Privacy Act tranche 2 exposure draft: what it could mean for marketing

The August 2026 exposure draft proposes a fair and reasonable test, consent to trade data and new direct marketing rules. It is a draft, not law.

31 August 202611 min read

On 31 August 2026 the Attorney-General, the Hon Michelle Rowland MP, released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, together with a consultation paper. This is the proposed second tranche of Privacy Act reforms, following the Privacy and Other Legislation Amendment Act 2024. Submissions closed on 18 September 2026.

This is a draft, not law. Nothing in it applies to your practice today, the wording may change, and the consultation paper says commencement, application and transitional provisions are not yet settled. We are covering it because several proposals go straight to how health practices advertise online, particularly retargeting, custom audiences and tracking pixels, and it helps to understand the direction before you commit to new marketing systems.

What changed

Nothing has changed in the law yet. What happened on 31 August 2026 is that the Government published draft legislation and asked for feedback on how it would operate in practice. According to the consultation paper, the package contains roughly 40 proposals:

25 Privacy Act Review proposals that uplift privacy protections;
5 Privacy Act Review proposals designed to clarify and simplify obligations;
4 additional measures to further simplify current obligations; and
7 additional measures to improve the efficiency of the OAIC.

The Attorney-General’s media release highlighted four initiatives: a fair and reasonable test, a right to erasure against large digital platforms, stronger standards for consent, and measures to stop businesses trading in personal information without clear permission. The consultation also sought views on emerging technologies, including wearable devices such as smart glasses, and connected vehicles.

The rest of this article describes what is proposed. Where we say “would”, read it as “would, if enacted as drafted”.

Who it would apply to

The proposals would amend the Privacy Act 1988, so they would apply to APP entities. Health service providers are already covered by the Privacy Act regardless of turnover, according to the OAIC, so practices of every size would be affected by any changes to the APPs. Some measures are narrower: the right to erasure would apply only to large digital platforms, and the ad-supported service rules are aimed at platforms rather than advertisers.

The proposals would also affect agencies and service providers, through a new framework for “controllers” and “processors”.

What the draft proposes

Updated core definitions

Personal information would cover information that “relates to” an identified or reasonably identifiable individual, rather than information “about” them. A new definition of “reasonably identifiable” would look at whether someone could be identified by combining information with other reasonably available information. A note would clarify that a person can be identifiable without their name being known, where they can be singled out or treated as a distinct individual.
Sensitive information would expand to include precise geolocation tracking data (location within a 500 metre radius, collected over time) and genomic information.
Collects would make clear that information is collected regardless of its source, including where it is generated or derived through data analysis or artificial intelligence. There are specific rules about when sensitive information derived from other information is taken to be collected.
Disclosure would mean making personal information accessible to another person or body.
Consent would have to be voluntary, informed, current, specific and unambiguous. The paper says bundled consent and interfaces that make it unreasonably hard to refuse would likely not be voluntary, and pre-selected settings or pre-ticked boxes would likely not be enough.

A single “fair and reasonable” test

Existing APPs 3, 4 and 6, which deal with collection and use and disclosure, would be replaced by a single principle that permits handling personal information only where it is fair and reasonable in the circumstances, unless an exception applies. Entities would consider legislated factors as a holistic assessment. The consultation paper describes factors including:

reasonable expectations of a reasonable person in the individual’s circumstances;
the relationship to the entity’s functions or activities;
transparency;
data minimisation;
genuine choice;
impacts on the individual and proportionality; and
the best interests of the child, where information relates to a child.

Two points matter for marketing. First, the paper says a practice does not necessarily become reasonably expected simply because it is described in a collection notice or privacy policy. Second, there would no longer be an express requirement to obtain consent for unexpected secondary uses; instead, the use would need to pass the fair and reasonable test, with genuine choice as one factor.

Consent to collect sensitive information or to “trade”

A separate principle would require consent to collect sensitive information, as now, and new consent to “trade” personal information, unless an exception applies. The proposed definition of trade covers disclosure for monetary or other consideration, or for direct marketing purposes. The paper says disclosure for direct marketing purposes is intended to be interpreted broadly and “may include disclosures of cookies or pixels in programmatic advertising processes.”

There are four carve-outs: disclosures necessary to provide a product or service the individual requested; disclosures incidental to selling a business; disclosures to a processor acting on documented instructions; and disclosures necessary to deal with unlawful activity or serious fraud. Even where a carve-out applies, the fair and reasonable test still applies.

Two new exceptions to the consent requirement for collecting sensitive information are proposed: collection from a publicly available document, and collection strictly necessary to provide a good or service the individual explicitly requested. The paper states that the second exception does not apply to direct marketing.

Simpler notices

Collection notices would focus on the fact and circumstances of the collection and the purposes of use or disclosure. Notices must not be excessive, vague or ambiguous, and would need updating when practices change.

A new direct marketing framework

APP 7 would be replaced. Key features described in the paper:

Direct marketing would be defined to include advertising directed to an individual using their personal information, whether targeted individually or as part of an audience, segment or cohort.
Examples given include emails, text messages, telemarketing calls, targeted social media advertising and online behavioural advertising based on personal information, including browsing history. Group-level targeting that relies on personal information is expressly included.
Consent would not be required for direct marketing itself, but consent would be required to trade personal information.
Organisations would still have to provide a simple means of opting out, take reasonable steps to give effect to opt-out requests, and include clear opt-out information in each communication.
Where an advertiser and a social media platform are both involved, the platform would generally be responsible for the opt-out requirement unless it is acting solely as a processor.

