultation paper will point the way, but neither of them in and of itself imposes a legal duty. For now, marketing teams would do well to note down their assumptions and watch for the final word.
Do Your Due Diligence
It is better to go to the OAIC for authoritative material on the Australian Privacy Principles and reform than to put stock in a vendor’s sales deck or something on social media. Michelle Rowland has been part of the political conversation on privacy reform, but her statements as a minister ought to be read in context with the Bill and the explanatory memorandum. You might find commentary from White & Case or Allens helpful in spotting an issue, but it is no substitute for the text of the law or a proper lawyer in Australia.
Marketing And The New Expectations
Under the proposed changes to Australian privacy law, the bar will be raised for the use and disclosure of data, sensitive or otherwise. It is not a case of “we have a database”. The question becomes whether you can account for why a field is there, who is to see it and when it will be done away with.
More is involved than a revision of the privacy policy. It will affect the way you plan a campaign, configure your CRM, set up loyalty programmes and draw up vendor contracts.
Reality Check
You might think a tick in a box gives you carte blanche to put the information to any marketing purpose. But consent has to be fit for the purpose. A pre-ticked box or some obfuscatory language on a form leaves you with little to stand on even if there is a statement of consent in there. Someone may want an update on an order but not be in favour of having his data matched for a promotional message.
Then there is the disparity between the front end and the back end. The form says one thing and the analytics tool or advertising platform another. A regulator or a journalist will not be slow to spot it; a privacy impact assessment will show you the mismatch first.
On Cookies, Pixels And Ads
As expectations evolve, so too will the need for circumspection in marketing consent across Australia. The same person in your audience may present different questions of law and experience when it comes to SMS, remarketing or behavioural profiling.
In the case of tracking pixels and cookies there are often several parties in play. Before the tea has gone cold a visitor to the site will have had dealings with the social media platform, an ad network, the analytics provider and a consent-management system as well as the business.
Make A Record Of It
Your consent trail should be able to tell you what was put to the individual and what they put themselves to, and when. It should make plain the distinction between optional marketing tech and what is necessary, and indicate how consent can be retracted and to which system the instruction was given.
A retailer will require a functional cookie to have an active shopping basket, for instance. One should not infer from that alone the right to put in a tracking pixel to build an audience. And when a customer retracts consent, it is incumbent on the relevant systems to register the withdrawal, not just the preference centre.
“Legitimate business interest” and a pre-existing relationship with a customer are no panacea for marketing issues; do not make that assumption. They are fact-dependent and can be very specific in a legal sense. In operational terms it is better to establish the purpose and see what the lawful basis and communication rules are for it before anything else.
Strengthen First-Party Data Practices
In Australia first-party data strategies are of greater import as companies seek information they can trust without recourse to the kind of third-party tracking that is hard to fathom. The objective is not to amass everything one can but to be responsible about what is gathered and what the customer would expect of you.
Compliance demands a distinction be made between personalisation that is of some use and superfluous hoarding. A café loyalty scheme has need of a name, how to get in touch and a record of purchases. It has little call for where a customer is at any given moment. You would think this self-evident but databases have a way of turning into attics with who knows what in the back corner.
Make Use Of A Data Map
Put together a straightforward map of your major sources of data and what is being collected from them, why, for how long and by whom. Make sure to note any third-party vendors and what controls a customer has at hand. This covers web forms, live chat, mobile apps, competitions, call recordings, offline events and the like.
Data minimisation ought to be part of the design, not something to put right in the wake of an incident. If a form builder makes it simple to put in twelve fields for a campaign that only calls for three, resist the temptation. An audience that is not being used should have a set date for review or deletion so as not to be left to drift.
| Marketing Area | Common Risk | Practical Preparation |
|---|---|---|
| Lead forms | Where the purpose is in doubt or there are too many fields | Account for each one and jettison what is unneeded |
| Email and SMS | A consent withdrawal should not be reflected in every system | Test the end to end process for suppression and unsubscription |
| Cookies and pixels | Optional tracking comes up before the user has made a choice of substance | Keep analytics and advertising separate from what is necessary |
| Customer data platforms | Profiles may be pulling together information for different ends | Document the matching rules and access |
| Third-party vendors | Oversight is lacking and data is being put out there | Look over the contracts, subprocessors and deletion controls |
| AI marketing | Personal details go into prompts or models unchecked | Set approved-use rules and keep a record of human review |
Your own data map will tell you more than some broad industry figure. Say an audit of a 50,000 profile campaign database turns up 2 per cent with no discernible purpose; you have 1,000 records to go after. The numbers are for illustration but the point is a sizeable clean-up can result from a small percentage.
Guarding AI Marketing Workflows
Whether for predictive scoring, copy, segmentation or analysing a campaign, AI is of service. But it is also a quick way to get a private record to a third party the customer did not count on.
The rule of thumb for sound privacy is not to feed an AI tool with personal data simply because there is an input box. Teams must be clear on whether the tool is retaining or training on prompts, passing them offshore or opening them to human review.
