Do you need a cookie banner in Australia?

What is a consent banner?

Australia has no single cookie law. But if your website uses tracking that collects personal information, you need to tell visitors and give them a real choice, and a consent banner is the most practical way to do that.

A consent banner is the pop-up, bar or box that appears when someone lands on your website, asking them to accept, reject or manage cookies and tracking before your site gets on with using them. For an Australian small business, it is often the first (and sometimes the only) moment you get to ask permission before analytics tools, ad pixels or other third-party scripts start collecting data about that visitor.

Is there a cookie consent law in Australia?

Not in so many words. The Privacy Act 1988 (Cth) does not name "cookie banners" as a legal requirement. What it does require, if your business is covered by the Act, is that you collect personal information fairly and transparently, and that you have genuine consent before you rely on consent to justify collecting or using someone's data.

The OAIC's own guidance on tracking pixels sets out what that looks like in practice. It says organisations should take reasonable steps to notify people about the use of tracking pixels, and gives a banner or pop-up when someone visits a website as an example of a reasonable step, alongside a link to further privacy information. In other words, a banner is not the legal requirement itself. It is one of the more practical ways to meet the requirement that actually sits behind it: telling people what is happening and giving them a real choice.

What makes consent valid, according to the OAIC

This is the part most banners get wrong. Under the Australian Privacy Principles, consent has four elements. The person needs the capacity to understand what they are agreeing to. The choice has to be voluntary, with a genuine option to refuse and no default set to "yes". Consent has to be current and specific to the purpose at hand, not a general tick years ago for something unrelated. And the person has to be informed, meaning they understood what they were agreeing to before they agreed to it.

Consent can be express (an explicit click, tick or statement) or implied (reasonably inferred from someone's conduct). The OAIC is clear that implied consent should not be assumed from silence or from someone simply not objecting, which rules out banners that treat scrolling past or continuing to browse as agreement.

There is also a specific warning worth knowing about: bundled consent. That is where a business rolls several different requests into one yes or no, for example lumping "essential cookies," "analytics," and "marketing" into a single accept button with no way to choose between them. The OAIC's guidance flags this as something that can undermine whether consent was really voluntary, because the person never had the option to agree to one thing and not another.

Common mistakes that make a banner meaningless

• Making "accept all" the only easy option. If accepting takes one click and rejecting takes three, that is not a genuine choice, it is a nudge.

• Pre-ticked boxes. A box someone has to actively untick is not consent they gave. It is consent you assumed.

• Vague wording. "We use cookies to improve your experience" tells a visitor nothing about what is actually being collected or why.

• Bundling everything together. One switch for cookies, tracking pixels and marketing emails means nobody can say yes to one and no to another.

• No way to change your mind later. Consent should be as easy to withdraw as it was to give, not buried three settings menus deep.

What to check on your own site

• Open your site in a private browser window and see what the banner actually says and does.

• Check whether rejecting or managing preferences takes the same number of clicks as accepting everything.

• Look for any box that is ticked by default. If there is one, untick it.

• Read the wording as a customer would. Does it say what is being collected and why, in plain language?

• Confirm your privacy policy matches what the banner promises. If your privacy policy does not mention the tools your banner is asking consent for, one of the two is out of date.

• Make sure there is an easy way for someone to withdraw consent later, not just give it.

See how Savira handles cookie consent.

Reading about banners is one thing, seeing your own is another. Enter your website address and Savira checks what your banner shows, what your privacy policy says, and which cookies and trackers load before a visitor clicks anything. You'll get a plain English report on what it finds and where to start.

Scan my website

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Read the OAIC's guidance on tracking pixels and privacy obligations and on what counts as valid consent for the full detail. If you would rather not build your consent set up from scratch, Savira's consent tools are built to make this straightforward for small businesses.