Australia has released draft legislation for the most significant overhaul of its Privacy Act in decades. As drafted, it could significantly impact business productivity and growth, and IAB Australia has called for changes. Here's an update on what is happing across in Australia, and what it means for New Zealand businesses right now.
Australia has released draft legislation for the most significant overhaul of its Privacy Act in decades. As drafted, it could require consent for almost all programmatically served personalised advertising – and an opt-out notice with every targeted ad. Industry, including IAB Australia, has warned the government the proposals could significantly impact business productivity and growth, and has called for changes. Nothing changes in New Zealand law immediately as a result. But many Kiwi businesses sell to Australian clients, reach Australian audiences or run ad technology across both markets and for them, the impact could arrive well before any reform here.
The Industry Has Raised Concerns
In its submission to the Attorney-General's Department on 21 September, IAB Australia supports greater consumer control over data, but warns the current drafting "undermines productivity and business growth in a way that Australia cannot afford".
Key concerns include:
- Consent for almost all programmatic advertising. The broad "trading" concept means any business that shares an audience segment with another, which then uses it to target people, would need consent. IAB Australia says this "appears likely to catch all programmatically served personalised advertising" – with consent potentially required at multiple points in the programmatic chain, even where someone has already chosen an ad-supported service.
- An opt-out in every ad. Every direct marketing communication using personal information would need an opt-out and explanation in clear and plain language. A 300×250 banner or six-second pre-roll cannot carry that.
- Consent fatigue. Repeated consent requests and opt-out notices risk training people to click through rather than engage – weakening the privacy protections the reforms aim to deliver.
- Uncertainty. The new "fair and reasonable" test leaves wide discretion to the regulator, making it hard for businesses to know in advance whether they comply.
As IAB Australia puts it, "We cannot overstate the importance of finding a workable solution to this issue, to avoid an economy-wide impost to the detriment of all Australians."
What Changes Are Proposed in Australia?
The exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 was released for consultation in September. The proposals most relevant to digital advertising are:
-
A wider definition of personal information. Information that "relates to" a person, including inferences about them, and data that allows someone to be "singled out" even when they are not named. This could capture tracking based on unique identifiers.
- A "fair and reasonable" test. A single test for collecting, using and disclosing personal information, with weight on whether people have a genuine choice.
- Consent to "trade" personal information. Exchanging personal information for value – or disclosing it for another business's direct marketing – would need consent. This expressly covers cookies and pixels used in programmatic advertising.
- Precise location data treated as sensitive. Data that tracks a person's location within 500 metres over time would need consent.
- A new direct marketing framework. It would include targeting groups built from personal information, with an opt-out required in every communication.
- A right to erasure for large digital platforms. It would cover services with at least A$500 million in revenue or 2.5 million average monthly Australian users.
- Controllers and processors. Organisations acting on a client's written instructions would carry lighter obligations.
This is a draft and the final bill will likely change. Several points remain unresolved, including whether audience segments built from inferences at scale count as personal information. But if the trading and direct marketing provisions pass unchanged, they would reshape how programmatic advertising works in Australia.
Why it Matters for Kiwi Businesses
Australia's Privacy Act applies to organisations carrying on business in Australia, wherever they are based. New Zealand businesses could be affected in the following five ways:
-
Direct exposure. Publishers, agencies and adtech companies with Australian clients, audiences or operations may fall within the new rules – including the consent and opt-out requirements for targeted ads.
-
Shared ANZ technology. Platforms and vendors often run one consent and data setup across both markets. Stricter Australian settings, including extra consent prompts, are likely to flow into New Zealand by default.
-
Programmatic data flows. If Australian buyers and data partners need consent to "trade" personal information, they may restrict or stop the audience data they accept from or share with New Zealand partners.
-
Location-based products. Location SDKs and footfall attribution services operating across both markets will need to account for consent requirements in Australia.
-
Vendor contracts. New Zealand vendors serving Australian clients can expect more formal written instructions and renegotiated terms to establish who is the controller and who is the processor.
What's Next for New Zealand?
There is currently no government bill currently underway. New Zealand's most recent change, IPP 3A, took effect on 1 May 2026 and covers only notifying people when their information is collected from a third party.
The Privacy Commissioner has called for further modernisation of the Privacy Act, including civil penalties and a right to erasure. Both feature in Australia's package. New Zealand has often looked to Australia when updating privacy law, so the final Australian bill – and how it treats advertising – is likely to shape any future debate here.
Emily Isle, Chief Digital Officer MBM and member of the IAB New Zealand, Data, Privacy & Measurement Council provides additional local content and industry commentary:
Privacy reform shouldn't be viewed as a choice between consumer protection and business growth. Trust is now an economic asset. The organisations that succeed will be those that can demonstrate both responsible data stewardship and clear value exchange with consumers. The challenge for regulators is designing legislation that strengthens trust without unintentionally undermining the digital experiences and services people rely on every day."
A Watching Brief...
Check your Australian exposure. Map where you have Australian clients, audiences, data partners or shared systems.
Talk to your partners. Ask your consent, data and adtech partners how they plan to respond, and whether changes will apply to New Zealand by default. Review location and audience data. Identify where you rely on precise location data or audience segments built from personal information. Watch the final bill, as the draft may change. IAB New Zealand will liaise with IAB Australia and continue to keep members updated.
We thank our colleagues at IAB Australia for their analysis of the exposure draft and for sharing its submission, which informed this article. Thank you to Emily Isle, Chief Digital Officer MBM and member of the IAB New Zealand, Data, Privacy & Measurement Council for her local commentary.
Sources
IAB Australia – Submission on the Privacy Amendment (Personal Data Protection) Bill 2026, 21 September 2026
IAB Australia – Privacy Reform Tranche 2: what you need to know
Herbert Smith Freehills Kramer – The draft tranche 2 Privacy Act reforms
MinterEllison – Draft tranche 2 privacy reforms: what they mean for businesses
Bell Gully – Preparing for IPP 3A
Office of the Privacy Commissioner – Privacy Act 2020 turns 5: changes are needed
