Regulatory update
The OAIC’s guidance on the use of tracking pixels
The OAIC has released guidance on how private sector organisations can meet their Privacy Act obligations when using third-party tracking pixels. Here are the key lessons.
7 November 2024
The Office of the Australian Information Commissioner (OAIC) has released its long-awaited guidance on tracking pixels. It explains how private sector organisations can meet their obligations under the Privacy Act 1988 (Cth) (the Privacy Act) when they use third-party tracking pixels on their websites.
The OAIC developed the guidance because businesses asked for more detail on how the Privacy Act applies to tracking technology. Government, the media and the community have also shown growing interest in the issue.
Update (October 2026): Two important developments have happened since this article was published:
- First tracking pixel determinations. On 24 June 2026, the OAIC announced that the Privacy Commissioner had found telehealth provider Medmate Australia and fertility provider Monash IVF interfered with people’s privacy through third-party tracking pixels. The Commissioner said that using pixels on health-related websites to track visitors and target them with social media ads is a collection of sensitive information, which needs the user’s consent.
- Privacy law reforms. The Privacy and Other Legislation Amendment Act 2024 (Cth) became law on 10 December 2024. It gave the OAIC new enforcement tools and created a statutory tort for serious invasions of privacy, which started on 10 June 2025. We explain these changes below.
Key takeaways
- The Privacy Act does not ban tracking pixels.
- If a tracking pixel collects or shares personal information, your business has obligations under the Australian Privacy Principles (APPs).
- Information like an IP address or a hashed email can be personal information if it can be matched with other data.
- You should set up pixels to collect as little personal information as possible, and avoid sharing sensitive information.
- Your privacy policy and collection notices must clearly explain your use of tracking pixels.
- Review your tracking tools regularly. Do not set and forget them.
On this page
What is a tracking pixel?
A tracking pixel is a small piece of code that a third-party provider (such as a social media platform) gives you to place on your website. When someone visits a page with the pixel, it loads and sends data about their activity to the provider’s server.
Businesses use tracking pixels for many reasons, including to:
- analyse website traffic, such as which pages people visit, how long they stay and their demographics
- show targeted ads to individual users on other platforms, and
- measure how well advertising campaigns are working.
Pixel providers usually offer a dashboard where you can track, test and change your pixel settings.
Along with cookies and similar tools, pixels allow detailed tracking of users across websites and social media. They are valuable for analysis, advertising and measuring return on investment. However, they also raise privacy concerns. Australian Privacy Commissioner Carly Kind said:
“Many of these tracking tools are harmful, invasive and corrosive of online privacy.”
When does the Privacy Act apply to tracking pixels?
Your business has privacy obligations if your use of a tracking pixel leads to the collection, use or disclosure of personal information.
The Privacy Act contains 13 APPs. These are legally binding rules for how APP entities handle personal information and sensitive information.
What is personal information?
Personal information is information or an opinion about an identified person, or a person who is reasonably identifiable. It can include technical information and information that is inferred about someone.
A person does not have to be named to be reasonably identifiable. For example, an IP address, URL information or a hashed email collected by a pixel may be linked with other information the platform holds. If so, both your business and the platform will have privacy obligations for that information.
Key lessons from the OAIC’s tracking pixel guidance
- Do your due diligence. The Privacy Act does not ban tracking pixels. But you should check that any third-party pixel is set up and used in a way that complies with the Privacy Act and the APPs.
- Collect only what you need (APP 3). Configure pixels to limit the personal information collected to the minimum needed.
- Protect sensitive information (APP 3). Sensitive information includes health information, political opinions and racial or ethnic origin. You generally need a person’s consent to collect it, and you should make sure pixels do not send it to third-party platforms.
- Be open about it (APPs 1, 3 and 5). Collecting information secretly is likely to be an unfair way of collecting it. Your privacy policy and collection notices must clearly explain your use of third-party tracking pixels.
- Use information only for the right purpose (APP 6). Personal information shared through pixels must be for the main purpose you collected it, or for another purpose if an exception applies.
- Check overseas transfers (APP 8). If the provider sends personal information overseas, you must take reasonable steps to make sure the overseas recipient does not breach the APPs, unless an exception applies.
- Follow direct marketing rules (APP 7). Using pixels to target people with online ads is direct marketing. You must give people a simple way to opt out.
- Review regularly. Check the tracking tools on your website on a regular, ongoing basis to make sure they are still appropriate and compliant.
How have privacy laws changed since this guidance?
The Privacy and Other Legislation Amendment Act 2024 (Cth) received Royal Assent on 10 December 2024. Its changes start on different dates. Those most relevant to businesses using tracking pixels include:
- New penalties and enforcement tools. The OAIC can now issue compliance notices and infringement notices for certain less serious breaches of the APPs. There is also a new mid-tier civil penalty, as well as the existing penalty for serious interferences with privacy. Most changes to the OAIC’s powers started on 11 December 2024.
- A statutory tort for serious invasions of privacy. Since 10 June 2025, individuals can sue for a serious invasion of their privacy in some circumstances.
- Automated decision making. From 10 December 2026, privacy policies must explain when a computer program uses personal information to make decisions that could significantly affect people.
- Children’s Online Privacy Code. The OAIC must develop and register a code for online services likely to be used by children by 10 December 2026.
These changes increase the risk for businesses that do not manage their tracking tools properly.
Do you have any questions about tracking pixels?
We can help you review your website tracking tools, privacy policy and collection notices. Learn more about our data and privacy law services.
Alternatively, you can give us a call, send us a message or book a call with us by clicking the buttons below.
Frequently asked questions
Are tracking pixels illegal in Australia?
No. The Privacy Act does not ban them. However, if a pixel collects or shares personal information, you must comply with the APPs.
Do I need consent to use a tracking pixel?
You generally need consent if the pixel collects sensitive information, such as health information. The OAIC has found that tracking visitors to health-related websites and targeting them with ads is a collection of sensitive information.
What should my privacy policy say about tracking pixels?
It should explain that you use tracking pixels, what kinds of information they collect and why. Your collection notices should also tell people about the pixel providers and any overseas recipients.
Does the Privacy Act apply to my small business?
Not always. Many small businesses with an annual turnover of $3 million or less are exempt, but some are covered, such as health service providers. Get advice if you are unsure.
Need advice?
Talk to our banking and financial services team
Banking & Financial Services Law
Our team can help you understand what this means for your business and what to do next. Learn more about our banking and financial services law expertise.
This article is general information only and is not legal advice. It reflects the law and information available at the date of publication. Please contact us for advice about your circumstances.
Related updates
Table of Contents
Posted in Data & Privacy Law