(Cth) Require Consent for Online Tracking

Anamarie Raič, Despina Pavlou & Hamish Wallace
Apr 28
7 min read

Author: Anamarie Raič, Despina Pavlou & Hamish Wallace | Publish date: 28/4/2026

P: In Australia, websites and apps are not required to request explicit consent before collecting data to track individuals.
S: The Attorney-General should amend Australian Privacy Principle 3 in Schedule 1 of the Privacy Act 1988 (Cth) to prohibit the collection of personal information via non-essential cookies and other tracking technologies without first gaining explicit consent.
E: Associate Professor Katharine Kemp: ‘A plain default rule that cookies and similar tracking technologies must not be used without clear, unequivocal and active consent is appropriate, except for strictly necessary cookies and technologies used for functionality.’

Problem Identification:

Privacy Principle 3 in Schedule 1 of the Privacy Act 1988 (Cth) (the Act) states that relevant entities ‘must collect personal information only by lawful and fair means’ and limit collection to what is ‘reasonably necessary for [their] functions or activities’. This is understood to allow the collection of personal information through online tracking methods as soon as a website or app is accessed.

The ACCC’s (Australian Competition and Consumer Commission) Digital Platforms Inquiry stated that the Act ‘does not contain sufficient mechanisms to allow consumers to understand and control how their data is collected [online] and for what purposes.’

Context:

The most common form of online tracking is cookies, which refer to ‘small files that web pages save to your device.’ Essential cookies are required for websites to function. In contrast, non-essential cookies are used for analytics and advertising tracking, typically through third-party services.

Other tracking technologies used by websites and apps include ‘web beacons or pixel tags’, ‘device or browser fingerprinting’, ‘mobile device tracking’ (including for approximate or precise location), and ‘cross-device tracking’.

NordVPN found that Australian websites use an average of 18.6 trackers to collect data.

Arguments:

A survey by the Office of the Australian Information Commissioner (OAIC) from 2023 found that ‘84% [of Australians] want more control … over the collection and use of their personal information’, and noted that 50% of people ‘feel they have no choice but to hand over their personal information … to access a service’. James Patto from Scildan Legal described online tracking as an ‘opaque data-sharing ecosystem’ where ‘consent is often meaningless or absent’ and ‘control and accountability are fragmented’. According to a Consumer Policy Research Centre (CPRC) survey from 2020, ‘94% of Australian consumers are uncomfortable with how their personal information is collected and shared’. An Australian Economic Review (AER) article noted that ‘people are barely aware of the extent to which their personal information is collected and shared; nor do they have full control over their personal information.'

According to the Australian Signals Directorate, ‘the more personal data from customers that businesses hold the more … risk if a data breach occurs.’ The OAIC stated that ‘data breaches can cause significant harm in multiple ways’, as victims ‘may be at risk of serious harm … to their physical or mental well-being, financial loss, or damage to their reputation.’ In 2023, The Observer found that 20 National Health Service trusts in the UK had installed Meta’s Pixel tracker on their websites, ‘sharing intimate details about patients’ medical conditions, appointments and treatments with Facebook without consent and despite promising never to do so.’ Former Australian Information Commissioner and Privacy Commissioner Angelene Falk stated that the ‘increased occurrence of incidents that affect multiple parties is a reason … data breaches [are growing] in complexity, scale and impact,’ particularly when personal information handling is outsourced to third-party providers.

The AER article noted that stricter privacy laws ‘may help protect privacy but stifle innovation and competition, and harm data-driven businesses.’ However, Australian Privacy Commissioner Carly Kind argued that ‘good privacy practices and clear laws will support innovation’ because a ‘more productive economy is contingent upon Australian consumers confidently participating in the digital economy and businesses retaining the trust of their customers’. Falk argued that ‘trust based on an organisation’s solid privacy foundations will play a fundamental role in supporting successful innovation’. The AER article suggested ‘that a desirable cookie policy is the one that leads to the collection of more data types with larger benefits [for firms] and lower privacy costs [for consumers].’

