Australia has no cookie law. There is no Australian equivalent of the EU rule that makes you ask before you set a cookie, and no legal requirement to show a cookie banner at all.
That is the part people get right. The part they get wrong is concluding that tracking is therefore outside the Privacy Act. It is not. The Act does not care what the technology is called, it cares whether personal information is being collected, used or disclosed. A great deal of tracking does exactly that.
What the regulator said in June 2026
On 24 June 2026 the Privacy Commissioner published determinations against two Australian businesses over third-party tracking pixels. Both were found to have contravened APP 3.3, APP 5.1 and APP 7.1 by collecting and using health information for targeted advertising without the knowledge or consent of the people affected.
Two findings matter for everyone else:
- A cookie banner is not consent for a tracking pixel. The Commissioner found a reference to cookies was not specific enough to cover pixels, which are a different thing and can follow someone across devices in a way a cookie cannot.
- For sensitive information, the bar is higher. Consent has to be specific to what is actually happening, and general wording does not reach it.
We wrote these up for small businesses when they landed.The full account is here.
What your policy should say
Not “we use cookies to improve your experience”. That sentence appears on tens of thousands of Australian websites and tells a reader nothing. What is useful, and what stands up:
- What you actually run. Analytics, advertising pixels, session recording, chat widgets, embedded video, social share buttons, name the categories you genuinely use.
- Who receives the data. A pixel sends information to someone else. That is a disclosure, and your policy has to describe disclosures.
- What it is used for. Measuring traffic is a different purpose from building an advertising audience, and the second one is the one people object to.
- Whether any of it leaves Australia, and which countries it goes to. Most analytics and advertising platforms are overseas, which makes this an APP 8 question too.
- What someone can do about it. Browser controls, opt-outs, and how to ask you.
Sensitive information changes the answer
If your site is about health, and someone lands on a page about a condition, the fact they visited can itself be health information. The same logic reaches other sensitive information under the Act: racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and more.
Tracking that is unremarkable on a hardware shop is a much more serious matter on a clinic, a legal practice, a counselling service or an advocacy group. If that is your business, the pixel on your booking confirmation page deserves a careful look.
How to find out what your site actually loads
Most owners genuinely do not know. Tags get added by a developer, an agency, a marketing contractor or a plugin, and nobody writes it down. Your browser’s developer tools will show you the network requests a page makes, which is the honest answer and a tedious one.
It is also something we check. Every paid report names the third parties your pages contact, because you cannot describe tracking in a policy you have never seen.
General information, not advice. This is general information about Australian law, the same for every reader. It is not advice about your situation, and AegorIQ is not a law practice. If you are unsure which parts apply to you, your accountant or a lawyer can tell you.