A landmark overhaul of the Privacy Act has been dealyed.
With attorney-general Mark Dreyfus’ latest statement saying the introduction of the laws to parliament is still on track for this month, media agencies and adtechs told AdNews they were unsurprised at the delay due to the complexity and scale of the project.
However, they are disappointed that they (and their clients) have once again been left in limbo without a date to work towards.
The federal government, reacting to online scams, regular data breaches and the rise of artificial intelligence, wants to reform privacy laws, including what data can be collected from individuals.
The advertising industry, however, is worried that some of the extra regulations will impact the collection of personal data, which enables fine targeting to specific audiences in digital ads.
Publicis Groupe ANZ’s chief data officer Maurice Riley, said that the delay, like the Google third-party cookies saga, is just “background noise” to the bigger conversation that needs to happen about how brands communicate their existing privacy commitments and build trust with consumers.
“Marketers don’t need to be lawyers, but they do need to work closely with them and bring their own expertise to the table: speaking the language of trust, transparency, and customer experience (CX),” he said.
“That’s the conversation to have with customers now, because avoiding it could already be costing brands their loyalty and confidence.”
Riley said that the challenge and opportunity now is to feed privacy into the broader CX strategy, with marketers driving the conversation around what privacy means for their brand and ensuring it resonates with what consumers care about - clear communication, the ability to give informed consent and take it away just as easily, as well as the data practices that reflect genuine respect for their privacy.
“If a marketer is speaking up in this space before the law, it’s because they’ve invested in understanding privacy, upskilling, and building frameworks that balance compliance with customer value and already recognise that doubling down on privacy is already a competitive edge,” he said.
Bench Media’s strategic partnerships manager, Laura Kleiman, said consumer privacy is crucial, but it is also closely linked to the health of the advertising, marketing, and media industries, so balancing privacy concerns with the needs of marketers, business implications, and the struggling media industry is essential.
"Stakeholders - including consumers, marketers, agencies, publishers, technology providers, and regulators - have varied interests, making it difficult to achieve a reform that satisfies everyone," she said.
Rapid technological advancements also further complicate policy updates, which require lengthy consultations and feedback processes, Kleiman said.
“Strong privacy practices help protect data and build loyalty, yet uncertainty around new regulations can cause hesitation in investing in proper data practices, especially for smaller businesses,” she told AdNews.
“This hesitation increases risks of non-compliance, fines, breaches, and reputational damage. Though delays in reform create uncertainty, stakeholders must remain informed and proactive in preparing for changes to protect both consumer trust and business interests.”
UM’s chief digital, data and technology officer, Adam Krass, said while the delay does raise questions about the real-world implications of such reforms.
“The fact that not all of the 106 recommendations have been included in the final bill may suggest that the government may be finding it challenging to balance the need for enhanced privacy protections with the operational realities faced by businesses,” he said.
Out of the 116 reforms suggested, the government agreed to 38 and agreed in principle to 68.
These include in-principle agreements that individuals should have a right to opt-out of their personal information being used or disclosed for direct marketing purposes; consent being required in order to trade an individual's personal information; and defining direct marketing, targeted advertising, targeting and trading.
Current technologies employed by companies may not be fit for purpose under the new regulations, potentially leading to costly custom solutions that are difficult to upgrade or maintain, not only adding to the operational burden but also raising concerns about the long-term viability of such bespoke systems, Krass said.
“While the intent behind the Privacy Act reform is clear, this could lead to a landscape where businesses are forced to navigate a patchwork of compliance requirements, ultimately driving up costs and complicating the delivery of personalised, data-driven services that consumers have come to expect,” he said.
Half Dome’s head of digital and growth and co-founder, Joe Frazer, said that his clients are looking to unlock consent management and stronger data security/privacy workflows, elements of the legislation that feel like “non-negotiables” based on the direction international markets have gone.
“Technological advancements in spaces like cookie deprecation and alternative identifiers have meant that there are pre-built workstreams addressing many of these issues, which is one major positive for clients,” he said.
“The general sentiment to date, however, is that engagement with the industry has been fleeting, lacked true consultation, and there is some risk associated with how the Privacy Act could roll out as a result. I hope the government approaches the next phase of consultation with more openness and industry input.”
