The Privacy Act 1988 is the principal piece of Australian legislation protecting the handling of personal information. It regulates how Australian Government agencies and organisations with an annual turnover of more than AUD 3 million collect, use and disclose personal data, and it reaches foreign businesses that carry on business in Australia. For websites, it means telling visitors what you collect through cookies and why, under the 13 Australian Privacy Principles. Australia has no cookie-specific consent rule, but its enforcement is sharper than it was: as of October 2026, the Federal Court has ordered the first civil penalty under the Act, and a statutory privacy tort has applied since June 2025.
Following high-profile data breaches at Optus and Medibank, the Australian Government began a major overhaul of the Privacy Act. The 2022 amendments sharply increased financial penalties. The Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024, introduced a statutory tort for serious invasions of privacy, new mid-tier penalties and infringement notices, and stricter rules for children's data.
The Office of the Australian Information Commissioner (OAIC) has explicit authority to investigate breaches and seek civil penalties in the Federal Court, so the Act matters to any website that targets or collects data from Australian residents.
The 13 Australian Privacy Principles at a glance
At the core of the Privacy Act are the 13 Australian Privacy Principles (APPs). They cover the whole lifecycle of personal information, from collection to disposal.
| APP | What it covers | What it means for a website |
|---|---|---|
| APP 1 | Open and transparent management of personal information | An accessible, clearly written privacy policy |
| APP 2 | Anonymity and pseudonymity | Let visitors browse or enquire without identifying themselves where practicable |
| APP 3 | Collection of solicited personal information | Collect only what is reasonably necessary, by fair means |
| APP 4 | Dealing with unsolicited personal information | Destroy or de-identify data you did not ask for and could not have collected |
| APP 5 | Notification of the collection of personal information | Tell visitors at or before collection, including through cookies |
| APP 6 | Use or disclosure of personal information | Use data only for the purpose you collected it for, unless an exception applies |
| APP 7 | Direct marketing | Consent or a simple way to opt out of marketing |
| APP 8 | Cross-border disclosure of personal information | Overseas analytics and ad providers must handle data consistently with the APPs |
| APP 9 | Adoption, use or disclosure of government related identifiers | Do not use government identifiers as your own customer IDs |
| APP 10 | Quality of personal information | Keep data accurate, up to date and complete |
| APP 11 | Security of personal information | Reasonable steps against misuse, loss and unauthorised access |
| APP 12 | Access to personal information | Give people access to the data you hold about them |
| APP 13 | Correction of personal information | Correct data that is wrong when asked |
APP 1 requires entities to manage personal information in an open and transparent way. Your website must have an accessible, clearly written privacy policy that explains what data you collect, why you collect it and how users can complain about a breach. APP 5 expands on this by requiring you to notify individuals about data collection at or before the time you collect it.
APP 7 governs direct marketing. You cannot use or disclose personal information for direct marketing unless an exception applies, such as obtaining the user's consent. APP 8 restricts cross-border disclosures: before you disclose personal information to an overseas provider, you must take reasonable steps to make sure it handles the data in a manner consistent with the APPs.
If you fail to secure the data you collect, you breach APP 11. This principle demands reasonable steps to protect personal information from misuse, interference, loss and unauthorised access.
Cookies and personal information in Australia
The Privacy Act defines personal information as information or an opinion about an identified individual, or an individual who is reasonably identifiable. The interpretation of "reasonably identifiable" directly affects how you handle web tracking.
The OAIC treats online identifiers, such as IP addresses, device identifiers and certain tracking cookies, as personal information if they can be linked back to a specific person. If you use analytics cookies to build persistent profiles of user behaviour, or marketing cookies to target specific individuals across the web, you are likely collecting personal information under Australian law.
You must inform users about this collection. Your privacy documentation should explicitly detail the types of cookies you use, the data they collect and the third parties that receive it.
Reforms since 2022 and the new penalty tiers
The late 2022 amendments increased the maximum penalty for a serious or repeated interference with privacy to AUD 50 million, three times the value of any benefit obtained through the misuse of information, or 30% of a company's adjusted turnover in the relevant period, whichever is greatest. They also gave the OAIC enhanced information-gathering powers and the ability to share information with other regulators, both domestically and internationally.
The 2024 Act added layers below that maximum. A mid-tier civil penalty now covers interferences with privacy that are not serious, and the OAIC can issue infringement notices for specific breaches without going to court. The same Act created a statutory tort that lets individuals sue over serious invasions of privacy, in force since 10 June 2025.
Two further changes are due by December 2026: transparency duties for automated decisions that use personal information, and a Children's Online Privacy Code that the OAIC must develop. Businesses should treat privacy as a continuous operational task rather than a one-off legal checkbox.
Privacy Act reforms, 2022 to 2026
The first civil penalty under the Privacy Act
For years the higher penalties were untested. That changed in October 2025, when the Federal Court ordered Australian Clinical Labs to pay AUD 5.8 million in civil penalties over a data breach at its Medlab Pathology business, the first civil penalty ordered under the Privacy Act.
