Explore. Build. Grow
Explore. Build. Grow

Our flexible three-stage framework to craft digital experiences.

Learn more
Expertise
Outcomes
View our portfolio
View our portfolio

Explore our range of digital solutions.

Learn more
Industries
Our Approach to AI
Our Approach to AI

Keeping ourselves at the forefront of emerging technology is part of our DNA. But we recognise that ‘technology for technology’s sake’ is not the end goal – there is a balance to be struck.

Learn more
DXP
Headless
Cloud Platforms
Marketing Optimisation
Contact Us
Contact Us
Explore. Build. Grow
Explore. Build. Grow

Our flexible three-stage framework to craft digital experiences.

Learn more
Expertise
Outcomes
View our portfolio
View our portfolio

Explore our range of digital solutions.

Learn more
Industries
Our Approach to AI
Our Approach to AI

Keeping ourselves at the forefront of emerging technology is part of our DNA. But we recognise that ‘technology for technology’s sake’ is not the end goal – there is a balance to be struck.

Learn more
DXP
Headless
Cloud Platforms
Marketing Optimisation
Contact Us
Data privacy
Home / Insights / ＿

What you need to know about changes in digital privacy 

As data privacy regulations continue to tighten, businesses must take proactive steps to ensure their digital data handling remains compliant. Here is what you need to know about upcoming changes.

Sarah Crooke
Sarah Crooke

05 November 2026

3 minute read

If your eyes start glazing over the moment someone starts talking about data privacy, you are not alone. There seem to be many rules, but no clear guidelines for ensuring you are meeting them. But there are some big changes coming down the line, and the onus will be on companies buying advertising and sending data to ensure compliance. 

Before going into the upcoming changes, we must note that Luminary cannot provide legal advice, and your lawyers should be consulted to ensure you are adhering to the regulations.

What has been happening?

In June, the OAIC (the Office of the Australian Information Commissioner) released a report that called out two health service providers, Medmate Australia Pty Ltd (Medmate) and Monash IVF Pty Ltd (Monash), for sending personal information to third parties. This is done by having tracking pixels on the site that send URL paths and page titles to Meta, meaning users could be remarketed to based on medical information (e.g. that they are interested in IVF).

In August, the Attorney-General published a media release about the need to update privacy laws for the digital age. 

These outlined a range of key initiatives, including:

  • a fair and reasonable test, so companies can no longer justify collecting more information than they need or using it for purposes Australians would never expect
  • a right to erasure, allowing individuals to request the destruction of personal information from large digital platforms like social media and search platforms
  • stronger, more meaningful standards for consent, to ensure Australians are making an informed choice about the information they share, without hidden terms, or take-it-or-leave-it conditions
  • measures to stop businesses from trading in personal information without clear permission, meaning shopping habits, online interests or location data cannot be bought and sold behind Australians’ backs.

This proposal may be presented and passed by Parliament this calendar year or in early 2027. When passed, it will likely mean for most Australian websites:

  • you will need consent to send click IDs to third parties, like sending Facebook click IDs in the URLs to Meta
  • you will need to give users a way to opt out of marketing
  • you will need to give users a way to get their data
  • You will be responsible for any data sent to third parties like Meta, LinkedIn or Google.

On 10 December, a new law will be put in place around automated decision-making, stating:
“... entities must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals’ rights or interests.”

How can Luminary help?

Pixel audit

Luminary can audit your current set-up so you get a full picture of what data you are sending where. This can highlight potential PII (Personally Identifying Information) leaks to third parties and possible solutions. It will also outline why certain data is needed and is useful documentation if a data audit is required.

GTM server-side tagging

We have done a full blog post about GTM sever-side tagging and it has many benefits outside of data privacy. Though if you are dealing with sensitive topics and you don’t want to send certain URLs or page titles to third parties, but you still want to track the pages, GTM server-side tagging is really your best option. It also allows you to hide other details about your user, such as IP addresses, from prying eyes.

Measurement strategy

A key element of data privacy is being able to justify why you are collecting data and how you are using it. A measurement strategy outlines what data you should collect, how it relates to your KPIs or website goals and how those relate to organisational goals. The deliverable can serve as a living document that guides your data analysis and reporting throughout the organisation.

Sarah Crooke
Sarah Crooke

05 November 2026

3 minute read

Enjoyed this article? Share it...

Need help with meeting data privacy obligations?

Get in touch

Keep Reading

Want more? Here are some other blog posts you might be interested in.

Follow
Contact Us
1300 554 891
hi@luminary.com

Our locations

Stay informed
Our best articles, observations and news delivered to your inbox
Subscribe
Flags

We acknowledge the Traditional Custodians of the land on which we work, live and engage. We pay respect to Elders past and present.

Luminary is a registered trademark of Luminary Digital Pty Ltd

Terms of Services
Privacy Policy