Keep Humans In The Loop
There is a place for human judgement when an AI is making a recommendation on a person. The model could conclude someone is of means or prone to churn, or has an interest in a matter of sensitivity. Such inferences can be unfair or even wrong despite the data appearing innocuous.
AI governance needs to address testing, due diligence on suppliers, escalation and permissions. Consider prompts and output as business records if they pertain to an identifiable individual.
Many make the error of supposing the removal of a name is enough to anonymise. Pseudonymised data is still personal if re-identification is feasible; device identifiers, dates and purchase patterns are enough to trace back to the person.
Be Ready For Consumer Rights
It is likely consumer rights will be more readily exercised and in plain sight. One can anticipate reform in the direction of transparency, tighter control of personal information, erasure requests and rules on high-risk practices and targeted advertising.
Some care is called for in the Australia right to erasure debate. A customer can put in a request for his or her personal information to be expunged, yet that may come up against legal retention requirements, the need to have transaction records on file, fraud prevention, an open complaint or any number of other operational imperatives. It is not for marketing to put forward a promise of immediate deletion without having gone through the proper channels.
Make Requests Manageable
Customers should be given a straightforward way to find out what is being held on them, make corrections, pull back their consent for marketing or call for deletion. Put the request on record and verify identity in proportion; then identify the systems at play and explain the outcome in terms anyone can understand.
Digital ID will have its part to play in how an organisation manages service access and confirms who is who, but one would be unwise to see it as some kind of privacy panacea. While good identity verification lessens the chance of impersonation, it raises issues of its own over data collection, third-party access and disclosure.
There are seven types of privacy that get talked about: bodily, territorial, communication, financial, data, identity and associational. As broad thinking categories they have their uses, but do not let them stand in for the rights and definitions you will find in the Privacy Act 1988 (Cth) or whatever reform legislation eventuates.
A Practical Compliance Plan
The fact that reform is being mooted is no reason for a marketing team to scuttle every campaign. What is required is a sensible plan of preparation so as to avoid unnecessary work down the track and to put current data practices in a defensible light.
One day is all it takes to put the highest risk and volume journeys first: AI tools, advertising audiences, email and SMS subscriptions, lead forms, website consent and any deletion requests from customers. The database can wait until day two, but do not lose sight of it. Have an owner on the case for monitoring privacy reform and note the date of each review.
You will want to map out the personal and sensitive information in your customer data platforms and with suppliers and across marketing systems. See if your collection notices are in line with how data is actually used and disclosed. Put the workflows for consent, correction, access and the like to the test. Look over your cookies, tracking pixels and data-sharing settings and the like. For high-risk campaigns, profiling and the use of digital ID or AI in marketing, complete a privacy impact assessment.
Vendor contracts should be updated as to security, breach notification and deletion obligations. And put marketing, sales, technology and customer service through their paces with training that is relevant to the Australian context.
An Eye On Incidents
When it comes to a data breach, response has to be practical, not a show. Staff must be clear on who is to be told first, how to cordon off access, what evidence to put aside and when to bring in the privacy experts, as well as which suppliers to put on the phone.
Try a tabletop exercise with something plausible, an employee putting customer details in an AI tool that has not been approved for instance, or a tracking vendor with the wrong segment. Time how long it takes to go from discovery to escalation. There is little point in having a plan that is confined to a folder any more than there is in leaving a spare tyre at home.
Common Privacy Questions
With the mix of proposed laws, old obligations and new technology, these are bound to be asked. The following short answers distinguish between what can be done in advance and what is still subject to the law.
What is in store for 2026?
Reforms are likely to put more teeth into accountability and consumer control, as well as consent, data governance and deletion rights. But the precise obligations will be in the final form of the Privacy Amendment (Personal Data Protection) Bill 2026 and its rules. Consider present proposals a signal for preparation.
Can I have my information deleted?
An organisation can be asked to do so, but it will want to measure the request against its duties under the Privacy Act 1988 (Cth), security and record-keeping. Marketing should have a path for such requests but not be in the business of promising deletion where exceptions hold.
Is Australia making a push for Digital ID?
It is in the works, but that does not obviate the requirement for safeguards. Before an organisation makes use of a digital ID service it has to give thought to data minimisation, retention, security and so forth.
And the seven types of privacy?
Bodily, territorial, communication, financial, data, identity and associational. They are a help in spotting risks beyond an email address or name but are not to be taken as the full legal test in Australia.
Do Tranche 2 reforms apply across the board?
Not of themselves. They will have bearing on certain activities or technologies by virtue of the final scope. Even if a proposal is not directly applicable, it is a sound benchmark for bettering your approach to vendor oversight and transparency.
Make Privacy Part Of Marketing
In the end, the direction is plain: secure what you have, be more forthcoming, let the customer have his say and collect only what is needed. That will put a team in good stead when the 2026 reforms are made concrete, provided they have clean first-party data and sensible controls on AI.
Henry Northwood would put it this way: do not let privacy be a wet-season road closure for the whole trip, have it in your route plan. Document your assumptions, check the official line and make sure your legal advice is up to date. That is the way to remain useful and not creepy in Australia.
