Australia · Privacy and website tracking
What is your website sharing with advertising platforms?
A new advertising tool can change what your website shares without changing a single word of your privacy policy. Before the next campaign, find out what is actually leaving the site.
The regulator's message
In June 2026, the Australian Privacy Commissioner published findings involving tracking pixels on health-service websites. The determinations concerned collection of sensitive information and the need for consent. The OAIC also encouraged all entities covered by the Australian Privacy Principles to review their use of third-party tracking pixels.
Those findings do not mean every pixel is unlawful or that all website information is sensitive information. They do reinforce the need to understand the particular data, technology and legal obligations involved. This article is a practical reminder about existing obligations, not a new September requirement.
Look beyond the name of the tool
A page visit, search term, form event or purchase event can reveal more when combined with an identifier or other information. Ask what is transmitted, who receives it and whether it can identify or reveal something about a person. Information does not automatically fall outside privacy obligations simply because an email address has been hashed.
For businesses covered by the Privacy Act, assess the applicable collection, notice, use, disclosure, security and overseas-handling obligations. Where sensitive information is collected, consent is generally required unless an exception applies. A generic cookie banner does not, by itself, resolve these questions.
Five questions for marketing, technology and your agency
- What is installed? List pixels, tags, audience tools and server-side advertising integrations. Include tools added by agencies, plug-ins and past campaigns, with a named owner for each.
- What does each event send? Test representative pages, forms and customer journeys using controlled data. Record the actual fields and destinations, not only the vendor's default description.
- Could the data be sensitive or unnecessarily revealing? Review searches, page names, URLs and form fields as well as obvious identifiers. Remove or block unnecessary information before transmission.
- Do the choices work? Where consent is required, test collection before and after the choice is made. Check withdrawal and preference changes in the live configuration.
- Do your notices and contracts match reality? Reconcile privacy wording, vendor arrangements, access and retention with the verified flow. Make further tag changes subject to an agreed review process.
A useful first test
Choose one landing page from your next campaign and trace a test visitor from the ad through the form or checkout. Have marketing and technology review the same results. This often reveals gaps between what the campaign intends to measure and what the integration actually sends.
How Watchdog can help
Watchdog can help review the privacy implications of your website and marketing arrangements, clarify notices and consent processes, and identify questions for your technical team and vendors.