Do you need a cookie consent banner in Australia?
The OAIC scanned 50 health websites and found tracking pixels quietly sharing browsing data. Here is what that means for your business.
Published Updated 6 min read
If your website has a Meta or TikTok pixel on it, information is being sent to a social media platform every time someone visits. A tracking pixel is a small piece of code embedded in your site that reports what visitors do back to a third party. If you use one, the Privacy Act 1988 (Cth) makes you responsible for what it collects and where it goes, even if your web agency installed it.
The Office of the Australian Information Commissioner (OAIC) published a blog post on 24 June 2026 setting out what it found when it looked at how Australian health providers were using these tools. The findings are worth reading even if you are nowhere near the health sector, because the underlying problem is one almost every small business site shares.
What is a tracking pixel, and how is it different from a cookie?
A cookie sits in the visitor's browser. They can clear it, block it, or set their browser to refuse it. A tracking pixel is different: it lives in your website's code, it is invisible on the page, and there is no setting a visitor can flick to switch it off. Unless someone runs a scanning tool, they will not know it is there.
Depending on how it is configured, a pixel can send a third party the full URL of every page a visitor opens, what they searched for on your site, which buttons they clicked, the time and date, their device details, and in some cases what they typed into your forms.
What the OAIC found
In October and November 2024, the OAIC scanned 50 health service provider websites, including helplines, mental health services, pharmaceutical sites, and services covering insurance, fertility and abortion.
Finding | Share of sites |
|---|---|
Used some form of tracking technology | 96% |
Used a third-party tracking pixel | 52% |
Of those, made no mention of pixels in the privacy policy | 77% |
It then inspected 12 of those sites more closely. Every one used more than one third-party pixel. Every one used Meta's. Half used TikTok's and a quarter used Snapchat's. None of the 12 organisations had done a Privacy Impact Assessment before turning the pixels on.
The OAIC's view was that this is not just technical data. On a health site, a page visit can reveal a condition someone is worried about, a symptom questionnaire they clicked through, or a search for support with an eating disorder or family violence. Where a visitor is logged into their social account, that activity can be linked straight to their profile. Hashed form fields such as a name or phone number can be matched to a profile even when they are not logged in.
The work led to Commissioner initiated investigations in December 2024, with published determinations for Monash IVF and Medmate Australia, plus direct engagement with eight more organisations.
The three gaps that got businesses into trouble
They assumed hashed meant anonymous. Several organisations told the OAIC that because data was hashed or aggregated, privacy obligations did not apply. The inspection found that assumption did not hold up.
They did not know what was on their own site. One health provider was surprised to learn it had active pixels at all, since its Facebook page had been switched off years earlier. An audit turned up 50 tracking pixels, added over time by the vendor that built the site, none of them necessary to run the business.
They underestimated the harm. Pixels feed a wider advertising ecosystem. The OAIC's example is a woman who reads about counselling late one night, creates no account and books nothing, then spends the next week being served ads for counselling and weight loss supplements and wondering whether her phone is listening to her.
What to do about it
1. Find out what is actually running
Free tools such as Blacklight from The Markup will scan a public page and list the trackers on it. Browser tools and extensions will do the same job. Ask your web developer or marketing agency for a written list of every tag and pixel they have installed, and when.
2. Work out what a pixel could infer about your visitors
Look at your page URLs and form fields through a stranger's eyes. If a page name gives away a health concern, a financial hardship, or anything else someone would consider private, that is sensitive information and a pixel should not be sending it anywhere. Under APPs 3 and 6, collection should be limited to what is reasonably necessary, and sensitive information needs express consent.
3. Say so plainly in your privacy policy
If you use pixels, your privacy policy and collection notice should say which ones, what they collect, and which platforms receive the data. Vague reassurances that data "cannot be traced back to you" are exactly what the OAIC pulled organisations up on.
4. Give people a real way to opt out
Where pixels feed advertising, the OAIC suggests a notice or consent banner on first visit that explains the tracking and lets the visitor decline. Consent only counts if it is voluntary, specific, informed, and given by someone with capacity to give it.
5. Put a review in the calendar
Pixels are not set and forget. Tags accumulate quietly as campaigns come and go, so check every few months that what is running is still what you approved.
Common questions
Does this apply if I am not a health provider?
The obligations under the Privacy Act apply to any organisation the Act covers, whatever the sector. Health sites were the OAIC's focus because the inferences are so sensitive, but the same rules apply to your site.
My business is small. Am I exempt?
Many businesses with an annual turnover of $3 million or less fall outside the Privacy Act, but there are exceptions, and one of them is providing a health service. Whether you are covered is worth checking properly rather than assuming. Our guide on who the Privacy Act covers walks through it.
My agency set the pixels up. Is it still on me?
Yes. Outsourcing the work does not outsource the obligation. The OAIC's inspection found that separation between marketing and privacy was one of the main reasons pixels ended up somewhere nobody intended.
Want a simpler way to capture and record consent for tracking on your site? Take a look at Savira's consent management tools.
Source: Your life, pixelated: how tracking pixels watch your every click, OAIC, 24 June 2026.
This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.