In Brief
Businesses that earn money from personal information should read the government's draft privacy bill as a test of their revenue. The draft would require collection, use and disclosure of personal information to be fair and reasonable, with limited exceptions, and would generally require consent before a business trades it. No bill had been introduced by 25 October 2026. Boards should ask management for a list of exposed revenue lines and a range for the margin at risk by early 2027.
The day the ad boom met the privacy bill
On 31 August 2026 the Attorney-General’s Department released a draft privacy bill, the centrepiece of a reform package of about 40 proposals. On the same day, IAB Australia reported that online advertising had reached $19.8 billion in 2025-26, up 14 per cent. That is about $700 for every person in the country.
The draft could reach some of the ways that money is made. Take a hypothetical shopper who looks at running shoes on a retailer’s website at lunchtime. That evening an ad for the same shoes appears on a news site. A pixel, a small piece of tracking code on the retailer’s site, had reported the visit to an advertising platform. Under the draft, each company in that chain that is covered by the Act would generally need its handling to be fair and reasonable. If the hand-off counts as a trade, the retailer would generally need the shopper’s consent.
The draft would mainly apply to organisations already covered by the Privacy Act, including most businesses with turnover above $3 million. It would also reach some smaller businesses that trade in personal information. Consultation closed on 18 September. No bill had been introduced by 25 October, and the department says the draft remains under consideration, so its detail may change.
For a board, the draft raises a commercial question: how much of our revenue depends on data we could not justify using if this became law? Answering it takes a list of exposed revenue lines and a range for the margin at risk.
How the fairness test works
The draft would generally require collection, use and disclosure of personal information to be fair and reasonable, with exceptions such as uses required by law. To judge fairness, a business weighs seven matters, and together they read like an investment appraisal. Would a reasonable person expect it? Does it relate to what the business does? Was the business open about it? Could less information have done the job? Did the person have a genuine choice? Is the risk of harm in proportion to the benefit? For a child, are the child’s best interests a primary consideration?
Consent counts in the weighing through the question of genuine choice, and the test also covers uses a customer has agreed to.
The draft also adds a consent rule for trading personal information, which it defines as disclosing it for money or other consideration, or for direct marketing. A trade would generally need consent, subject to four carve-outs and some exceptions. The consultation paper says trades may include the cookies and pixels used in automated ad buying.
The public already leans the draft’s way. In the OAIC’s March 2026 survey, 96 per cent said selling or trading personal information is unfair or unreasonable. Just 10 per cent said organisations’ practices are usually fair.
The regulator weighs necessity and proportionality under current law too. In 2025 the Privacy Commissioner found that Kmart’s facial recognition cameras scanned every shopper in 28 stores to catch a few refund fraudsters. The Commissioner judged that out of proportion to the problem. Kmart has sought tribunal review, with hearings expected in early 2027.
In February 2026 the Administrative Review Tribunal found that Bunnings’ earlier use of facial recognition, aimed at serious retail crime, did not breach the collection rules. It upheld findings that Bunnings had failed to tell customers properly about the cameras and lacked adequate privacy procedures.
Tracking pixels have drawn findings too. In June 2026 the Commissioner found that the telehealth provider Medmate and the fertility clinic operator Monash IVF had interfered with privacy. Pixels on their websites had collected visitors’ health information without consent.
Four steps before February 2027
We recommend four steps, timed so the board can decide at its February 2027 meeting.
By 27 November 2026: list the revenue lines. Ask the CFO, with the chief marketing officer and privacy officer, to list every revenue line and approved investment that depends on collecting, inferring or sharing personal information. Examples include a retailer’s media network, a publisher’s programmatic advertising (the automated auctions that sell ad space) and a bought-in data feed that a lender uses to price risk.
By 18 December 2026: map who receives the data. Ask general counsel to record what personal information the company passes to each advertising platform and data partner, and whether each hand-off would count as a trade. Record in writing who decides what the data is used for. The draft carves out disclosures to a processor where both parties are covered by the Act and the processor follows the company’s written instructions for purposes the company specifies.
By 29 January 2027: put a range on the margin at risk. Ask the CFO to estimate, for each exposed line, how much contribution margin the company would lose if some customers refused consent, and what redesign would cost. Take a hypothetical retail media line that contributes $10 million a year, of which $3 million comes from hand-offs that would need consent. If four in ten customers refused, $1.2 million would be at risk before any redesign cost. No Australian data yet exists on refusal rates under the proposed rule, so the paper should show a range and state its assumptions.
At the February 2027 board meeting: decide each line. For each exposed line, the board decides whether to keep, redesign or exit it, and confirms that any continuing use is fair and reasonable and has the consent it needs. Name one executive to own the remediation, and minute the decisions. Before releasing capital for any new use of personal information, require management to explain in writing why the use is fair and reasonable after weighing the seven matters.
