Agency privacy obligations for client websites: why client data is still your risk, what the June 2026 pixel rulings changed, and what to fix first.

Does privacy compliance apply to digital and marketing agencies?

Almost certainly. Even if your agency sits under the $3 million turnover threshold, the small business exemption is narrower than most people think. And when you run campaigns, place pixels or manage CRMs for clients covered by the Privacy Act 1988 (Cth), their data flows through your systems, so you share the exposure.

That makes you a critical link in every client's privacy chain, and a high-value target for the Office of the Australian Information Commissioner (OAIC). In June 2026 the OAIC found two providers breached the Act through tracking pixels on their websites, and courts can now order penalties of up to $50 million for a company’s serious interference with privacy. The upside is that agencies that get consent and tracking right have a real edge in client conversations.

Does the small business exemption cover your agency?

The Privacy Act applies to organisations with annual turnover above $3 million. Below that, the exemption doesn't apply if:

• your agency is related to a body corporate that isn't a small business

• you share or trade in personal information, including selling leads or licensed data

• your contracts with enterprise clients include privacy representations that bring you within scope.

More importantly, agencies routinely process data for clients who are bound by the Privacy Act. When that data moves through your infrastructure, ad platforms and analytics tools, you're accountable for what happens there. Processing data on a client's behalf doesn't shift your obligations. If you store it, access it or transfer it, you have responsibilities.

Not sure where you stand? If your agency runs email campaigns, places pixels, manages CRMs or handles any user tracking for clients, this applies to you. Get advice on your specific exposure before assuming the exemption holds.

What has changed under the Privacy Act?

1. Much stronger enforcement powers

The Privacy and Other Legislation Amendment Act 2024 expanded the OAIC's powers. It can now issue infringement notices, use stronger investigation powers, and run public inquiries into systemic privacy practices across industries, including digital marketing.

2. Significantly higher penalties

Serious or repeated interferences with privacy can attract a maximum penalty of the greater of AU$50 million, three times the benefit obtained, or 30 percent of adjusted turnover. That puts privacy penalties on par with serious competition and consumer law breaches.

3. Individuals can now sue

Since 10 June 2025, people can take legal action where an invasion of privacy was intentional or reckless, serious, and where they had a reasonable expectation of privacy. Damages cover both economic loss and emotional distress, with non-economic damages capped at AU$500,000.

4. Consent is under closer scrutiny

The legal test for consent hasn't changed, but the OAIC is applying it more closely. Consent must be voluntary, informed, current and specific, and given by someone with the capacity to give it. Pre-ticked boxes, consent bundled into terms and conditions, and consent implied from continued browsing are unlikely to meet that test. Cookie banners and forms have to clear a higher bar, and the draft second tranche of reforms would tighten it further.

5. Tracking pixels are now an enforcement priority

In June 2026, the Privacy Commissioner found that Medmate Australia and Monash IVF interfered with people's privacy by collecting sensitive information through third-party tracking pixels. Using pixels to follow visitors to health-related websites and then target them with social media ads counts as collecting sensitive information, so the website provider must get consent.

Alongside the determinations, the OAIC published Your life, pixelated, a report on its inspection of 50 health provider websites. Those cases were about health, but several findings apply to any client site you build or market:

• Browsing data can be personal information. The OAIC says browsing data may be personal, and sensitive, information, even without a name attached.

• Hashing isn't de-identification. Organisations argued that hashed names, addresses and phone numbers were de-identified. The OAIC's inspection found that wasn't the case, because platforms used them to match individuals.

• Most sites weren't telling anyone. 52 percent of the sites used a third-party pixel, and 77 percent of those didn't mention it in their privacy policy.

• Pixels aren't set and forget. The OAIC describes vendors adding pixels over time and outsourced marketing leaving organisations unaware of what was running. One organisation found 50 active pixels it didn't know about.

For the agency angle on the health determinations in more depth, read what the June determinations mean for your agency.

Why are agencies exposed when a client breaches?

Agencies face dual exposure. You have your own privacy obligations, plus liability risk when a client breach traces back to your systems, campaigns or third-party integrations.

Here's how that plays out. Under the APPs, a digital agency and its client can both bear responsibility for how personal information is used in a campaign. If an agency uses a client-supplied email list without checking that consent was obtained for marketing, both may be found to have interfered with privacy: the client for disclosing it, and the agency for using it.

The OAIC's APP 7 guidance expects a client's contract with a marketing provider to reflect the client's own direct marketing obligations, and an agency that is itself covered by the APPs must comply with them in its own right. Outsourcing the campaign doesn't make the obligations disappear.

Pixels are the newest version of the same problem. The OAIC is clear that responsibility stays with the organisation running the website, so expect clients to ask you to account for every pixel you've installed, what it sends and where. If you can't, you're the weak link in their compliance.

Direct marketing is also where enforcement is most immediate. The OAIC can now issue infringement notices for direct marketing breaches, so unlawful email lists, lookalike audiences and retargeting without valid consent are live risks.

Which Australian Privacy Principles matter most for agencies?

• APP 1, open and transparent management: Keep a current, accessible privacy policy covering what you collect, why, how you use and disclose it, and how people can access or correct it. Many agency policies are out of date or ignore client data processing.