Advice/Solution Identification:

Kemp, the ACCC's Digital Platforms Inquiry, the CPRC, and Digital Rights Watch have all called for requiring consent for online tracking. According to the ACCC, ‘a requirement to obtain consent … will both increase the transparency of information processing and significantly reduce the … power imbalance between consumers and [digital platforms]’. They stated this ‘assists consumers to make rational and informed choices about which digital platform service to use’, and noted that ‘strong privacy protections … can promote competition, innovation, and the welfare of individual consumers’.

Precedent:

There is international precedent for requiring consent for online tracking. In the EU, ‘“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes’.

Public support:

This list reflects publicly stated positions and should not necessarily be taken as endorsement of this specific brief.

News Coverage:

The Conversation - “What does it mean to ‘accept’ or ‘reject’ all cookies, and which should I choose?” The article explained what cookie consent options mean and how they affect online privacy. By: Ahmed Ibrahim and David Cook | 19 May 2025 - Read the article here.
The Guardian - “Get a VPN and delete your cookies, Australia’s privacy laws are still lagging behind”. The article highlighted weaknesses in Australia’s privacy laws, with consumer protections delayed due to industry lobbying. By: Paul Karp | 9 September 2024 - Read the article here.
Forbes - “94 Billion Stolen Browser Tracking Cookies Published To Dark Web”. The article analysed the ramifications of stolen cookies and outlined practical mitigation strategies. By: Davey Winder | 27 May 2025 - Read the article here.
News.com.au - “Aussies’ private data being shared without consent through online advertisers exposing them to scammers”. The article covered data collection, data reselling, and scam risks in an Australian context. By: Emma Kirk | 4 October, 2024 - Read the article here.

Where to go to learn more:

(2019) Digital Platforms Inquiry | Australian Competition and Consumer Commission - This inquiry covered a wide variety of issues surrounding digital platforms and made several recommendations, including requiring consent for online tracking. Read the full report here.
(2022) Privacy Act Review Report | Attorney-General’s Department - This report discussed proposals for ongoing Privacy Act 1988 (Cth) reforms, including consent for online tracking. Read the full report here.
(2023) Australian Community Attitudes to Privacy Survey | Office of the Australian Information Commissioner - This report contained the results of a broad survey that covered public attitudes towards many aspects of privacy and data collection. Read the full report here.
(2024) ‘Singled Out’ Report | Consumer Policy Research Centre - This report explored consumer understanding of privacy notices and the impacts of data broking. Read the full report here.
Privacy Act 1988 (Cth) - Read the full Act here.

Human Perspective:

Emily is a 28-year-old who enjoys online shopping and browsing social media. She always made sure to ‘reject all’ tracking when presented with a website pop-up, but was unaware that most websites in Australia track without asking or even notifying. This meant her personal data, including her location, purchases, and online habits, was still being shared hundreds of times a day, often through unknown third parties. One afternoon, she received a warning message claiming to be from her bank, and it was particularly convincing as it referenced brands she had recently shopped at and her postcode. Having believed it to be legitimate, Emily used the included phishing link to view her account, which quietly provided her banking information to the scammers. A series of fraudulent purchases was rapidly made using her account before Emily realised what had happened. As a result, Emily became anxious, stressed, and exhausted as a result of the subsequent month-long effort to secure her banking and reclaim her lost finances. She no longer knows who she can trust online.

To protect the anonymity of those involved, this is a fictionalised account drawn from an amalgamation of real-life stories, experiences and testimonials gathered during the research process for this brief. Any resemblance to actual individuals is purely coincidental.

Conflict of interest/acknowledgment statement:

N/A

Support

If your organisation would like to add your support to this paper or suggest amendments, please email Info@foreaustralia.com.

Disclaimers

Please review all FORE disclaimers here.

