Verified as of August 2026: Australian regulation is actively changing. This is operational orientation, not legal advice; confirm with ACMA, OAIC, ASQA or your legal adviser.
Almost every article about Australia's privacy reform is written by a law firm for a compliance team. That is useful if you are general counsel and useless if you are the person who actually configured the lead scoring model. Here is the marketer's version. Two things matter most to you. First: from 10 December 2026, if you use automated decision-making that significantly affects individuals, your privacy policy must disclose it: and AI lead scoring, algorithmic segmentation, and automated eligibility or pricing personalisation are squarely in scope. Second: a statutory tort for serious invasion of privacy commenced on 10 June 2025, meaning individuals can now sue directly rather than relying on the regulator. That changes the risk calculus on aggressive retargeting and inferred-attribute targeting in a way most marketing teams have not absorbed.
The rest of the reform package, the widely discussed "Tranche 2", remains proposed. As of mid-2026 no bill had been introduced. Plan for it; do not budget as though it is law.
Key Takeaways
- Tranche 1 passed in December 2024. It is real, staged, and partly already in force.
- Statutory tort commenced 10 June 2025. Individuals can bring direct claims for serious invasion of privacy, a genuine shift from an OAIC-only enforcement model.
- Automated decision-making transparency becomes mandatory from 10 December 2026. If automated systems materially affect individuals, your privacy policy must say so.
- A Children's Online Privacy Code is due to be registered by 10 December 2026: relevant to any brand whose audience skews under 18, including much of edtech.
- Tranche 2: removing the small business exemption, a "fair and reasonable" test, a broader definition of personal information, had no bill introduced as of mid-2026. Treat it as proposed and expected, not settled.
- The practical work is inventory, disclosure, and restraint on inference-based targeting. Start with the inventory.
The compliance deadline is December 2026. The engineering and copy work needs to start well before that.
What Actually Changed, in Marketer Terms
The statutory tort is the underrated one
Before June 2025, a privacy grievance essentially meant complaining to the OAIC. The regulator prioritised, investigated some matters, and most complaints never became litigation. A statutory tort for serious invasion of privacy changes the shape of that risk: an individual can pursue a claim themselves.
For marketing, the exposure sits in a specific place: inference and intrusion. Retargeting that reveals something a person never told you is the classic pattern: health-adjacent inferences, pregnancy or life-event targeting, financial-distress segments, or ads that follow someone across contexts in ways that feel like surveillance rather than relevance. "The data was technically available" was never a great defence; now it is a defence that has to hold up against a claimant with standing.
The practical adjustment is not to stop retargeting. It is to stop targeting on inferred sensitive attributes, cap frequency, honour opt-outs across the whole stack rather than per-platform, and remove the creepiest 5% of your segments, the ones that make people ask "how did they know that?"
Automated decision-making: the December 2026 obligation
This is the one with a date on it. From 10 December 2026, organisations must include information in their privacy policy about automated decisions that significantly affect individuals: broadly, what kinds of personal information are used, and what kinds of decisions are made this way.
Marketers habitually think of "automated decision-making" as a fintech or HR concept. It is not. Consider what routinely runs in a modern growth stack:
- AI lead scoring that determines who gets a human sales call and who gets a nurture drip
- Eligibility or pre-qualification logic that decides who sees which programme, offer, or price
- Automated content or offer personalisation driven by predicted attributes
- Churn or propensity models that trigger retention offers, discounts, or deprioritisation
- Automated approval or rejection in application funnels
Not all of these will meet the "significant effect" threshold. Some clearly might: particularly anything gating access to a product, a price, a place in a programme, or a credit-like decision. The work now is to find out which of yours do.
Children's Online Privacy Code
A Children's Online Privacy Code is due for registration by 10 December 2026. If any meaningful part of your audience is under 18: and for edtech, bootcamps, tutoring, test prep and skilling brands that is often true even when the buyer is a parent, this will shape consent flows, default settings, and how you advertise. Watch oaic.gov.au for the registered code rather than commentary about the draft.
The Automated Decision-Making Inventory
Before you can write the disclosure, you need to know what you're disclosing. Run this as a workshop with marketing ops, data, and whoever owns the CRM.
Step 1: List every automated decision point
Walk the funnel end to end. At each stage, ask: does a system decide something about a person without a human making that call? Capture the tool, the trigger, and the outcome.
Step 2: Record the inputs
For each decision, what personal information feeds it? Declared data (form fields), behavioural data (site and email engagement), enriched or third-party data, and inferred attributes. Third-party enrichment is where most teams find surprises.
Step 3: Classify significance
Does the decision materially affect the person's rights, access, opportunities, or the terms they receive? A decision about which subject line variant they get is not the same as a decision about whether they are shown a scholarship pathway. Be honest, the temptation to classify everything as trivial is exactly the reasoning that reads badly later.
Step 4: Note human involvement
Genuine human review, where a person can and does override, sits differently to rubber-stamping. Document which is which.
