Cookies, tracking and consent in Australia

Australia has no direct equivalent of the European Union’s cookie-consent banner requirement, and a business building for Australia should not assume the two frameworks ask the same question. The Privacy Act 1988 (Cth) regulates the handling of personal information, which is a narrower and differently shaped question from “does a cookie fire before consent” — and it is possible for a site to need no cookie banner at all while still needing to think carefully about what its tracking actually collects and why.

This page is general information about how the two frameworks differ and where the Privacy Act’s Australian Privacy Principles engage web tracking. It is not legal advice, and whether your specific tracking setup requires a particular disclosure or consent mechanism is a question for your own assessment or a lawyer.

Why the EU comparison misleads more often than it helps: cookie consent, GDPR and the Australian Privacy Act

The EU’s ePrivacy Directive requires consent before storing or accessing information on a user’s device for most non-essential purposes, which is why EU-facing sites commonly show a cookie banner before any tracking script runs. Australia has no directly equivalent instrument. The Privacy Act instead governs the collection, use, storage and disclosure of personal information by APP entities, and it does not turn on the technical mechanism (a cookie) at all — it turns on whether personal information is involved. A business copying an EU-style banner onto an Australian site because “that’s what websites do” is solving the wrong problem if its actual exposure is under the Privacy Act rather than under a law that does not apply to it.

The two frameworks, side by side: cookie banner rules vs Privacy Act compliance

	EU ePrivacy framework	Australian Privacy Act
What triggers the obligation	Storing or accessing information on a device, for most non-essential purposes	Collecting, using, storing or disclosing personal information
Typical mechanism	A consent banner before tracking scripts load	No mandated mechanism; obligations attach to what is done with the data collected
Applies to Australian businesses?	Only where EU users are targeted or monitored, a separate question from local operation	Yes, subject to the small-business exemption and other coverage rules

When web tracking data becomes “personal information”: data privacy and your tracking preferences

The Privacy Act’s Australian Privacy Principles apply to personal information — information about an identified individual, or an individual who is reasonably identifiable. Standard analytics tracking (page views, session duration, device type) is not automatically personal information, but it can become identifiable, or combine with other data a business holds, in ways that engage the Privacy Act — the OAIC’s guide to data analytics addresses this directly and states that IP addresses and other online identifiers are capable of being personal information depending on the circumstances. Whether a specific analytics configuration on a specific site meets that threshold is a technical and factual question this page cannot answer for your setup.

The small-business exemption, and why Australia’s privacy laws are under active reform

Many small businesses are currently exempt from the Australian Privacy Principles under a turnover-based exemption in the Privacy Act. That exemption has been the subject of active reform, with removal agreed in principle in the Government’s response to the Privacy Act Review, but as at the time of writing no second-tranche Bill implementing removal has been introduced and no commencement date is legislated. This page does not state a date, because an unconfirmed date circulating in industry commentary is worse than no date. If your business currently relies on the exemption, treat it as a position to monitor rather than a permanent feature.

What a privacy-conscious approach to tracking and cookie banners actually looks like, regardless of the exemption

A privacy-conscious approach has three practical parts. First, collect only the tracking data genuinely needed for the purpose. That means understanding traffic and usage, rather than building an individual profile beyond what’s needed. Second, state in a privacy policy what tracking is used, broadly what it collects, and any third party it is shared with, such as analytics providers or advertising platforms. Third, configure analytics tools’ privacy-related settings — IP anonymisation or truncation where offered, data retention limits. Do not just leave every default enabled without review.

Third-party tracking pixels and advertising pixels specifically

Advertising and remarketing pixels (from major ad platforms) typically collect and share more identifiable data than a standard analytics setup. Using them alongside a privacy policy that only describes basic analytics is a common gap. The policy should describe what is actually running on the site, not a simplified version of it. This is a factual accuracy question about your own privacy policy rather than a separate legal obligation, but an inaccurate privacy policy is itself a misleading representation risk under the Australian Consumer Law, independent of the Privacy Act analysis.

No cookies, no personal information — does anything still apply?

A site using no cookies and no tracking that could reasonably identify an individual sits outside the practical reach of both frameworks, for that specific activity. This is genuinely achievable for a simple brochure site with no analytics. It is worth knowing as a real option. The absence of tracking is also the absence of the obligation. It is not a corner being cut.

A note on GDPR, distinct from the cookie-banner question

GDPR is a separate EU data-privacy regulation from the ePrivacy Directive’s cookie-consent mechanism, and the two are commonly conflated in general commentary. Neither applies directly to an Australian business with no EU presence. Where an Australian site’s own data privacy compliance obligations actually sit is a Privacy Act question, covered above, not a GDPR one. Learn the distinction before assuming either framework’s rules apply by default.

What to do next

Audit what tracking scripts are actually running on your site — analytics, advertising pixels, third-party embeds. Check that your privacy policy accurately describes them, rather than assuming a generic policy template covers whatever happens to be installed. Where your business’s privacy obligations more broadly are covered, including the small-business exemption, is set out on website terms and privacy policy. What this means for the technical build itself is covered on development as an ongoing engagement.