By Mitch Bruce -
Snapshot
- In recent tracking pixel determinations, the Privacy Commissioner has adopted a broader interpretation of what constitutes personal and/or sensitive information under the Privacy Act.
- The determinations also make clear that users of online tracking tools, such as pixels, are considered to have ‘collected’ personal information even though data is sent to and stored by third parties, and targeted advertising constitutes ‘direct marketing’.
- Users of these tools are responsible for compliance with the Australian Privacy Principles and must meet requirements for sufficiently specific notification and consent. Website operators should review their online tracking and privacy practices, and perform privacy impact assessments before deployment of online tracking tools.
A pair of recent determinations made by the Privacy Commissioner (‘Commissioner’) have broad implications for the application of Australia’s privacy law to website providers and digital marketers. These determinations related to the use of ‘tracking pixels’ in the healthcare context, however the implications extend to any website operator that uses online tracking techniques such as the Meta Pixel or Google Analytics tools.
On 24 June 2026 the Commissioner published the determinations against Medmate Australia Pty Ltd (Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41 (‘Medmate’)) and Monash IVF Pty Ltd (Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40 (‘Monash’)), in which she determined these health service providers contravened the Privacy Act 1988 (Cth) in their use of tracking pixels due to the lack of notice provided or consent sought for the personal and sensitive information collected and shared with third parties, including for use in direct marketing.
In the determinations, the Commissioner took a broad interpretation of what constitutes personal and/or sensitive information, taking into account the state of tracking technologies. She confirmed that targeted advertising amounts to direct marketing and emphasises the need for specificity in notice and consent mechanisms.