Enigma’s head of data and technology, Antonio Panuccio, said that not is it unsurprising that the reforms are delayed and may not pass until 2025, though it is disappointing after an already drawn-out process.
“We all acknowledge that the current Privacy Act is woefully inadequate when it comes to addressing the interplay of digital in everyday life, and it's important to remember that there are some aspects of change in the revamped Privacy Act that are meant to address socio-political issues beyond advertising - domestic violence, for one; artificial intelligence, potentially,” he said.
Panuccio said that he doesn’t think the delay will make any waves on the wider industry, however, with organisations already tussling with how to make data actionable while at the same time more concerned than ever regarding cybersecurity, both in breaches and in rogue artificial intelligence ingestion.
“The crux of what organisations need to do to get ready hasn't changed: just the timeline,” he said.
“However, the bill landing in parliament would be nice to make this a "real" issue in boardrooms rather than a speculative one so that budget can be unlocked and resources can be allocated to ensure compliance.”
The Privacy Act Review originated out of recommendations from the Australian Competition and Consumer Commission’s 2019 Digital platforms inquiry – final report.
Following major data breaches in late 2022, the Federal Government fast-tracked amendments to the Privacy Act to significantly increase maximum penalties for serious or repeated privacy breaches, as well as providing the Office of the Australian Information Commissioner with enhanced enforcement powers.
Releasing the Privacy Act Review Report in February 2023, the government then undertook public consultation to inform the government response, before releasing its own response to the report two years ago in September 2023.
The review covered areas including such areas as whether the Privacy Act effectively protects personal information; whether individuals should have direct rights of action to enforce privacy; whether a statutory tort for serious invasions of privacy should be introduced; the impact of the notifiable data breach scheme; the effectiveness of enforcement powers and mechanisms; and the desirability and feasibility of an independent certification scheme to monitor and demonstrate compliance.
The General Data Protection Regulation (GDPR), the EU-enacted legislation that the Privacy Act reforms are most often compared to, also took years to come to fruition.
First proposed at the start of 2012, it wasn’t entered into force until midway through 2016, and its provisions only became directly applicable in all member states two years after that.
Use extra time to prepare
Magnite’s ANZ MD, Yael Milbank, said similar privacy law overhauls in other regions have faced comparable hurdles and delays.
“The need to strike the right balance between strengthening privacy protections and minimising regulatory burden coupled with addressing the numerous recommendations from the Privacy Act Review likely also contributed to the extended timeline,” he said.
Milbank said while some uncertainty will remain until regulations are officially updated, companies should use this extra time wisely to assess data flows and vendor relationships, as well as reviewing processes.
“This will help ensure a smooth transition once reforms have officially passed,” he said.
InfoSum’s SVP for APAC Richard Knott, said that he similarly doesn’t anticipate the delay having any real impact beyond giving any businesses behind the curve a few more weeks to build their new privacy-by-design technology stacks.
“By now, businesses should have conducted an internal privacy audit of their current data practices to determine what, why and how data is being collected, accessed, shared and processed,” he told AdNews.
Knott said while it's impossible for anyone to be fully prepared without the final, specific wording, if brands architect around privacy-by-design then the specifics of the wording will become a moot point as they will likely be ahead of the curve.
“This means embracing the non-movement of data, data minimisation (particularly the unfettered sharing of personal data) and controlled access - as well as ensuring you can explain your policy in a way that consumers will understand," he said.
UM’s Krass said while on one hand, the industry is allowed more time to adapt to the changes that the reform will bring, the delay also prolongs uncertainty, leaving businesses in limbo about the exact requirements they will eventually need to meet.
“This uncertainty could stall budgeting for and investment in new technologies or compliance measures that would have otherwise been necessary,” he said.
He said the legislation's impact on personalised marketing “cannot be understated”, as the stricter privacy regulations threaten to curb the ability of data-driven marketing, which has been instrumental in “delivering value to consumers through richer experiences”.
“If not carefully implemented, these changes could reduce the effectiveness of advertising campaigns, leading to a below average experience for consumers and potentially diminishing the value consumers get from targeted offers and content,” he said.