Our recommended timetable to February 2027
| Action | Owner | Timeline | Priority |
|---|---|---|---|
| List every revenue line and approved investment that depends on personal information | CFO with chief marketing officer and privacy officer | By 27 November 2026 | critical |
| Map the personal information passed to each advertising platform and data partner; record which hand-offs would be trades and who decides how the data is used | General counsel with chief marketing officer | By 18 December 2026 | high |
| Estimate the contribution margin at risk for each line as a range of consent refusal rates and redesign costs; present the assumptions to the audit and risk committee | CFO | By 29 January 2027 | high |
| Decide whether to keep, redesign or exit each exposed line; name a remediation owner; adopt a written fairness case as a condition for new data-dependent investment; minute the decisions | Board, advised by the audit and risk committee | February 2027 board meeting | high |
The decision for the board
Under current law, the maximum civil penalty for a serious interference with privacy is $50 million or more. The draft would make an unfair collection, use or disclosure a breach of the privacy principles, unless an exception applies.
The board must decide which data uses to change, put behind consent or stop, and how much revenue those decisions could put at risk. The chair should schedule that decision for the February 2027 meeting, with management’s list and range in the board papers.
Ask management: if a customer asked why we shared their information with an advertiser, what would we tell them?
The bill. Privacy Amendment (Personal Data Protection) Bill 2026, exposure draft; commencement table blank.
Fairness (new APP 3). Replaces APPs 3, 4 and 6. APP 3.1 requires fair, reasonable and lawful handling; APP 3.2 lists the seven matters; APPs 3.3 and 3.4 set out the exceptions.
Consent (new APP 4; sections 6AAB and 6FC). Consent to collect sensitive information and to trade personal information, with exceptions in APPs 4.3 and 4.6; it must be voluntary, informed, current, specific and unambiguous.
Breaches (new section 26WK). Notice to the Commissioner within 72 hours of becoming aware of reasonable grounds to believe an eligible data breach occurred.
Penalty (current section 13G, corporations). Maximum civil penalty: the greater of $50 million, three times the benefit, or 30 per cent of adjusted turnover.
Updated October 2026: rewritten for readability and figures checked since first publication on 25 September 2026.
Questions for Leadership
Which of our revenue lines depend on collecting, inferring or sharing personal information?
Management can size the exposure once one executive owns a complete list.
For each of those lines, could management explain today why the data use is fair and reasonable?
Reasons written down now become the record a regulator or tribunal would examine.
Which of our data hand-offs to advertising platforms would count as a trade under the draft?
The share of customers who refuse consent becomes a revenue variable for each of those hand-offs.
What contribution margin is at risk, shown as a range with stated assumptions?
A range with stated assumptions gives directors something specific to test and challenge.
What condition will we attach to new investment that depends on personal information?
Capital approved today for a data flow that later fails the test would need costly rework.
The Bottom Line
Treat the draft privacy bill as a test of the business model. List the revenue lines that depend on personal information, put a range on the margin at risk, and decide the future of each line at the February 2027 board meeting.
Frequently Asked Questions
Which existing exemptions does the draft keep?
The draft keeps the small business exemption for businesses with annual turnover of $3 million or less, and it changes how that exemption's trading exception works. Because the draft's definition of a trade includes disclosures for direct marketing, some small businesses that share customer data for advertising could come within the Act. The draft keeps the employee records exemption, which covers many records about current and former staff. It gives individuals no general right to sue a business for breaching the privacy principles, and it leaves privacy impact assessments voluntary for private businesses.
Which privacy rules already apply before this draft becomes law?
The 2024 amendments to the Privacy Act are already law. They created a statutory tort for serious invasions of privacy, which has applied since 10 June 2025, and gave the Privacy Commissioner tiered civil penalties and infringement notices. They also added a rule on automated decisions. From 10 December 2026, a covered organisation's privacy policy must describe the kinds of significant decisions about people that its software makes or substantially helps make, and the kinds of personal information it uses. The OAIC published its final guidance on that rule on 30 September 2026.
What counts as trading personal information, and what is carved out?
Under the draft, a business trades personal information when it discloses it for money or other consideration, or for direct marketing. Four kinds of disclosure are carved out: one that lets the recipient provide a product or service the person asked it for; one incidental to the sale of all or part of a business, where payment for the information is a minor purpose of the deal; one to a processor, where both parties are covered by the Act and the processor acts on written instructions for purposes the controller specifies; and some fraud disclosures. A carve-out lifts the consent requirement. The fairness test can also apply, unless a separate exception in the new APP 3 covers the disclosure.
Does the consent rule apply to an ad-supported service?
Yes. The draft defines an ad-supported service as one that earns revenue from sending direct marketing to its users. Such a service could offer different terms to users who opt out of that marketing, provided users keep a genuine choice and the service avoids dark patterns. The consent rule for trading personal information applies to an ad-supported service as it does to any other business, with the same carve-outs and exceptions. A platform that passes a user's information to another company for money or other consideration would generally need that user's consent.
Would the draft change how we use customer data to train AI?
It would add a test. On 20 May 2026 the Privacy Commissioner said that personal information used to train AI must comply with the Privacy Act, and that in most cases it is a secondary use or disclosure that must meet the existing rules on use. Under the draft, that use would generally also have to be fair and reasonable after weighing the same seven matters, including whether customers would expect it. The draft would also treat inferences an AI system draws about a person as a collection of personal information, so those inferences would come under the same rules.