The case was about security and breach handling (APP 11 and the Notifiable Data Breaches scheme), not cookies. It shows that the OAIC now takes cases to court and that the court will impose real money.
How the Privacy Act compares to European law
Website owners often assume that following European rules automatically satisfies Australian law. While there is overlap, the frameworks differ in structure and scope, as the comparison with the GDPR's cookie consent requirements shows.
| Feature | Privacy Act 1988 (Australia) | GDPR (EU) |
|---|---|---|
| Maximum penalty | AUD 50 million, 3x benefit, or 30% of adjusted turnover | EUR 20 million or 4% of global turnover |
| Consent basis | Notice is the main duty, consent for sensitive data and some direct marketing | Strict opt-in required for non-essential cookies (prior consent) |
| Small business rule | Exempts most businesses under AUD 3 million turnover | Applies to all businesses regardless of size |
| Individual rights | Access and correction, plus the statutory tort since June 2025 | Includes erasure and data portability |
The European framework relies heavily on establishing a lawful basis for every data processing activity. The Australian system focuses more on whether the collection is reasonably necessary for an entity's functions. Australian law relies on transparency and notification, though specific activities like handling sensitive health information or some direct marketing do require consent.
Australian websites need a notice, not always a consent banner
Unlike the EU's ePrivacy Directive, Australia does not currently have a specific cookie law that mandates a prior-consent cookie banner for every visitor. The OAIC focuses on transparency rather than requiring an "Accept all" click before a page loads.
You must still notify users about your tracking practices. The OAIC expects a clear notice at or before collection (APP 5) and a privacy policy that covers cookies (APP 1), which many Australian websites provide through a visible cookie notice that links to the policy. If your tracking makes individuals reasonably identifiable, or feeds sensitive data, asking for consent first is the safer approach.
If your website also attracts visitors from Europe, California or Brazil, you need a consent mechanism that respects the strictest jurisdiction they come from. Geo-targeting lets you show an opt-in banner to European visitors and a notice to Australian traffic. Neighbouring New Zealand has its own Privacy Act, and the global compliance hub covers the other countries.
Extra-territorial scope: who must comply
You do not need an office in Sydney to fall under the Privacy Act. The legislation applies to any organisation that has an "Australian link".
Since the December 2022 amendments, a foreign organisation has an Australian link if it carries on business in Australia. It no longer matters whether it collects or holds the personal information in Australia. Selling goods directly to Australian consumers or targeting Australian users with localised advertising are typical signs of carrying on business there.
A short checklist for Australian privacy duties
Use this list to check a website against the Privacy Act:
- Confirm whether the Act applies: turnover above AUD 3 million, or one of the exceptions such as trading in personal information or providing health services.
- Run a cookie scan to see which cookies and trackers your site sets.
- Describe each type of cookie, what it collects and who receives it in your privacy policy (APP 1).
- Show a notice at or before collection that links to the policy (APP 5).
- Get consent for sensitive data and give an easy opt-out from direct marketing (APP 3 and APP 7).
- Check that overseas analytics and advertising providers handle data consistently with the APPs (APP 8).
- Prepare a breach response plan that meets the Notifiable Data Breaches scheme.
Questions about the Privacy Act and websites
Does the Privacy Act apply to small businesses?
Most businesses with an annual turnover under AUD 3 million are exempt. Businesses that trade in personal information, operate as health service providers or contract with the Commonwealth government must comply regardless of size.
What is a serious privacy breach in Australia?
A serious breach typically involves large volumes of sensitive data, systemic failures in security or intentional misuse of personal information. The OAIC evaluates the scale and impact to decide whether to seek the highest penalties. Since the 2024 reforms, less serious interferences can attract a mid-tier penalty or an infringement notice instead.
Are IP addresses considered personal information under the APPs?
Yes, if the IP address can be combined with other data to reasonably identify an individual. The OAIC advises treating persistent online identifiers as personal information.
How fast do I need to report a data breach in Australia?
You have up to 30 days to assess a suspected breach. Once you have reasonable grounds to believe an eligible data breach has happened, you must notify the OAIC and affected individuals as soon as practicable.
Do I need a dedicated Australian privacy policy?
You do not need a separate document if your global privacy policy clearly addresses the requirements of APP 1 and APP 5. Many companies add an "Australian privacy rights" section to their global policy to cover the local points.
Can individuals sue over privacy in Australia?
Yes, since 10 June 2025. The Privacy and Other Legislation Amendment Act 2024 created a statutory tort that lets individuals sue for serious invasions of privacy, separate from complaints to the OAIC.
Map your trackers before you write the notice
A privacy notice that lists your cookies is only as good as your list. If you operate across several jurisdictions, start by mapping every tracker your site sets, then decide where a notice is enough and where a visitor must opt in first.
Kukie.io detects first-party and third-party cookies and shows each visitor's region the consent model you set for it: a notice for Australian traffic, opt-in for the EU.