“In the long run, consumers might actually miss out on beneficial services and products simply because advertisers no longer have access to the data needed to tailor their offerings effectively. A knock-on effect could be the increase in competition for approved targeted advertising tactics which will ultimately lead to increased costs of media."
Publicis’ Riley said that the forward-thinking brands aren’t just waiting for the law to hit - they are already thinking through the CX of their privacy promise.
“This is an opportunity to build competitive advantage through trust and loyalty, especially with so many Australians wanting more straightforward, no-jargon data privacy promises and practices,” he said.
“Savvy marketers see this as a moment to embrace the connection between privacy and profit—because driving growth means getting ahead of what customers want today, not just what’s legally required tomorrow.”
Eyeota’s Head of APAC, Trent Lloyd, said that if ever there was a time when getting it right is better than getting it done quickly, then this is it.
“In that light, the delay could be viewed as beneficial to most stakeholders,” he said.
“Regardless of timing, though, as any new rules come into effect as the Australian Privacy Act is updated, any company or brand that is using data should be prepared to diligently assess and incorporate these changes into their existing compliance framework.”
Honeycomb Strategy MD John Bevitt said while the delay allows for better preparation, it also extends the period during which businesses must navigate a shifting regulatory landscape without clear direction.
"The delay wasn’t entirely unexpected - given the broad implications of the proposed changes and the extensive consultations involved - however, it highlights the ongoing tension between advancing consumer protections and maintaining a flexible environment for businesses," he said.
"The hope is that the regulations better equip consumers to make more informed decisions about how their data is used, and don’t simply make decisions on consumers’ behalf.
"With changes to what’s deemed ‘fair and reasonable’ - new requirements around targeting and stricter rules on the collection of personal information from third parties - marketers should use this time to review and refine their current data practices, to ensure that they are consumer-centric, transparent and most importantly aligned with stricter regulations."
For the industry bodies, they're all watching the developments closely.
When the proposals were first announced, the Australian Association of National Advertisers (AANA) defended the use of targeted advertising; ADMA (Association for Data-driven Marketing and Advertising) said they would increase uncertainty and add unnecessary complexity to the digital marketing sector; and the IAB (Interactive Advertising Bureau) said they were too broadly scoped and inconsistent with international approaches.
Once the government responded to the report, however, feedback was more positive.
IAB’s director of policy and regulatory affairs, Sarah Waladan, said that the ad industry is continuously working to meet evolving consumer expectations when it comes to privacy and a current delay in the reforms will not change that.
“We have already seen some reforms pass the parliament – including significantly increased civil penalties for serious privacy breaches and greater enforcement powers for the OAIC. Our industry takes these reforms very seriously and will continue to meet the changing requirements as they come into effect,” she said.
“It is not surprising that this requires a significant amount of work and consultation with affected industries. It is more important that we get these reforms right, than that we rush them through quickly. It is critical that they are fit-for-purpose and support our growing digital economy.”
ADMA’s director of regulatory and advocacy, Sarla Fernando, said the delay has no impact on how the advertising and marketing industry should be preparing as privacy reform is coming and the exact date should not be the focus.
“Even if the reform is staged, consumers have continued to show that they are expecting businesses to improve their data practices. Marketers and advertisers have a lot of work to do to prepare their business for the changes that we expect will come in some form,” she said.
“There are a few proposals (in particular those outlined in Proposal 20 - direct marketing, targeting and trading) that marketers will be relieved to see delayed, as there is some concern as to how they will be applied in practice.
“While we expect that there will be clear guidance provided for compliance, hopefully any extra time will mean that the Government will be engaging in consultation with industry - which is a positive outcome.”
IMAA CEO Sam Buchanan said the industry body appreciates the government's consultative approach, which ensures that the implications of these changes are thoroughly assessed and understood.
“Transparency is key to preventing stagnation and enabling our industry to move forward. It’s crucial for us to remain focused on prioritising 'privacy by design' strategies and solutions that uphold user privacy,” he said.
“With an election scheduled for 2025 and a full legislative agenda, further delays beyond the revised date could be speculated."
Have something to say on this? Share your views in the comments section below. Or if you have a news story or tip-off, drop us a line at adnews@yaffa.com.au
Sign up to the AdNews newsletter, like us on Facebook or follow us on Twitter for breaking stories and campaigns throughout the day.