Privacy obligations for online stores: why most track before they ask, what valid consent looks like under the Privacy Act, and what to fix first.

What does privacy compliance mean for an online store?

It means getting real consent before you collect, and being able to prove it. Most online stores collect personal information before a customer buys anything: analytics scripts, advertising pixels, newsletter forms and abandoned carts all gather data, often before anyone has agreed. Under the Privacy Act 1988 (Cth), that's collection, and consent standards have tightened.

Courts can now order penalties of up to $50 million for a company’s serious interference with privacy. The good news is that most of the fixes are on your website, where you control them, and customers notice a store that treats their data properly.

Does the Privacy Act apply to your store?

The Privacy Act includes a small business exemption that generally excludes businesses with annual turnover of $3 million or less. Online, that exemption is narrower than most operators assume. It doesn't apply if:

• your business is related to a body corporate that isn't a small business, which captures many franchisees and brands operating under a parent

• you trade in personal information, which can include sharing customer data with brand partners, data-matching with an ad platform, or buying and selling lists

• you provide a health service, which includes online pharmacy and some supplement and telehealth models.

Even where the exemption technically holds, it doesn't travel. If you sell into Europe or the UK, or use a platform that applies those standards to you by contract, you're meeting a higher bar anyway. And customers don't check your turnover before deciding whether to trust you.

Not sure where you stand? If your store runs advertising pixels, sends marketing email, offers customer accounts or shares data with any third-party tool, assume this applies to you and get advice on your specific exposure.

What has changed under the Privacy Act?

1. Much stronger enforcement powers

The Privacy and Other Legislation Amendment Act 2024 expanded the powers of the Office of the Australian Information Commissioner (OAIC). It can now issue infringement notices for certain breaches, use stronger investigation and information-gathering powers, and run public inquiries into systemic privacy practices.

2. Significantly higher penalties

Courts can order penalties of up to $50 million, three times the benefit obtained, or 30% of adjusted turnover, for a company’s serious interference with privacy (Privacy Act s 13G). Lower-tier penalties and OAIC infringement notices now apply to less serious breaches.

3. Individuals can now sue

The statutory cause of action for serious invasions of privacy commenced on 10 June 2025. People can take legal action where an invasion of privacy was intentional or reckless, serious, and where they had a reasonable expectation of privacy. Online breaches tend to affect thousands of customers at once, which is what makes class actions viable.

4. Consent is under closer scrutiny

The legal test for consent hasn't changed, but the OAIC is applying it more closely. Consent must be voluntary, informed, current and specific, and given by someone with the capacity to give it. Pre-ticked boxes, consent bundled into terms and conditions, and consent implied from continued browsing are unlikely to meet that test. Cookie banners, loyalty sign-ups and checkout forms all have to give people a genuine choice, and you have to be able to show what they chose. The draft second tranche of reforms would tighten it further.

Why are online stores so exposed?

An online store collects more personal information, from more people, with less thought than almost any other kind of business. Most of it is collected automatically, by scripts the business didn't write and often can't fully explain.

A typical Australian store runs somewhere between five and fifteen third-party scripts: analytics, advertising pixels, chat widgets, review tools, heat mapping and email capture. Each one collects something. Most fire the moment the page loads, well before the consent banner is even visible. That's collection without consent, and it's the most common problem we see. When the banner does appear, it often offers a single Accept button, which isn't a choice and so isn't consent.

Unlike an in-store problem, this is visible from the outside. A regulator, a competitor or a journalist can open your site, check what fires before consent, and see the gap in about thirty seconds. No investigation needed.

Your data leaves the country

Ecommerce platforms, email tools, payment providers and ad networks are mostly overseas. Sending customer data to them is a disclosure, and you're responsible for what happens to it.

Everything you keep is something you can lose

A store that has traded for five years is holding abandoned carts from customers who never bought, accounts nobody has logged into since 2022, and marketing lists inherited from a platform migration. None of it is earning anything. All of it is in scope if something goes wrong, and all of it has to be disclosed to the people affected.

What has the OAIC said that applies to online stores?

The OAIC hasn't yet issued a headline determination about tracking pixels on an Australian store, but it has been very clear about the principle underneath them (here's what the OAIC found about tracking pixels more broadly).

Its retail facial recognition determinations turned on two questions: could the business justify collecting the information at all, and did the people it collected from understand what was happening. Neither question is really about cameras. Both apply directly to a script that starts collecting before anyone has agreed to anything.

On consent, the OAIC's guidance is that it must be voluntary, informed, current and specific. A banner that only offers Accept fails the voluntary test. A banner that says "we use cookies to improve your experience" without saying which cookies, or who receives the data, fails the informed test.

Which Australian Privacy Principles matter most for online stores?

• APP 1, privacy policy: You need a clear, accurate and accessible privacy policy (here's what it must include) explaining what you collect, why, how it's used and disclosed, and how people can access or correct it. Most store policies are template text that doesn't match the tools actually running on the site.

• APP 3 and APP 5, collection and notification: Collect only what's reasonably necessary, and tell people at or before collection. Newsletter forms, account sign-up and checkout are the everyday risk points. Asking for a date of birth or phone number you never use is over-collection.