• APP 3 and APP 5, collection and notification: Collect only what's reasonably necessary for a specific purpose, and notify people at or before collection. Forms, landing pages and lead magnets you build for clients need compliant collection notices, not just a buried privacy policy link.

• APP 6, use and disclosure: Information collected for one purpose can't be used for another without consent. Using a client's customer list to build lookalike audiences or seed new campaigns without explicit consent is a common breach point.

• APP 7, direct marketing: You can't use personal information for direct marketing without consent or a clear, working opt-out. The OAIC can issue infringement notices for direct marketing breaches, which makes this an immediate risk for agencies running campaigns.

• APP 8, cross-border disclosure: When data goes to overseas services, including US-based ad platforms, analytics tools and CRMs, take reasonable steps to make sure those providers uphold comparable protections. Relying on standard platform terms is increasingly not enough.

• APP 11, security: Take reasonable steps to protect personal information from misuse, loss and unauthorised access. That includes access controls on shared tools, secure offboarding of client data, and managing the security of integrated third-party platforms.

What should your agency do now?

Work through privacy in three stages. Fix critical exposure first, build governance next, then position your agency as a trusted, privacy-forward partner.

Immediate: 0 to 3 months

1. Audit your consent mechanisms (forms, cookie banners, landing pages) and fix anything that doesn't meet the current standard.

2. Update your privacy policy to reflect how you handle client data, third-party integrations and cross-border transfers.

3. Stop any direct marketing running on lists without documented, valid consent.

4. Review pixel and tag set-ups so tracking doesn't fire before valid consent is given.

5. Inventory every pixel on every client site: which platform, what data it sends (full URLs, searches, button clicks, hashed contact details) and who added it. Flag health and other sensitive-category clients, where the OAIC expects express consent before pixels collect sensitive information.

6. Tighten basic security: access controls on shared tools, removing dormant accounts and stronger authentication.

Medium term: 3 to 12 months

1. Map data across every client account, platform and integration.

2. Put data processing agreements in place with key clients, especially those sharing personal data with you.

3. Document retention schedules and delete campaign data and lead lists on schedule.

4. Review every third-party vendor contract for APP 8 compliance and proper data processing terms.

5. Run privacy training tailored to agency roles, since account managers, developers, data analysts and campaign managers each face different risk points.

6. Build a breach response plan and register, and test it.

Strategic: 12 to 18 months

1. Keep an eye on upcoming reforms, particularly automated decision-making, children's privacy and the regulation of data brokers.

2. Run privacy impact assessments on AI-assisted targeting, personalisation and content generation tools before using them for clients.

3. Build a client-facing privacy offering and use your compliance capability as a point of difference in new business conversations.

4. Build privacy risk into agency governance, reporting and insurance reviews.

5. Make consent management part of your standard website build and campaign templates, so compliance is the default, not a retrofit.

Agency privacy checklist

Use this to keep the team accountable. Give each item an owner and track progress.

• Privacy policy: Update it now to reflect agency and client data processing. Next, schedule an annual review with a named owner.

• Consent mechanisms: Audit all forms and cookie banners and fix non-compliant set-ups now. Next, standardise compliant consent templates across all client work.

• Direct marketing: Confirm every active list has documented, valid consent now. Next, review CRM governance and set up list hygiene processes.

• Tracking and pixels: Inventory every pixel on client sites and make sure none fires before consent is captured now. Next, build consent-first tracking into standard delivery templates and review pixels on a schedule.

• Third-party vendors: Identify every tool processing personal data on your behalf now. Next, review contracts and add data processing terms where they're missing.

• Cross-border transfers: Map which platforms send data offshore and review reliance on standard terms now. Next, update privacy policy disclosures and add contractual protections.

• Security: Tighten access controls, remove dormant accounts and enforce MFA now. Next, commission periodic risk assessments and set up a breach response plan.

• Training: Run an initial all-staff session on the key risks for agency roles now. Next, build an annual refresher with scenario-based exercises into the calendar.

• Governance: Appoint a privacy lead and document a basic privacy management plan now. Next, build privacy into agency reporting and your risk register.

A one page PDF you can work through this week. Download it here.

Get the checklist

How Savira helps digital agencies

Consent standards have tightened, and the data you handle for clients is still your responsibility. If a breach traces back to your forms, pixels or integrations, the OAIC won't treat you as a bystander. Getting consent and tracking right in your standard build means less rework, less risk and a stronger position in every client conversation.

Savira handles the parts of privacy compliance that are ongoing rather than one-off. Generate and maintain privacy policies, run compliant cookie consent on the sites you build, and keep an auditable record of who agreed to what and when, so you can answer a client or a regulator without digging through inboxes.

Whether you're a two-person studio or a national network, you get compliance foundations you can roll out across every client build, without a consultant or extra developer time. See how Savira works for digital agencies.

This guide was last updated 17 March 2026 to reflect current OAIC enforcement priorities and updated consent standards, and reviewed on 15 October 2026 to reflect the OAIC's June 2026 tracking pixel determinations and its Your life, pixelated report. Australian privacy law keeps evolving, so we'll keep it current as the rules change.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Sources: Your life, pixelated: how tracking pixels watch your every click and Chapter 7: APP 7 Direct marketing (OAIC). To see where your agency stands, get my risk score.