On this page5 sections
Australia’s privacy law is changing in stages, and two of the next ones fall on the same day: 10 December 2026. A destination website collects more personal information than most teams realise, through newsletter sign-ups, competitions, brochure requests, industry portals, chat tools and the tracking pixels that campaign agencies add. This is a practical checklist for that website.
It is not legal advice, and the first question is whether the federal Privacy Act applies to you at all. It covers Australian Government agencies and organisations with an annual turnover above $3 million, with some exceptions, and it does not cover state or territory government agencies, which have their own laws (OAIC (opens in a new tab)). In practice, for destination organisations:
If you are | The federal Privacy Act | What to do |
|---|---|---|
A council or state government tourism team | Generally not; your state or territory privacy law applies (in Victoria, the Privacy and Data Protection Act 2014) | Check with your organisation's privacy officer; the checklist below is still good practice |
A regional tourism organisation or association with turnover of $3 million or less | Often not, unless an exception applies or you have opted in | Confirm with an adviser; follow the checklist anyway, because the Spam Act applies regardless |
A larger organisation or a Commonwealth body | Yes | The 10 December changes may apply directly |
Whichever row you are in, two things bind everyone: the Spam Act for marketing email, and the expectations of the Visitors whose details you hold. Good practice is the same either way.
What starts on 10 December 2026
Automated decision-making in your privacy policy. From 10 December 2026, organisations covered by the Act (the third row above) that use personal information in automated decisions that could affect people’s rights or interests must say so in their privacy policy: the kinds of personal information used and the kinds of decisions made (OAIC (opens in a new tab)).
Most destination websites make no such decisions. Some do without calling it that: automatic scoring of grant or award applications, automated eligibility checks on competition entries, or rules that decide which Operators get featured placement. List anything on or behind your website that decides something about a person without a human in the loop, and decide with your adviser whether it counts.
A children’s privacy code. The OAIC’s Children’s Online Privacy Code covers online services, including websites, that are likely to be accessed by children, and it must be finalised and registered by 10 December 2026 (OAIC (opens in a new tab)). A family-holiday destination site with a kids’ activity page or a school-holiday competition may be in scope. The final text isn’t registered yet, so the practical step now is to find every place your site collects information from or about children, and be ready to review it when the code lands.
What is proposed, and not yet law
On 31 August 2026 the Government released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with consultation closing on 18 September. According to Clayton Utz’s summary, the draft proposes (Clayton Utz, August 2026 (opens in a new tab)):
- consent that is “voluntary, informed, current, specific and unambiguous”, which would rule out pre-ticked boxes and bundled consent;
- a definition of direct marketing wide enough to include “disclosures of cookies or pixels”;
- notifying the Information Commissioner within 72 hours of an eligible data breach;
- personal information defined as information that “relates to” a person;
- precise geolocation data treated as sensitive information.
A draft can change before it reaches Parliament. The direction is clear enough to act on now, because every item on that list is already good practice.
The website checklist
1. Map what you collect. List every form, sign-up, competition, download gate, chat tool and login on the site. For each, note what it collects, where the data goes (your newsletter platform, a CRM, a spreadsheet in someone’s inbox) and who can see it. Most teams find one or two forms nobody remembers building. Include the offline ones that end up online: the entry cards from the competition stand at a summer market, or the paper sign-up sheet from a morning tasting day, typed into the newsletter list the following week.
2. Clear out the pixels. Open your tag manager and list every tracking script and pixel. Campaign agencies add them and rarely remove them. If a pixel shares visitor data with an advertising platform and nobody can say why it is there, remove it. If the draft bill passes as proposed, those disclosures sit inside direct marketing.
3. Fix consent on forms. No pre-ticked boxes. One purpose per tick: entering a competition is not the same as joining the newsletter. Say plainly what the person will receive and how often.
4. Check your “service” emails. Under the Spam Act, a commercial message needs consent, must identify you and must offer an unsubscribe that is honoured within five working days (ACMA (opens in a new tab)). In March 2026 the ACMA penalised Lululemon $702,900 for order and shipping emails that also carried promotions without an unsubscribe; as an ACMA member put it, a message with “any promotional or sales content” is commercial (ACMA, March 2026 (opens in a new tab)). For a destination, the equivalents are the brochure-delivery email with this month’s deals in it and the competition confirmation with a campaign banner.
5. Update the privacy policy. Make it describe what the site actually does today: the forms, the analytics, the newsletter platform, any chat assistant, any automated decisions. A policy written for the site you had in 2021 is a liability.
6. Know your breach plan. Who would you call, and how fast could you tell who was affected, if your newsletter platform or a form plugin were compromised on a Friday evening? If the 72-hour proposal passes, slow answers will matter.
7. Watch the children’s code. Note the pages and competitions that involve children, and diarise a review for December.
Serious invasions of privacy
One earlier change is worth knowing about. Since 10 June 2025, people have been able to sue for serious invasions of privacy under a statutory tort, which reaches beyond the organisations the Privacy Act covers (OAIC (opens in a new tab)). It is aimed at serious conduct, not ordinary marketing, but it is another reason to know exactly what your site collects and shares.
On Roam
Roam operates in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). Your origin data, the database, content, uploaded Assets and user accounts, is hosted in Australia, and public static files are cached at Cloudflare’s global edge so pages load fast everywhere. Your forms, newsletter platform and analytics choices are still yours to govern, and the checklist above applies to them. See how Roam handles hosting and security.
