# The draft tranche 2 privacy reforms: what they could mean for your website

> The government's draft tranche 2 privacy reforms would reshape how websites use tracking pixels, consent, email marketing and customer data. Here is what is in the draft, what is missing, and the no-regret steps worth taking now.

- Source: https://webdivine.agency/insights/privacy-act-tranche-2-draft-websites
- Author: Fady Ilias, Director, Web Divine
- Published: 2026-10-05

---

On 31 August 2026, the Attorney-General released draft legislation for the second, larger round of Australia's Privacy Act reforms: the **Privacy Amendment (Personal Data Protection) Bill 2026**. Public comment closed on 18 September. The government has said it hopes to introduce the Bill to Parliament this year, with a parliamentary committee expected to review it.

It is a draft, not law, and it has no start dates yet. But it is the clearest signal so far of where Australian privacy law is heading, and much of it lands squarely on business websites: the forms that collect enquiries, the pixels that feed your ad platforms, your analytics, and your email list.

*General information, not legal advice. Checked against the exposure draft, the consultation paper and OAIC material as at 6 October 2026.*

## Where this fits

The reforms are arriving in stages, and some are already in force.

![Australian privacy reform timeline: the statutory privacy tort from June 2025, AML/CTF expansion from July 2026, the tranche 2 draft in August 2026 and automated-decision transparency from December 2026](https://vtsswbfzioalwmcwkzbo.supabase.co/storage/v1/object/public/portfolio/blog-diagrams/privacy-reform-timeline.jpg)

- **Since 10 June 2025:** individuals can sue for serious invasions of privacy under a new statutory tort. Unlike most of the Privacy Act, this is not limited to larger businesses.
- **Since 1 July 2026:** anti-money-laundering obligations have expanded to lawyers, accountants, conveyancers and real estate agents, bringing small firms in those fields under the Privacy Act for that information.
- **From 10 December 2026:** privacy policies must explain significant decisions made by software or AI. We cover that in detail in [your privacy policy has a new deadline](https://webdivine.agency/insights/privacy-policy-automated-decisions-december-2026).
- **Tranche 2:** the draft discussed here, with around 41 measures.

## The changes that matter most for websites

![What the tranche 2 draft would change for websites: personal information, the core test, sharing for marketing, consent and data breaches](https://vtsswbfzioalwmcwkzbo.supabase.co/storage/v1/object/public/portfolio/blog-diagrams/tranche2-website-changes.jpg)

### A wider definition of personal information

Today, personal information is information *about* an identified or reasonably identifiable person. The draft changes that to information that *relates to* a person, and notes that someone can be identifiable without a name: through an identifier, location data, or patterns of behaviour.

The draft also treats information you **generate or infer**, including through AI or analytics, as information you have collected. If your systems work out that a visitor is probably a new parent or likely to buy, that inference is personal information you are responsible for.

The draft does not name IP addresses, device IDs or cookies. Law firms reviewing it, including MinterEllison, expect those to be more likely to count as personal information under the new wording.

### One "fair and reasonable" test

The separate rules for collecting, using and disclosing information would be replaced by a single overarching test: is what you are doing fair and reasonable? The factors include what people would reasonably expect, whether it is connected to your business, how transparent you are, whether you collect only what you need, whether people have a genuine choice, and the impact on them.

Two points from the consultation paper stand out for websites. Mentioning something in your privacy policy does not, on its own, make it expected. And dark patterns, or take-it-or-leave-it terms, undermine genuine choice.

### Consent with a definition

Consent would have to be voluntary, informed, current, specific and unambiguous. The consultation paper says pre-ticked boxes and consent bundled into terms and conditions are unlikely to qualify.

### "Trading" and direct marketing

This is the change with the most direct impact on tracking pixels. The draft would ban **trading** personal information without consent, and it defines trading to include disclosing personal information for value **or for direct marketing purposes**. There are carve-outs, including disclosures needed to deliver a service someone asked for, to processors acting on your documented instructions, and for fraud prevention.

The consultation paper gives disclosing cookies or pixels in programmatic advertising as an example of what could be a trade. Allens' analysis is that such disclosures will likely need consent. Whether an ordinary Meta or Google pixel on a typical small-business site is caught is genuinely unsettled, and the processor carve-out may matter. This is the part to watch most closely as the Bill develops.

Direct marketing itself would not need consent, but the definition expands to cover targeting someone individually or as part of an audience segment, including targeted social ads and ads based on browsing history. Every message would need a simple way to opt out, and opt-outs would have to be acted on.

A small business that trades personal information under the new definition would also lose the small business exemption.

### Security, retention and 72-hour breach reporting

Businesses would need to know what personal information they hold, consider destroying information they no longer need, and regularly check that their security measures actually work. Eligible data breaches would have to be reported to the OAIC **within 72 hours**, a sharp change from today's approach of assessing within 30 days and then notifying.

