Australian privacy reforms to upend marketing activities

In Marketing We Trust says proposed Australian privacy reforms would affect 31 of 32 common marketing activities. Its analysis found most would become more costly, less effective, or more dependent on major platforms.

The agency assessed 32 routine marketing tasks used by a large Australian company against the draft legislation. It found 20 could continue at higher cost, four could continue but work less effectively, seven would depend on platform controls, and one would remain unaffected.

The only activity judged to be unaffected was measuring a business's own performance through analytics. The broader list included customer list uploads, retargeting, lookalike audiences, conversion tracking, programmatic buying, website and app tags, personalisation, retail media, and addressable TV matching.

Paul Hewett, Chief Executive Officer at In Marketing We Trust, said the review was conducted quickly during a short consultation window.

"The consultation period for the latest tranche of Privacy Act reforms was very short, so we had to move quickly to test what the proposals would mean for marketing teams. Our analysis shows almost every common activity is affected, though none stops outright. The indications are that the reforms will pass parliament in the coming 12 months, which is a short window given the amount of work marketers will need to do to get ahead of the impact. That will begin to show up in performance numbers before quickly becoming a compliance issue. The short answer is that they will fundamentally change what marketers are able to do across most common marketing activities, which will ultimately flow through to marketing performance and effectiveness," Hewett said.

The platform issue

One pressure point is how far advertisers rely on technology platforms to carry out compliance-related functions. Seven activities were assessed as dependent on platform controls, including customer list uploads, lookalike audiences, programmatic buying, addressable TV matching, and shared ID solutions.

Under the proposed direct marketing rules, advertisers could also face opt-out obligations even where the technical means to deliver those opt-outs are controlled by a platform rather than by the advertiser. That raises questions about where responsibility would sit in practice.

Benoit Weber, Head of Digital Analytics at In Marketing We Trust, said this leaves marketers exposed.

"Being reliant on platforms is a difficult situation for marketers, who will still carry the risk under these proposals even if they can't control how they are operationalised. There are still a lot of unknowns under these laws, not least how platforms are defined in terms of the way they use data, a definition which has a material impact. Common things like targeting will also become harder with more consent and opt-out requirements for consumers," Weber said.

Consent concerns

The analysis also highlights uncertainty around consent. Under the agency's reading of the draft, sending customer data to an advertising platform could amount to a trade requiring consent unless the platform is acting as a processor.

That interpretation could affect customer list uploads, advertising pixels, and conversion uploads. It could also bring into scope data that businesses already hold, including CRM records, website sign-ups, newsletter lists, and event registrations, if the new consent and fair-and-reasonable requirements apply to existing information as well as newly collected data.

This matters because much of modern marketing depends on moving customer data between a brand, its agencies, and a group of large platforms. If that transfer requires fresh consent, marketing teams may need to review long-established processes for audience targeting, measurement, and campaign optimisation.

What marketers can do

In Marketing We Trust recommends that marketers start by identifying what customer data they hold, how it was collected, where it is sent, and what permissions support its use. It also recommends auditing tags and pixels, mapping data flows, documenting consent histories, and ensuring any new consent is specific and dated.

Larger decisions may need to wait until the final form of the legislation becomes clearer and platforms explain how they will respond. Those decisions could include broad re-permissioning exercises or reducing reliance on certain platforms.

The analysis is framed as a practical interpretation of the exposure draft rather than a survey of Australian businesses or a quantified estimate of financial impact. It also notes that the legislation remains in draft form and could still change before becoming law.

Among the agency's recommendations are clearer rules on who is responsible for advertising opt-outs when platforms control the relevant systems, whether platforms should be treated as controllers or processors, whether consent-to-trade rules should apply only to data collected after commencement, and whether implementation should be staged when businesses depend on suppliers to make technical changes.