← ALL REGULATIONS
Australia’s Privacy Act and cookies: no banner rule, real duties.
Australia has no specific cookie consent law. The Privacy Act 1988 applies when cookies or pixels collect personal information, which brings notice duties, limits on use and disclosure and an opt-out from direct marketing, and the OAIC has warned businesses about tracking pixels.
Privacy Act at a glanceNotice, consent in some cases
- Applies to
- Most businesses with annual turnover over A$3 million, and some smaller ones
- Cookie rules
- None specific; the Australian Privacy Principles apply to personal information collected by cookies
- Enforced by
- Office of the Australian Information Commissioner (OAIC)
- Penalties
- For serious interferences, the greater of A$50 million, three times the benefit, or 30% of adjusted turnover
WHAT PRIVACY ACT REQUIRES
What the Privacy Act asks of a site that uses cookies.
THE RULENotice at collectionAustralian Privacy Principle 5 requires telling people what is collected, why, and who it is disclosed to.
WITH KATLAKatla scans the site, classifies every cookie it finds and generates the cookie policy from that list, in 13 languages.
THE RULEUse and disclosure limitsPersonal information may be used or disclosed only for the purpose it was collected for, or a related one the person would expect.
WITH KATLAKatla shows each category’s purpose before a choice. In GDPR mode, which Auto uses for Australian timezones, tracking waits for an opt-in, which is more than the Act asks.
THE RULEAn opt-out from direct marketingAustralian Privacy Principle 7 requires a simple way to opt out of direct marketing.
WITH KATLAA floating settings icon, or your own "Cookie settings" link calling katla.open(), reopens the choice on any page.
THE RULEResponsibility for tracking pixelsThe OAIC’s guidance on tracking pixels makes businesses responsible for what pixels on their sites collect and send.
WITH KATLAThe scan lists every cookie and tracking pixel it finds, with its vendor. It does not inspect what a pixel sends in its requests.
Privacy Act questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Do Australian websites need a cookie banner?
- No law requires one. The Privacy Act applies when cookies collect personal information, and a banner is one way to give notice and choice, which also helps if the site serves EU visitors.
- Who does the Privacy Act apply to?
- Most businesses with annual turnover above A$3 million, plus some smaller ones, such as health service providers and businesses that trade in personal information.
- What changed in 2024?
- The Privacy and Other Legislation Amendment Act 2024 added tiered civil penalties, new enforcement powers for the OAIC and a statutory tort for serious invasions of privacy.
- What are the maximum penalties?
- For serious interferences with privacy, the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover in the relevant period.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.