What a website privacy policy must say in Australia
Who has to have one, why most website tools require one anyway, what it must say, the sections templates get wrong, and the new rules on automated decisions. With a do-I-need-one quiz, a policy checker and a checklist.
On This Page
Most small business owners asking whether they need a privacy policy get one of two answers: a template seller saying yes, always, or a forum saying no, you're under $3 million. Both are half right. Most small businesses aren't covered by the Privacy Act, but a long list of them are, whatever their size, and nearly every business with a website runs a tool whose terms require a privacy policy anyway. This guide covers who has to have one, what it must say, the website sections templates get wrong, the new rules on automated decisions, and how to check your own. It's from the Privacy Act, the Australian Privacy Principles, the OAIC's guidance and checklists, and the platforms' own terms, read on 12 October 2026. It's general information, not legal advice. If you provide a health service, you're covered whatever your size; read the health version instead.
- The law: maybeBusinesses over $3 million turnover must have one, and so must many smaller ones: health providers, childcare centres, anyone trading in customer data, and real estate, legal and accounting firms for their anti-money laundering work.
- Your tools: probablyGoogle Analytics, Google remarketing, Google and Meta lead forms, Stripe and both app stores require a privacy policy or notice, whatever your size.
- Write your ownThe OAIC says a policy shouldn't be "simply based on a generalised template used by a different entity". Say what you actually collect, why, and where it goes.
Who has to have one
The Privacy Act says every "APP entity" must have "a clearly expressed and up-to-date policy" about how it manages personal information. Most businesses with an annual turnover of $3 million or less are exempt, and turnover means all income, not profit. But the exemption doesn't apply if:
- your turnover has been over $3 million in any year since the rules began (once over, the exemption is gone);
- you provide a health service and hold health information, which the OAIC says includes allied health, complementary therapists, pharmacies, childcare centres and private schools;
- you trade in personal information, such as selling or swapping a customer list or paying for leads, without consent;
- you deliver services under a Commonwealth contract or subcontract;
- you're a company related to a larger company that is covered;
- you provide services regulated by AUSTRAC, covered for that work. Since the anti-money laundering reforms, that includes real estate agents, lawyers, conveyancers, accountants and trust and company service providers;
- you run a residential tenancy database, are a credit reporting body or a registered employee association, or hold Consumer Data Right accreditation;
- or you've chosen to opt in.
The AUSTRAC point is new and catches a lot of small firms. The OAIC says these businesses "must have a privacy policy and collection notices" for their anti-money laundering work, and where client details serve both that and the ordinary service, as they usually do, the Privacy Act applies to them.
Why an exempt business still needs one
The platforms you use set their own rules:
- Google Analytics requires you to "post a Privacy Policy" that gives notice of cookies and similar technology, and to disclose your use of Google Analytics and how it collects data, for example with a link to Google's page on how it uses information from sites that use its services.
- Google Ads remarketing requires your policy to describe how you use data to advertise, that third-party vendors including Google show your ads and use cookies based on past visits, and how to opt out through Google's Ads Settings.
- Google lead forms and Meta lead ads need a link to your privacy policy. Meta says a policy is required to run instant forms.
- The Meta pixel terms require a clear notice on each page where the pixel runs, explaining the tracking and how to opt out.
- Stripe's data terms make you responsible for providing notices, "including by making available a Privacy Policy", to your customers.
- Apple and Google Play require a privacy policy for every app.
Two more reasons: the statutory tort for serious invasions of privacy applies to everyone, with no small business exemption, though it needs intentional or reckless conduct. And the consumer law covers every business, so a privacy promise you don't keep, like "we never share your data", can be misleading even if the Privacy Act doesn't apply to you.
What it must say
APP 1.4 sets the minimum. Your policy must say:
- the kinds of personal information you collect and hold;
- how you collect and hold it;
- why you collect, hold, use and disclose it;
- how people can see and correct what you hold about them;
- how people can complain about a breach, and how you'll deal with it;
- whether you're likely to send personal information overseas, and if so, to which countries where practicable.
It must be free and available in an appropriate form, which usually means a page on your website. The OAIC's guidance adds: write it in plain English a 14-year-old could follow, keep a summary to about 500 words, don't treat it as a legal document, don't just repeat the APPs, avoid vague words like "may", put a link on every page, and show when it was last updated. People want more than the minimum, too: in the OAIC's latest community survey, 42% wanted to know how long information is kept, and 34% what happens after a data breach.
The website sections templates get wrong
- Collect by channel. List what you collect through each route: contact and quote forms, bookings, online orders, newsletter sign-ups, job applications, phone and email. Card details are usually handled by your payment provider; say which one.