For a website, that means old enquiries sitting in an inbox, form submissions stored indefinitely in a plugin's database and forgotten CSV exports are all liabilities.

### The rest, briefly

- **Controllers and processors:** if a supplier handles data on your documented instructions, you are responsible for what it does. Your form tool, CRM, host and agency all fall in this bucket.
- **Children:** a child's best interests become a primary consideration in the fair and reasonable test.
- **Right to erasure:** limited to very large digital platforms, not ordinary businesses.

## What is not in the draft

Several long-debated changes are absent. The **small business exemption** for businesses turning over $3 million or less is unchanged, apart from the new trading rule. The employee records and journalism exemptions are untouched, and there is no direct right to sue under the Privacy Act itself (separate from the statutory tort already in place). The government has not said whether these will be revisited.

![Much of the reform package is about whether data is used in ways people would reasonably expect](https://webdivine.agency/images/insights/1580847097346-72d80f164702.jpg)

## Some of this is already the law

Do not wait for the Bill on one issue in particular. In June 2026, the Privacy Commissioner found that online health service Medmate and fertility provider Monash IVF had breached the Privacy Act by using tracking pixels on their websites to target visitors with social media ads. Because the pages related to health, the information collected was sensitive information, which already requires consent.

If you run a health, medical, fertility, NDIS or similar website with ad pixels on it, that finding applies to you today. Our guide to [website requirements for medical and allied-health practices](https://webdivine.agency/insights/website-requirements-medical-allied-health-practices) covers the wider picture for clinics.

## No-regret steps you can take now

None of these depend on the final shape of the Bill, and all of them reduce risk under current law:

1. **Map your data flows.** List every form, pixel, analytics tool, CRM and email platform on your site, and where each one sends information.
2. **Remove what you do not need.** Drop unused pixels, and stop sending form contents, sensitive page URLs and "advanced matching" customer data to ad platforms. This is urgent for health, finance and children's sites.
3. **Make consent real.** No pre-ticked boxes, marketing consent kept separate from your terms, and a record of who agreed to what.
4. **Check every marketing email** has a working unsubscribe link, and that unsubscribes are actioned promptly.
5. **Set deletion schedules** for old enquiries, leads and exports, and actually delete them.
6. **Put suppliers on documented instructions.** Your form tool, hosting, CRM and agencies should have clear contracts or terms covering how they handle your customers' data.
7. **Rewrite your privacy policy and collection notices in plain English**, add an automated-decision statement if it applies to you, and prepare a breach response plan that could work within 72 hours.

## Our take

Most of the draft rewards websites that were built carefully in the first place: collect only what you need, be upfront about it, keep it secure and delete it when you are done. The sites that will find this painful are the ones carrying years of accumulated plugins, pixels and stored form data nobody has looked at.

When we [design and build websites](https://webdivine.agency/services/web-design-development) and run [email](https://webdivine.agency/services/email-marketing) and [paid social](https://webdivine.agency/services/paid-social-ads) campaigns, we map where data goes as part of the job. If you would like an independent view of what your current site collects and shares, [talk to us](https://webdivine.agency/lets-talk) and we will give you a plain-English audit to take to your legal or privacy adviser.

## Sources

- [Privacy reform consultation, exposure draft and consultation paper](https://consultations.ag.gov.au/rights-and-protections/privacy-reform/), Attorney-General's Department
- [Exposure draft: Privacy Amendment (Personal Data Protection) Bill 2026](https://consultations.ag.gov.au/rights-and-protections/privacy-reform/user_uploads/exposure-draft-bill-2026.pdf), Attorney-General's Department
- [Modernising Australia's privacy laws for the digital age](https://ministers.ag.gov.au/media-centre/modernising-australias-privacy-laws-digital-age-31-08-2026), Attorney-General, 31 August 2026
- [Privacy Commissioner finds breaches in third-party tracking pixel investigation](https://www.oaic.gov.au/news/media-centre/privacy-commissioner-finds-privacy-breaches-in-third-party-tracking-pixel-investigation), OAIC
- [Statutory tort for serious invasions of privacy](https://www.oaic.gov.au/privacy/your-privacy-rights/more-privacy-rights/statutory-tort-for-serious-invasions-of-privacy), OAIC
- [A new era for privacy: what the proposed reforms mean in practice](https://www.allens.com.au/insights-news/insights/2026/09/a-new-era-for-privacy-what-the-proposed-privacy-act-reforms-mean-in-practice/), Allens
- [Draft tranche 2 privacy reforms: what they mean for businesses](https://www.minterellison.com/articles/draft-tranche-2-privacy-reforms-what-they-mean-for-businesses), MinterEllison

---

Web Divine is a web design and development studio in Melbourne, Australia. More articles: https://webdivine.agency/insights. Site index for AI assistants: https://webdivine.agency/llms.txt