• APP 6, use and disclosure: Information collected for one purpose can't be used for another without consent. Uploading your customer list to build a lookalike audience, or feeding purchase history into ad targeting, is the most common breach point in ecommerce.

• APP 7, direct marketing: You can't use personal information for direct marketing without consent or a clear, working opt-out. That covers email, SMS and push. Abandoned cart emails to someone who never completed checkout are worth a specific look.

• APP 8, cross-border disclosure: When customer data goes to overseas platforms, including your store platform, email tool, ad networks and analytics, take reasonable steps to make sure comparable protections apply. Relying on the provider's standard terms alone is increasingly not enough, and you remain accountable for what they do.

• APP 11, security: Take reasonable steps to protect personal information from misuse, loss and unauthorised access, and destroy or de-identify it when you no longer need it. That second half is where most stores fall down, because nothing is ever deleted.

What should your online store do now?

Work through privacy in three stages. Fix the critical gaps first, build governance next, then make privacy part of how your store runs.

Immediate: 0 to 3 months

1. List every third-party script running on your store. Most operators find tools they'd forgotten about, or that a previous agency installed.

2. Check what fires before consent. Open your store in a private window and watch the network tab, or ask whoever maintains the site to do it.

3. Fix your cookie banner so it offers a genuine choice, not a single Accept button, and so declining actually stops the tags.

4. Update your privacy policy so it matches the tools you actually run, including which ones send data overseas.

5. Review your sign-up and checkout forms and remove any field you don't use.

6. Confirm every marketing list has documented consent and a working unsubscribe, consistent with the Spam Act 2003 (Cth).

Medium term: 3 to 12 months

1. Appoint a privacy lead and document a privacy management plan.

2. Map your data flows across the store platform, payment provider, email tool, ad platforms and analytics.

3. Set retention periods for guest checkout data, abandoned carts, dormant accounts and old marketing lists, and actually delete on schedule.

4. Review contracts with your platform and key vendors for privacy and security cover, particularly around cross-border transfers.

5. Build a process for access and correction requests, so a customer email doesn't become a scramble.

6. Write and test a data breach response plan aligned to the Notifiable Data Breaches (NDB) scheme.

Strategic: 12 to 18 months

1. Make consent-aware tracking the standard, so tags are wired to consent state rather than added ad hoc by whoever is running campaigns.

2. Review personalisation, segmentation and any automated decision-making against APP 6 and community expectations.

3. Assess AI tools used for recommendations, support or content before using them on customer data.

4. Build privacy risk into business reporting, vendor review and insurance cycles.

5. Keep an eye on reform work on automated decision-making, children's privacy and data brokers.

If you also sell in store

Most of the above applies to the physical side of your business too: collect only what you need, tell people why, and keep it no longer than necessary.

Two things are different in store. Loyalty sign-ups at the counter give people very little time to understand what they're agreeing to, so the collection notice on the form matters more than it does online. And any camera system that analyses faces, rather than simply recording footage, collects sensitive information, which carries a much higher bar. The OAIC has issued determinations against major retailers on exactly that point, so get specialist advice rather than working it out yourself.

Online store privacy checklist

Use this to keep the team accountable. Give each item an owner and track progress.

• Third-party scripts: List everything running on the store now. Next, review each new tool before it's added.

• Cookie consent: Fix the banner and make sure declining stops the tags now. Next, keep consent records auditable and reviewable.

• Privacy policy: Update it to match the tools you actually run now. Next, schedule an annual review with a named owner.

• Forms and checkout: Remove fields you don't use and add collection notices now. Next, standardise compliant templates across the store.

• Marketing: Confirm consent and opt-out on every list now. Next, review CRM governance and list hygiene.

• Cross-border: Map which tools send data overseas now. Next, review contracts and update policy disclosures.

• Retention: Set periods for carts, guest data and dormant accounts now. Next, automate deletion where your platform allows.

• Security: Enforce multi-factor authentication on admin accounts now. Next, commission a periodic risk assessment.

• Breach readiness: Document who to notify and when now. Next, test the plan and build it into governance reporting.

A three page PDF you can work through this week. Download it here:

Get the checklist

How Savira helps online stores

Consent isn't a banner you add once and forget. Every new campaign, tool and integration changes what your store collects. Getting it right at the platform level means each new thing starts from a compliant baseline, and you have a clear answer when a customer asks what you do with their data.

Savira handles the parts of privacy compliance that are ongoing rather than one-off. Generate and maintain a privacy policy that matches the tools you actually run, put compliant cookie consent on your store with tags that hold until consent is given, and keep an auditable record of who agreed to what and when, so you can answer a customer or a regulator without digging through inboxes.

Whether you're a sole trader or a national retailer, you get the compliance foundations without needing a consultant or a developer. See how Savira works for ecommerce.

This guide was last updated 29 August 2026 to reflect current OAIC guidance on consent and enforcement priorities. Australian privacy law keeps evolving, so we'll keep it current as the rules change.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Source: Chapter B: Key concepts (OAIC). To see what your store collects before consent, scan your website free.