Privacy compliance for Australian online stores

It depends on what you collect directly. If you have your own site, mailing list or customer accounts, you are collecting personal information and the obligations apply to that. If you sell exclusively through a marketplace and never handle customer data yourself, your exposure is lower, though the platform's terms will usually pass some obligations to you.

Open the store in a private browser window and watch what loads before you touch the banner. If advertising or analytics scripts fire before consent, the banner is decorative. A banner that only offers Accept has the same problem, because consent has to be a genuine choice.

Treat both the same way. The test is whether the tool is necessary to make the site work, not whether it is labelled analytics or advertising. Most analytics tools set identifiers and share data with a third party, so the safe position is that they wait for consent.

Not automatically, but it is a cross-border disclosure under APP 8 and you remain accountable for what happens to the data. You need to take reasonable steps to ensure comparable protections apply, and your privacy policy should disclose that data goes offshore.

Only where you have consent to email that person. Someone entering an email address at checkout has not necessarily agreed to marketing, and an abandoned cart email is marketing. Ask for consent separately at the point of collection, and include a working unsubscribe.