Reference list:

Australian Competition and Consumer Commission. (2019). Digital platforms inquiry: Final report. https://www.accc.gov.au/system/files/Digital%20platforms%20inquiry%20-%20final%20report.pdf

Australian Competition and Consumer Commission. (2022). Digital platform services inquiry: Interim report No. 5 – Regulatory reform. https://www.accc.gov.au/system/files/Digital%20platform%20services%20inquiry%20-%20September%202022%20interim%20report.pdf

Australian Signals Directorate. (2023, August 30). Data breaches. https://www.cyber.gov.au/threats/types-threats/data-breaches

Australian Signals Directorate. (2025, July 23). Securing customer personal data. https://www.cyber.gov.au/business-government/small-business-cyber-security/securing-customer-personal-data

Consumer Policy Research Centre. (2020). Response to Privacy Act review issues paper [Submission to the Attorney-General’s Department]. https://www.ag.gov.au/sites/default/files/2021-01/consumer-policy-research-centre.PDF

Consumer Policy Research Centre. (2020, December 7). CPRC 2020 data and technology consumer survey. https://cprc.org.au/report/cprc-2020-data-and-technology-consumer-survey/

Das, S. (2023, May 28). NHS data breach: Trusts shared patient details with Facebook without consent. The Guardian. https://www.theguardian.com/society/2023/may/27/nhs-data-breach-trusts-shared-patient-details-with-facebook-meta-without-consent

Das Chaudhury, R., & Chongwoo, C. (2023). Digital privacy: GDPR and its lessons for Australia. Australian Economic Review, 56(2), 204–220. https://doi.org/10.1111/1467-8462.12506

Digital Rights Watch. (n.d.). The privacy pledge. https://digitalrightswatch.org.au/the-privacy-pledge/

Globytė, E. (2022, October 31). NordVPN research: Which countries’ websites have the most trackers? NordVPN. https://nordvpn.com/blog/nordvpn-research-website-trackers/

Ibrahim, A., & Cook, D. (2025, May 19). What does it mean to ‘accept’ or ‘reject’ all cookies, and which should I choose? The Conversation. https://theconversation.com/what-does-it-mean-to-accept-or-reject-all-cookies-and-which-should-i-choose-256219

Kemp, K. (2021). The absence of competition in the privacy terms of online marketplaces [Submission to the Australian Competition and Consumer Commission]. https://www.accc.gov.au/system/files/Dr%20Katharine%20Kemp%20%2816%20August%202021%29.pdf

Kind, C. (2025, July 31). Getting AI right benefits businesses, productivity and the community. Office of the Australian Information Commissioner. https://www.oaic.gov.au/news/blog/getting-ai-right-benefits-businesses,-productivity-and-the-community

Office of the Australian Information Commissioner. (2022, May 1). Privacy in focus as the foundation of trust this Privacy Awareness Week. https://www.oaic.gov.au/news/media-centre/privacy-in-focus-as-the-foundation-of-trust-this-privacy-awareness-week

Office of the Australian Information Commissioner. (2023, August 8). Australian community attitudes to privacy survey 2023. https://www.oaic.gov.au/engage-with-us/research-and-training-resources/research/australian-community-attitudes-to-privacy-survey/australian-community-attitudes-to-privacy-survey-2023

Office of the Australian Information Commissioner. (2024, February 22). Data breach report highlights supply chain risks. https://www.oaic.gov.au/news/media-centre/data-breach-report-highlights-supply-chain-risks

Office of the Australian Information Commissioner. (2025, February). Part 1: Data breaches and the Australian Privacy Act. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-1-data-breaches-and-the-australian-privacy-act

Patto, J. (2025, July 4). The hidden privacy risks of pixels, cookies and third-party sharing. Scildan Legal. https://www.scildanlegal.com.au/blog-posts/the-hidden-privacy-risks-of-pixels-cookies-and-third-party-sharing

Privacy Act 1988 (Cth). https://www.legislation.gov.au/C2004A03712/latest/text

Regulation 2016/679. Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

Solo, A. (2025, June 13). Creating a cookie policy for your Australian business website. Sprintlaw. https://sprintlaw.com.au/articles/creating-a-cookie-policy-for-your-australian-business-website/

Zahra, M. (2026, April 24). I have a website. Do I need a cookie consent pop-up? LegalVision. https://legalvision.com.au/cookie-consent-pop-up/#what-is-the-australian-law-regarding-cookies