Data breaches and security

A 72-hour deadline to notify the Commissioner after becoming aware of reasonable grounds to believe an eligible data breach has occurred, with the option of an incomplete statement followed by updates. The 30-day deadline to assess a suspected breach would remain.
An express obligation to have practices, procedures and systems to respond to breaches, and to take reasonable steps to contain breaches and reduce harm.
APP 11 changes requiring entities to be able to identify the personal information they hold, consider destruction of information no longer needed before choosing de-identification, and regularly evaluate the effectiveness of their security and destruction measures.

Controllers and processors

Where one APP entity handles personal information on behalf of another under documented instructions, the processor’s acts would be treated as the controller’s. Processors would remain directly responsible for APP 1 and APP 11.

Complaints and the OAIC

The Bill is also intended to include OAIC efficiency measures. Under these, individuals would generally need to raise privacy concerns with the entity first, and APP entities would need accessible complaint mechanisms, a response within 60 days and written decisions. Breaches of these complaint-handling obligations would be an interference with privacy.

Other measures

The draft also proposes a right to erasure for large digital platforms and a single exception for ethically reviewed human research, which would start once new research guidelines are in place.

What it could mean for your marketing

Paid social, retargeting and lookalike audiences

Under the proposed definition, retargeting and audience-based campaigns that rely on personal information would clearly be direct marketing, including group-level targeting. If pixel data or customer lists are disclosed to platforms for advertising, that disclosure may be a trade needing consent. For health practices, this sits on top of the existing rule that collecting sensitive information needs consent, and the OAIC’s June 2026 findings that pixel tracking on health websites for social media advertising is a collection of sensitive information.

Website and consent tools

The proposed consent definition would make pre-ticked boxes and bundled “accept all” approaches harder to rely on. A consent tool that loads trackers before the visitor chooses, or makes refusing difficult, would look weaker against the voluntary and unambiguous elements.

Email and SMS

The draft direct marketing framework would not itself require consent to email your own patients, but the fair and reasonable test would apply to how you use their information. Opt-out requirements would continue. Spam Act rules for commercial email and SMS are separate, and the paper says the existing carve-out for communications regulated by certain other laws would be replicated.

Agencies

If your agency is a processor acting on documented instructions, the controller and processor framework would make your practice primarily responsible for most APPs in relation to what the agency does for you. Written instructions would matter.

Data held in marketing systems

The proposed APP 11 changes would push practices to know what personal information sits in CRMs, email platforms and form plugins, and to destroy what is no longer needed.

Common mistakes we see

Treating an exposure draft as if it were already law, or waiting for it to pass before fixing issues that are already non-compliant today.
Assuming that a disclosure in the privacy policy makes any use of data reasonable.
Building new marketing around health-page retargeting without considering both current rules and the proposed direction.
Having no written instructions with agencies that handle patient data.
Keeping marketing data indefinitely because nobody owns the decision to delete it.

A practical checklist

Fix current issues first: pixels on health pages, privacy policy accuracy and working opt-outs.
List every disclosure of personal information to an advertising platform, including pixels and customer list uploads.
Check whether your consent tool lets visitors refuse as easily as they accept, with nothing pre-selected.
Put written instructions in place with agencies and vendors that handle patient or enquiry data.
Map what personal information sits in each marketing system and set retention periods.
Review your data breach plan against a possible 72-hour notification window.
Check your complaint handling process and response times.
Watch for the bill’s introduction to Parliament and any changes from the draft.

How this fits with other rules

Today, your obligations come from the Privacy Act as amended in 2022 and 2024, the OAIC’s guidance and determinations, Ahpra’s advertising rules under the National Law, the Australian Consumer Law and the Spam Act. The exposure draft would change the Privacy Act part of that picture if enacted. It would not change what Ahpra allows you to say in advertising.

The 2024 Act’s remaining start date still applies regardless of this draft: privacy policies must describe certain automated decisions from 10 December 2026.

Frequently asked questions

Is the tranche 2 bill law?

No. It is an exposure draft released for consultation on 31 August 2026. It has no commencement date, and its content may change.

Would we need consent to run ads to our own patients?

The paper says the new framework would not require consent for direct marketing itself, but would require consent to trade personal information, and disclosures for direct marketing may be a trade. Collecting sensitive information already needs consent. How this applies to a particular campaign would depend on the final law.

Would tracking pixels be banned?

The draft does not propose a ban. The paper says disclosures of cookies or pixels in programmatic advertising may be a trade requiring consent, and all handling would need to be fair and reasonable.

Does the small business exemption matter?

For practices, generally not. The OAIC states that health service providers are covered by the Privacy Act regardless of turnover.

When would it start?

The consultation paper says application, transitional and commencement provisions are not yet settled.

Can we still comment?

Submissions closed on 18 September 2026.

Need a hand?

The most useful step now is to get today’s basics right, because they are also the foundation for whatever tranche 2 becomes. Our compliance audit covers pixels, consent tools, privacy policies and opt-outs, and our clinic websites team can build consent and tracking that you can adjust as the law settles. Our compliance training can brief your team on current rules and the proposed changes.

This article is general guidance based on the published exposure draft and consultation paper, not legal advice. Final responsibility for how your marketing handles personal information sits with your practice, and complex situations may need independent legal or privacy advice.