If you market a business in health or another sensitive sector in Australia, the proposed changes to the country’s privacy laws deserve your attention now, not once they’re passed.
The reforms will change how businesses can collect, use and share personal information. For marketers, that means a closer look at tactics many of us treat as standard: installing tracking pixels, uploading customer lists and building remarketing audiences on social media platforms.
The New “Fair and Reasonable” Test
A central part of the proposed reforms is a new “fair and reasonable” test. It would apply to how businesses collect, use and disclose personal information.
In practice, this puts first-party audiences under much tighter scrutiny. Sharing website visitor data through a pixel, or uploading customer data to an ad platform, would need to pass this test. Ticking a consent box would no longer be enough on its own.
For businesses that rely on remarketing, especially on social media, this could have a big impact on how audiences are built and who you can reach.
Current Privacy Law Already Has Teeth
It would be easy to assume the risk only starts once the reforms pass. That’s not the case. Australia’s current privacy laws are already being enforced.
In June 2026, the Australian Privacy Commissioner found that Monash IVF and telehealth provider Medmate had breached existing privacy law through their use of third-party tracking pixels.
In Monash IVF’s case:
- The tools: Meta Pixel and Custom Audiences were used to retarget people.
- The targeting: Identifiable individuals were retargeted based on their interactions with pages containing fertility-related content.
- The finding: The Commissioner found that sensitive health information had been collected without proper consent and used for targeted advertising.
This is a clear signal that regulators are paying attention to how ad tech handles sensitive information, even under current rules.
Stricter Consent Requirements Are Coming
The proposed reforms go further again. For consent to be valid, it would need to be:
- Voluntary: Freely given, not forced or bundled as a condition of service.
- Informed: The person understands what they’re agreeing to.
- Current: Still valid at the time the data is used, not given once and assumed forever.
- Specific: Tied to a clear purpose, not a blanket approval.
- Unambiguous: A clear, positive action, not implied by silence or a pre-ticked box.
For health businesses in particular, where almost any page visit can reveal something sensitive about a person, meeting this standard with a standard pixel setup will be difficult.
What This Means for Australian Marketers
Collecting customer data, building audiences and sharing information with ad platforms or third-party data providers are all tactics that now need careful thought. A few practical steps to take now:
- Audit your tracking: Know exactly which pixels and tags are on your site, what data they send, and to whom.
- Review sensitive pages: Consider whether tracking belongs on pages about health conditions, treatments or other sensitive topics at all.
- Check your audience lists: Review how your custom audiences and customer list uploads are built, and what consent sits behind them.
- Revisit your consent flow: Make sure your consent mechanisms would stand up to the “voluntary, informed, current, specific and unambiguous” standard.
- Plan for less remarketing data: Build strategies that don’t depend entirely on retargeting identifiable individuals.
If you’re unsure how these changes affect your advertising, get in touch with Brik Digital and we can review your tracking and audience setup with you.
This article is general information only and isn’t legal advice. Speak with a privacy or legal professional about your specific obligations.
Privacy Commissioner’s findings:
https://www.oaic.gov.au/news/media-centre/privacy-commissioner-finds-privacy-breaches-in-third-party-tracking-pixel-investigation
Proposed privacy reforms:
https://www.ag.gov.au/rights-and-protections/publications/privacy-act-review-report
