Privacy Act reforms and the data sitting in your agency

For a decade, Australian marketers treated tracking as a technical preference. A pixel here, a list upload there, a conversion API because iOS had made the old story harder. The Privacy Act was a policy page. The agency was a helper with logins. That arrangement was always shaky. After the Privacy and Other Legislation Amendment Act 2024, it is an operational problem with names.

This desk is not your lawyer and not the OAIC. It is a buyer’s note. The reforms do not require you to close the ad account. They do require you to stop pretending that a customer list, a matching audience and a pixel on a form are “the agency’s stack”. They are personal information in motion. Someone has to be able to draw the motion on a page.

The piece belongs in working together. The exit version of the same problem — retrieving lists and pixels — sits in when and how to fire your agency. Read them together if your shop has been “just in the accounts” for years.

What actually changed, and what is still incoming

The 2024 Amendment Act is public law, not a rumour. It created a statutory tort for serious invasions of privacy, with a delayed start after Royal Assent. It added doxxing offences. It pointed toward a Children’s Online Privacy Code to be developed on a published timetable. It tightened expectations around automated decision-making transparency in privacy policies, and it pushed APP 11 — security of personal information — toward measures you can describe, not adjectives.

Other reform ideas from the earlier review remain political and sequential: the small-business exemption, further enforcement machinery, the shape of consent in a tracking world. Do not let a shop sell you a 2026 horror story as if every recommendation were already in force. Do not let a shop tell you nothing has changed because a particular section is still in consultation.

The Australian Privacy Principles still apply to APP entities. The Spam Act still applies to commercial electronic messages. The Australian Consumer Law still applies to claims about how you use data. Platforms still have their own policies, which are not a substitute for yours. A stack of “we follow Meta’s terms” is not a privacy program.

Penalties were already lifted in earlier rounds. The point for a marketer is not the maximum number in a press release. It is that sloppy list-handling is no longer a costless habit.

First-party data is an asset with a custodian

First-party data, in the way agencies use the phrase, usually means a list you collected, a log of behaviour on a property you own, or a CRM someone promised was “clean”. It is valuable because the open web got worse at remembering people. It is dangerous because it is easy to copy.

Decide who the custodian is. Not “marketing” as a department — a role. That person approves uploads, audience sharing, new pixels, new tools, and the agency’s subcontractors. If the custodian is the agency, you have outsourced a legal role without paying for it or watching it.

Do not give the shop a standing export of the whole file because it makes the weekly faster. Give them the minimum that can do the job, in a system you can revoke. If they need a matching audience, use the platform’s clean-room or hashed-upload path you can turn off. If they need a spreadsheet, ask why 2014 is still the workflow.

Write deletion. When a person asks you to be forgotten, the agency’s copies and the ad platform’s leftover audiences have to be in the story. If nobody can list the copies, you cannot keep the promise on your privacy policy.

Write overseas disclosure. Plenty of Australian shops use tools, editors and traders that are not in Australia. That can be fine. It cannot be a surprise. APP 8 is not new. The reforms made it harder to treat as fine print.

Pixels, tags, and the pages that should stay quiet

A pixel is not a logo. It is a transfer of information about a person and a page. The page matters.

Do not put advertising and analytics tags on pages that collect health, financial hardship, children’s information, or anything you would not want described in a complaint letter, unless you have a specific, documented reason and a configuration that does not send the field. “The tag manager already had it” is how hospitals, lenders and schools end up in stories.

Do not let the agency add tags from a new vendor because the vendor’s salesperson sat in the monthly. Each tag is a new party. Each party is a new sentence in the data map.

Server-side tagging and conversion APIs are not a privacy exemption. They can be a control — fewer browsers doing wild things — or they can be a way to keep sending after the browser said no. Ask which you bought. Ask what the consent signal actually does in the server. A banner that does not change the firehose is theatre.

This desk will not pretend consent banners in Australia are settled law in the European style. It will say this: if you show a choice, honour it. If you do not need the tag, do not install it. The OAIC has not asked you to decorate the footer. It has asked you to handle personal information fairly and securely.

Lists, suppression, and the Spam Act sitting beside privacy

Agencies still receive CSVs. They still upload them to platforms. They still keep a copy “in case the upload fails”. Treat that as a controlled activity.

Hash what you can. Minimise fields. No extra columns “for later”. No list of people who asked not to be contacted sitting in the same sheet as the people you are about to contact. Suppression is a discipline. It is also how you stay on the right side of the Spam Act when the work is email or SMS.

Ask where the file went. The shop’s Google Drive. A freelancer’s laptop. A Slack thread. A leftover audience in an ad account you forgot you opened for a test. The map should be short. If it is long, the program is too clever.

Do not buy enrichment as a casual add-on. Appending phone numbers, joining data from a broker, “enhancing” a list — these are new collections. They need a purpose and a story you can tell the person. A performance shop that treats enrichment as hygiene has told you their theory of the customer.

What the contract should say, in sentences

The agency is a processor or an APP entity in its own right depending on the facts. Do not settle that with a vibe. Say what they may do, what they may not do, which tools are approved, how subcontractors are approved, how quickly they notify an incident, and what they delete on exit.

“Comply with privacy law” is not a clause. It is a heading.

If the shop wants to use your data to train a model or to benchmark other clients, the answer is no unless you have a separate, specific agreement. Most marketers mean no. The paper should say no.

If you want the operational brief that sits next to this paper, use writing a brief agencies will actually read and include a one-page data map as an attachment. Shops can work with a map. They cannot work with a panic in month eleven.

Questions for the weekly, not the policy page

Ask them to share their screen and show every tag on a sensitive template.

Ask who can export the list this week.

Ask what they would do if a contractor’s inbox were compromised on a Saturday.

Ask which overseas tools touch the file, and whether those tools’ terms let them use the file for their own improvement.

Ask how a person’s deletion request would travel through the ad accounts by name, not by slogan.

The answers will be imperfect. Imperfection you can see is better than a certificate on the wall and a CSV in a personal drive.

The desk’s view

Treat first-party data as something you can revoke. Treat pixels as transfers. Treat lists as copies that want to multiply. Write the agency’s job as a map and a deletion path, not as a promise to be careful. The 2024 reforms did not invent that duty. They made it more expensive to ignore.

If we get a fact wrong on the timetable of a code or a commencement date, the editorial standards page says how to correct it. Bring the Act, not a LinkedIn carousel.