- Name your tools. Your website platform, email platform, booking system, payment processor and ad platforms. Platform terms require Google Analytics and remarketing to be described.
- Overseas, honestly. Wix stores data in the US and Ireland, Squarespace in the US, Shopify in Canada and the US, and WordPress.com in the US and the EU. If your site runs on one of them, the answer is yes, and the policy should name the countries. Self-hosted WordPress on an Australian host can keep the site here.
- Analytics, pixels and cookies. Australia has no cookie banner law. But the OAIC says tracking pixel data can be personal information and that policies should "clearly disclose" pixels, what they collect and why, with a simple way to opt out of targeted ads. A banner is one way to give that choice; it isn't required.
- Marketing messages. How you get consent and how people unsubscribe. The Spam Act applies to every business.
- A notice under every form. The policy isn't the collection notice. A sentence or two under each form saying who you are, why you're asking and where the policy is covers APP 5.
- Complaints in three steps: to you first, then any external scheme you belong to, then the OAIC.
- Not copied. If your policy mentions GDPR, "data controller", California or "Do Not Sell", it was written for somewhere else.
Automated decisions: the new section
New rules about to start require a privacy policy to explain when a computer program makes, or does something substantially related to making, a decision that could significantly affect someone's rights or interests using their personal information. The policy must describe the kinds of personal information used, and the kinds of decisions made by the program alone or with its help. The OAIC's guidance says AI tools, including chatbots, count as computer programs, and that a decision can be in scope even if a person reviews it. Its examples are close to home for small businesses: AI that screens and ranks job applications, software that automatically approves or declines refunds, and a rental application system that calculates a suitability score. A chatbot that answers questions or a booking calendar that shows free times is unlikely to be making that kind of decision.
If one of your tools does, a short paragraph covers it: what the tool does, what information it uses, whether it decides or helps your staff decide, and how to ask for a person to review the decision.
Check your policy
Paste your current privacy policy, and I'll flag the common problems.
It flags phrases. It can't see what's missing, so also tick through the list below.
- A page on your site, linked from the footer of every page, not only a PDF.
- Plain English, with a short summary at the top.
- What you collect, by channel, with any sensitive information listed separately.
- How you collect it and where it's held, naming your platform.
- Why, for each channel, without "may".
- Who you share it with, including your tools.
- Overseas: yes or no, and the countries.
- How to see and correct information.
- How to complain: to you, then the OAIC.
- Analytics, pixels and cookies, with opt-out links.
- Marketing consent and unsubscribing.
- How long you keep information, and how it's protected.
- An automated decisions section, if a tool decides things about people.
- A notice under every form.
- A last-updated date, reviewed each year.
- Matches what you actually do, checked against the tools on your site.
Why it matters now
Since the 2024 changes, the regulator can issue an infringement notice for a missing or incomplete privacy policy without going to court. Its first ever compliance sweep reviewed about sixty ordinary businesses' privacy policies, including rental agencies, car dealers, pharmacies and licensed venues, and found problems in "a significant proportion". And in one OAIC decision, a real estate agency that replied to a tenant's bad Google review with his full name, job and finances was found to have interfered with his privacy. Whatever your policy says, never put a customer's details in a review reply.
My view
Write one even if you're exempt. You almost certainly run a tool that requires it, most of your customers expect it, and a short, honest page about what your forms collect, which tools see it, where it's stored and how to complain takes an hour. What doesn't work is a template from another country that promises you never share anything. That's the version the regulator's sweep found wanting.
Questions I get asked
Does a small business need a privacy policy in Australia?
Only if it's covered by the Privacy Act: over $3 million turnover, a health service, trading in personal information, AUSTRAC-regulated work and a few others. But most website tools require one anyway.
What must a privacy policy include?
The kinds of information you collect, how and why, how people can access and correct it, how to complain, and whether it goes overseas and to which countries.
Can I use a privacy policy template?
As a starting point, but the OAIC says a policy shouldn't simply be a template used by another business. Make it describe what you actually do.
Do Australian websites need a cookie banner?
No law requires one. But if you use tracking pixels, your policy should explain them and give a way to opt out of targeted ads.
Do I need a privacy policy if I use Google Analytics?
Yes. Google Analytics' terms require you to post a privacy policy that discloses your use of it and of cookies.
About this guide
Written by Joseph Alzein, founder of bdog. bdog builds websites for small businesses. The rules come from the Privacy Act and the Australian Privacy Principles, the OAIC's guidance, checklists and survey, the Spam Act, and the terms of Google, Meta, Stripe, Apple and the website platforms, read on 12 October 2026. This is general information, not legal advice.
Main sources:
