Australian Privacy Act
Privacy Act 1988, as amended by the Privacy and Other Legislation Amendment Act 2024
Key Facts
Overview
Australia's December 2024 amendments are the most significant update to the Privacy Act since 1988. Personal information now explicitly includes technical identifiers like IP addresses, device IDs, and cookie identifiers. Consent must be voluntary, informed, current, specific, and unambiguous. Pre-ticked boxes and dark patterns are prohibited.
What This Means for Your Website
- Cookies, IPs, and device IDs are now explicitly personal information under Australian law
- Consent must be voluntary, informed, current, specific, and unambiguous
- Pre-ticked boxes, vague wording, and dark patterns are restricted
- Penalties can reach AUD 50 million, 3x benefit obtained, or 30% of turnover
- A new statutory tort for serious privacy invasion creates a private right of action
- A Children's Online Privacy Code must be developed by December 2026
- The small business exemption (under AUD 3M turnover) remains but is under review
Key Requirements
The OAIC enforces the Privacy Act with the power to issue compliance and infringement notices directly. Penalties reach the greater of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover. Automated decision-making transparency requirements commence December 2026. Breach notification has been mandatory since February 2018.
How ConsentStack Handles This
ConsentStack detects Australian visitors and applies the strengthened consent requirements. All cookies are treated as personal information per the 2024 amendments, with no pre-ticked boxes or dark patterns.
Penalties
Bodies corporate: greater of AUD 50M, 3x benefit, or 30% of adjusted turnover. Individuals: up to AUD 2.5M. New tiered civil penalty process.
Key Requirements
- Consent must be voluntary, informed, current, specific, and unambiguous
- Pre-ticked boxes, vague wording, and dark patterns restricted
- Personal information includes IPs, device IDs, cookie identifiers
- Mandatory data breach notification
- New statutory tort for serious invasion of privacy
- Children's Online Privacy Code to be developed by December 2026
Notable Provisions
- December 2024 amendments: most significant ever
- IPs, device IDs, cookies now explicitly personal information
- AUD 50M or 30% of turnover penalties
- New statutory tort creates private right of action
- Small business exemption (under AUD 3M) still in place
Data Subject Rights
Complain to the organisation about a breach of the Australian Privacy Principles; its privacy policy must say how to complain and how it will deal with the complaint, and the Commissioner generally will not investigate until you have complained to the organisation first.
Deal with the organisation without identifying yourself or by using a pseudonym, unless an Australian law or a court or tribunal order requires it to deal with identified individuals, or dealing with unidentified individuals is impracticable.
Ask the organisation to stop sending you direct marketing, to stop using or disclosing your information to help other organisations market to you, and to tell you where it got your information unless that is impracticable or unreasonable; it must act within a reasonable period and free of charge.
Get access to the personal information the organisation holds about you, subject to the exceptions in APP 12.3; an organisation must respond within a reasonable period, may not charge for making the request, and must explain a refusal in writing with the ways to complain about it.
Ask the organisation to correct inaccurate, out-of-date, incomplete, irrelevant or misleading information, to notify other entities covered by the Act it disclosed it to (where practicable and lawful), or, if it refuses, to attach your statement to it; it must respond within a reasonable period and cannot charge.
Complain in writing to the Australian Information Commissioner about an act or practice that may interfere with your privacy; the Commissioner may decline a complaint made more than 12 months after you became aware of the act or practice.
Other Asia Pacific Regulations
Frequently Asked Questions
Stay compliant with Australian Privacy Act
ConsentStack helps you implement Opt-in consent for Australia automatically.