On 31 August 2026, the Attorney-General’s Department released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with submissions closing 18 September. The provision with the most operational impact for marketing teams sits in the definitions: as drafted, cookie identifiers, device identifiers and hashed email addresses count as personal information where they let you single out an individual. Sending them to an advertising platform becomes a disclosure, and a disclosure for marketing purposes requires consent.
That reclassification reaches into everyday marketing activity — Custom Audiences in Meta, Customer Match in Google Ads, remarketing pixels, and conversion signals passing back into ad platforms.
What we’ll cover
- What the privacy reform actually proposes, and how likely it is to reach commencement in its current form
- The operational implications for your paid media, analytics and lifecycle marketing setup
- Where the boundaries sit for uploading customer lists, firing tags before consent, and passing conversion signals
- The basic privacy and data hygiene businesses should already have in place
- What overseas businesses marketing to Australian audiences need to understand
- How to run a Privacy Compliance Health Check across your tracking stack — every pixel, tag and SDK — before commencement
- What to prioritise now, and what can wait
Who this is for
Marketing, digital, data and analytics leaders at Australian organisations and businesses advertising in Australia, not legal or privacy specialists. This session is for the people who own marketing operations and need to plan the practical response.
