Key Facts
Overview
Australia's December 2024 amendments are the most significant update to the Privacy Act since 1988. Personal information now explicitly includes technical identifiers like IP addresses, device IDs, and cookie identifiers. Consent must be voluntary, informed, current, specific, and unambiguous. Pre-ticked boxes and dark patterns are prohibited.
What This Means for Your Website
- Cookies, IPs, and device IDs are now explicitly personal information under Australian law
- Consent must be voluntary, informed, current, specific, and unambiguous
- Pre-ticked boxes, vague wording, and dark patterns are restricted
- Penalties can reach AUD 50 million, 3x benefit obtained, or 30% of turnover
- A new statutory tort for serious privacy invasion creates a private right of action
- A Children's Online Privacy Code must be developed by December 2026
- The small business exemption (under AUD 3M turnover) remains but is under review
Key Requirements
The OAIC enforces the Privacy Act with the power to issue compliance and infringement notices directly. Penalties reach the greater of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover. Automated decision-making transparency requirements commence December 2026. Breach notification has been mandatory since February 2018.
How ConsentStack Handles This
ConsentStack detects Australian visitors and applies the strengthened consent requirements. All cookies are treated as personal information per the 2024 amendments, with no pre-ticked boxes or dark patterns.
Penalties
Bodies corporate: greater of AUD 50M, 3x benefit, or 30% of adjusted turnover. Individuals: up to AUD 2.5M. New tiered civil penalty process.
Key Requirements
- Consent must be voluntary, informed, current, specific, and unambiguous
- Pre-ticked boxes, vague wording, and dark patterns restricted
- Personal information includes IPs, device IDs, cookie identifiers
- Mandatory data breach notification
- New statutory tort for serious invasion of privacy
- Children's Online Privacy Code to be developed by December 2026
Notable Provisions
- December 2024 amendments — most significant ever
- IPs, device IDs, cookies now explicitly personal information
- AUD 50M or 30% of turnover penalties
- New statutory tort creates private right of action
- Small business exemption (under AUD 3M) still in place
Data Subject Rights
Right to access personal information held by an organization under APP 12
Right to request correction of personal information under APP 13
Other Asia Pacific Regulations
Frequently Asked Questions
What changed in Australia's Privacy Act in 2024?
The most significant amendments since 1988: personal information now explicitly includes cookies, IPs, and device IDs. Consent standards were strengthened. A statutory tort for privacy invasion was created.
Are cookies now personal information in Australia?
Yes. The December 2024 amendments explicitly include IP addresses, device IDs, and cookie identifiers in the definition of personal information.
What are Australia's privacy penalties?
The greater of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover during the relevant period.
Does Australia have a private right of action?
Yes. The new statutory tort for serious invasion of privacy creates a private right of action, commencing by June 2025.
Stay compliant with Australian Privacy Act
ConsentStack helps you implement Opt-in consent for Australia automatically.