Privacy and online advertising

Much of what we read, watch and use online is free because it's funded by advertising, and much online advertising is funded by data about us: what we search for, which sites we visit, what we buy, where we are and who we know. That data makes ads more relevant and more valuable to advertisers, but it raises real concerns about privacy, security and fairness.

This guide explains how online tracking and targeted advertising work, what Australian privacy law says, and what both businesses and individuals can do.

How online tracking works

Several technologies let companies recognise you and record your activity.

• Cookies. Small files stored in your browser. First-party cookies from the site you're visiting remember logins, shopping carts and preferences. Third-party cookies from advertising and analytics companies embedded in many sites have been used to build profiles of people across the web. Major browsers have restricted third-party cookies to varying degrees.
• Pixels and tags. Tiny pieces of code on websites and in emails that report back when you load a page, open an email or take an action, such as making a purchase.
• Device identifiers. Mobile devices have advertising identifiers that apps can use for tracking, subject to operating-system permission controls.
• Logged-in data. Platforms where you have an account can link activity across devices and services to your profile.
• Fingerprinting. Combining details about your device and browser to recognise you without cookies.
• Location data. Collected by apps with location permission, and inferred from IP addresses.

How targeted advertising works

Data collected through tracking is used to place people into audience segments, such as "interested in home renovation" or "recently visited this store's website". Advertisers then bid to show ads to those segments, often through automated auctions that happen in fractions of a second as a page loads. Retargeting shows ads to people who have already visited a site, and lookalike audiences find people similar to existing customers. Our online advertising guide explains the advertiser's side.

Concerns about tracking

Regulators and researchers have raised concerns about the scale of data collection, the difficulty of understanding privacy policies, the sharing of data with many third parties, the risk of data breaches, and the potential for targeting to exploit vulnerable people or to discriminate. The ACCC's inquiries into digital platforms examined data practices and recommended privacy reforms.

Australian privacy law

The Privacy Act 1988 is the main privacy law. It applies to Australian Government agencies and to private sector organisations with annual turnover above $3 million, as well as some smaller businesses, including health service providers, businesses that sell or buy personal information, and certain others. State and territory laws cover state public sector agencies, and some sectors have specific rules, such as for health records and credit reporting.

Covered organisations must follow the 13 Australian Privacy Principles (APPs). In summary, they must:

• manage personal information openly and transparently, with a clear privacy policy (APP 1);
• collect only information reasonably necessary for their functions, by fair means, and tell people about the collection (APPs 3 and 5);
• use and disclose information only for the purpose it was collected or related purposes people would reasonably expect, with exceptions (APP 6);
• follow rules on direct marketing, including giving people a simple way to opt out (APP 7);
• take care with overseas disclosure (APP 8);
• keep information accurate and secure, and destroy or de-identify it when no longer needed (APPs 10 and 11);
• give people access to and correction of their information (APPs 12 and 13).

Personal information is information or an opinion about an identified or reasonably identifiable individual. Some kinds of information, such as health information, are sensitive information and have stronger protections.

Data breaches

Under the Notifiable Data Breaches scheme, which began in February 2018, organisations covered by the Privacy Act must notify affected individuals and the OAIC about eligible data breaches likely to result in serious harm. Major breaches in recent years have prompted stronger penalties and reform. If you're notified of a breach affecting you, follow the advice provided, change passwords, enable two-factor authentication, watch for scams and consider contacting IDCARE, Australia's national identity and cyber support service.

Privacy reform

Australian privacy law is being reformed in stages. Amendments passed in 2024 included a statutory tort for serious invasions of privacy, a requirement for a Children's Online Privacy Code, new transparency requirements for automated decisions and stronger enforcement powers for the OAIC. Further reforms have been proposed. Check the OAIC's website for current requirements.

What businesses should do

Even if your business is exempt from the Privacy Act, good privacy practice builds trust and prepares you for reform.

• Publish a clear privacy policy explaining what you collect, why and who you share it with.
• Collect only what you need, and delete it when you no longer need it.
• Disclose use of analytics, advertising pixels, retargeting and customer list uploads.
• Secure personal information with strong passwords, two-factor authentication, access controls and up-to-date software.
• Give people an easy way to opt out of direct marketing.
• Have a plan for responding to data breaches.
• Choose vendors and platforms with strong privacy and security practices.

What individuals can do

You can't avoid all tracking, but you can reduce it.

• Review ad settings. Major platforms let you see and adjust the interests used to target ads, and limit personalised advertising.
• Control app permissions. Limit location, contacts, microphone and tracking permissions in your phone's settings, and turn off ad personalisation in your device settings.
• Use browser privacy features. Block third-party cookies, clear cookies regularly and consider privacy-focused browsers or extensions.
• Think before you share. Limit the personal information you post publicly and in online quizzes and competitions.
• Read before you agree. Skim privacy policies and permission requests for unexpected data sharing.
• Secure your accounts. Use a password manager and two-factor authentication.

Your rights

If an organisation covered by the Privacy Act holds information about you, you can generally ask to access it and to correct it. If you think an organisation has mishandled your information, complain to it first, then to the OAIC if you're not satisfied with the response within 30 days.

Common mistakes

• Businesses copying a privacy policy that doesn't match what they actually do.
• Installing tracking pixels without disclosing them.
• Keeping customer data forever.
• Individuals granting every app permission without checking.
• Reusing passwords across sites.

Key points

Online advertising relies heavily on tracking through cookies, pixels, device identifiers and logged-in data. The Privacy Act and the 13 Australian Privacy Principles govern covered organisations, data breaches must be notified, and reforms continue. Businesses should be transparent and collect only what they need, and individuals can limit tracking through settings and permissions.