Step 5: Draft the disclosure
Plain English, in the privacy policy, describing the types of information used and the types of decisions made. This is a transparency obligation: you are telling people what happens, not seeking their permission for it.
Most teams discover two or three automated decisions they had never thought of as decisions at all.
Retargeting After the Statutory Tort
Frequency and duration caps
Uncapped retargeting windows are the cheapest thing to fix. A 30-day window with a frequency cap looks like marketing. A 180-day window with unlimited impressions looks like pursuit. Set caps deliberately.
Kill the sensitive-inference segments
Anything approximating health, sexuality, religion, race, financial hardship, or immigration status should not be a targeting axis, whether declared or inferred. Inference does not launder it.
Opt-out that actually propagates
If someone opts out of marketing, that should suppress them from custom audience uploads, on-site personalisation, and SMS, not just the email list. A single suppression source of truth is the operational answer.
Be careful with lookalikes built from sensitive seeds
A lookalike audience seeded from a sensitive-attribute segment carries the sensitivity forward.
Tranche 2: How to Talk About It Honestly
The commentary cycle keeps announcing Tranche 2 as imminent. As of mid-2026, no bill had been introduced. The proposals commonly discussed include:
- Removing the small business exemption, which currently keeps many businesses under a turnover threshold outside most of the Act
- A "fair and reasonable" test for collection, use and disclosure, an objective standard sitting above consent
- A broader definition of personal information, likely capturing more technical identifiers
If you are a small business currently relying on the exemption, the sensible posture is to build as though it will disappear: not because it is law, but because the cost of retrofitting is higher than the cost of building right. If you are already an APP entity, the "fair and reasonable" test is the one to design for, because it undermines the "we got consent, therefore it's fine" reflex.
What I'd Do This Quarter
Weeks 1–2. Data inventory. Every place personal information enters, every third-party tool that receives it, every automated decision.
Weeks 3–4. Segment audit. Flag anything using inferred sensitive attributes. Cut it.
Weeks 5–6. Suppression architecture. One opt-out source of truth, propagating everywhere including ad platform audiences.
Weeks 7–8. Privacy policy rewrite, including the automated decision-making section, drafted in plain language and reviewed by your legal adviser well ahead of 10 December 2026.
Ongoing. Assign someone to watch oaic.gov.au monthly. This area is moving.
Why This Is a Growth Advantage, Not Just a Cost
Teams that build consent-first acquisition end up with better assets. When I worked on organic growth for edtech, Masai School's Instagram went 26K to 117K and LinkedIn 50K to 160K, the durable value was an audience that arrived voluntarily and could be contacted lawfully for years. Aggressive tracking-based acquisition produces audiences that evaporate the moment a platform changes policy or a regulator moves.
Privacy reform disadvantages the growth models that were always fragile. If your pipeline depends on inference-heavy targeting, the reform is a threat. If it depends on people choosing to hear from you, it is largely a documentation exercise.
Frequently Asked Questions
When exactly does the automated decision-making obligation start?
10 December 2026. The requirement is to include specified information about automated decisions with significant effects in your privacy policy.
Does AI lead scoring count as automated decision-making?
It can. If the score determines who receives human contact, an offer, a price, or access, the significance threshold is at least arguable. Inventory it and assess it rather than assuming it is exempt.
Do I need consent for automated decision-making?
The December 2026 requirement is a transparency obligation, disclosure in the privacy policy, not a consent mechanism. Other obligations about how you collect and use the underlying information still apply separately.
What is the statutory tort and when did it start?
A statutory cause of action for serious invasion of privacy, commenced 10 June 2025. It allows individuals to bring claims directly, rather than relying on the regulator to act.
Does the tort mean I can be sued for retargeting someone?
Ordinary retargeting is not automatically a serious invasion of privacy. The risk concentrates in intrusive, inference-heavy or sensitive-attribute targeting, and in ignoring opt-outs. Reduce those and you reduce exposure.
Has the small business exemption been removed?
Not as of mid-2026. Its removal is proposed and widely expected, but no bill had been introduced. Prepare, don't panic.
What is the Children's Online Privacy Code?
A code due to be registered by 10 December 2026 covering online services likely to be accessed by children. If your audience includes under-18s, monitor it closely.
Is Australian privacy reform basically GDPR?
No. There are conceptual similarities, transparency, a fairness standard, individual rights, but the mechanics, thresholds and terminology differ. Do not copy a GDPR notice and call it done.
Does this apply to a foreign company marketing into Australia?
The Act can apply to overseas organisations with an Australian link. Being headquartered elsewhere is not a general exemption. Check with your adviser.
What is the single highest-value thing to do first?
The data and automated-decision inventory. Every other task depends on knowing what you actually run.
Privacy reform tends to land on marketing teams as a legal memo nobody can action. The version that works is operational: an inventory, a segment cull, one suppression source of truth, and a policy rewrite scheduled backwards from December 2026. I help edtech and startup teams build organic-first growth that stays durable when the rules change. If that is the quarter you are heading into, you can see how I work at younusfardeen.com.