The Australian Privacy Act: what it says about cookies

What is the Privacy Act?

The Privacy Act 1988 is Australia's federal privacy law. Its core is the set of thirteen Australian Privacy Principles (APPs), in force since 12 March 2014, which cover the handling of personal information from collection to disclosure and security. The Office of the Australian Information Commissioner (OAIC) administers the Act. Two recent amendments changed the enforcement picture: the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, which multiplied the maximum penalties from 13 December 2022, and the Privacy and Other Legislation Amendment Act 2024, assented on 10 December 2024, which created tiered civil penalties, infringement notices, a statutory tort for serious invasions of privacy (from 10 June 2025) and a Children's Online Privacy Code that the OAIC must register by December 2026. A second tranche of reforms, including a fair and reasonable test for processing, has been announced but not yet legislated.

Who does the Privacy Act apply to?

The Act applies to Australian Government agencies and to organizations with an annual turnover of more than A$3 million. Smaller businesses are exempt unless they provide health services, trade in personal information (buy or sell it), are contracted service providers to the Commonwealth, or opt in. Organizations outside Australia are covered when they have an Australian link, which includes carrying on business in Australia and collecting personal information there; the 2022 amendments removed the earlier requirement that the information be collected from a source in Australia, so a foreign website that tracks Australian visitors is more clearly within reach.

What does the Act require for cookies and trackers?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. A cookie identifier on its own may not identify anyone, but combined with an account, a device profile or an advertising identifier it usually does, and the OAIC treats online identifiers used to track and profile people as personal information in that context.

When cookies collect personal information, the APPs apply:

• APP 1 requires an up-to-date privacy policy that explains what is collected, how and why, and how to complain.
• APP 3 limits collection to what is reasonably necessary for the organization's functions, and requires consent to collect sensitive information (health, ethnicity, religion, sexual orientation, biometrics).
• APP 5 requires reasonable steps to notify people, at or before collection or as soon as practicable afterwards, of who collects the information, why, who it is disclosed to, and whether it goes overseas. For a website this is the cookie or collection notice.
• APP 6 allows use for the primary purpose of collection and for related secondary purposes a person would reasonably expect; anything else needs consent.
• APP 7 allows direct marketing based on personal information if the person would reasonably expect it and can opt out easily; otherwise consent is needed.
• APP 8 makes an organization accountable for overseas recipients, which includes US-based analytics and advertising providers.
• APP 11 requires reasonable security and the destruction or de-identification of information no longer needed.

Consent under the Act must be informed, voluntary, current and specific, and the person must have capacity to give it; the OAIC's guidelines say bundled consent and pre-ticked boxes are unlikely to be valid. There is no equivalent of the European strictly necessary test and no duty to block cookies before a choice. The government's 2023 response to the Privacy Act Review agreed in principle to require an unqualified right to opt out of targeted advertising and to ban targeting children, but those proposals await the second tranche.

What should an Australian site's banner or notice do?

• Publish a privacy policy that names the analytics and advertising tools in use and the overseas recipients.
• Show a collection notice that meets APP 5 the first time a visitor arrives, with a link to the policy.
• Ask for consent before any sensitive information is collected and before uses outside what visitors would expect, for example cross-site profiling by a third party.
• Offer a working opt-out from direct marketing and, as good practice, from advertising cookies.
• Be honest about cookie purposes; misleading statements about tracking can also breach the Australian Consumer Law.

Australian sites with visitors from the EU or the UK usually run a consent banner anyway, and the OAIC's guidance treats clear notice and real choice as the way to meet the APPs online.

Enforcement and fines

The OAIC investigates complaints and can accept enforceable undertakings, make determinations, and since December 2024 issue infringement notices for lower-tier breaches such as a non-compliant privacy policy. Civil penalties are sought in the Federal Court. For a serious interference with privacy by a body corporate the maximum is the greater of A$50 million, three times the value of the benefit obtained, or, if the benefit cannot be determined, 30% of adjusted turnover during the breach period. The 2024 Act added a mid-tier penalty of up to 2,000 penalty units for interferences that are not serious and a lower tier of up to 200 penalty units for specific administrative breaches; a Commonwealth penalty unit has been A$330 since 7 November 2024, and the amount is multiplied by five for companies, so the mid-tier maximum is A$3.3 million and the lower tier A$330,000.

The first civil penalty under the Act was ordered on 8 October 2025: Australian Clinical Labs agreed to pay A$5.8 million over the 2022 Medlab Pathology breach, calculated under the pre-2022 maximum of A$2.22 million per contravention because the conduct predated the increase. Proceedings against Medibank and Optus over their 2022 breaches are pending. There has been no penalty about cookies; tracking appears in OAIC work mainly through determinations on online platforms and through the children's code now in preparation.

How Cookiequiet handles Australia

Australia is not in Cookiequiet's list of countries with a consent law, which is accurate: no cookie consent rule applies. You can still add Australia to a custom geo-targeting list, or show the banner everywhere, to give Australian visitors the APP 5 notice and a real choice on advertising cookies. The banner's first layer carries the notice text, categories stay off until a visitor accepts, and the preferences center provides the opt-out. The privacy policy generator lists the providers found by the scan and their locations, which covers the APP 8 disclosure of overseas recipients, as a template, not legal advice. See do I need a cookie banner for the decision by audience.