Australian law and your business website

The Privacy Act has a small business exemption, with sharp edges

The Privacy Act 1988 applies to organisations with annual turnover above $3 million, which exempts most Australian small businesses and is the single biggest difference from New Zealand, where the Privacy Act 2020 applies to everyone. The edges are where businesses get caught: all private health service providers are covered regardless of turnover, and the Office of the Australian Information Commissioner's own guidance lists gyms, weight-loss clinics, child care centres and private schools among them. So are businesses that sell or purchase personal information, credit reporting bodies, and Commonwealth contractors. A removal of the exemption entirely has been proposed in a second tranche of privacy reform, but as at the time of writing no such bill exists, and we are not going to publish a timeline for legislation that has not been introduced.

For covered organisations, thirteen Australian Privacy Principles apply. Three bear directly on a website: APP 1 requires a clearly expressed and up-to-date privacy policy, APP 5 requires notifying people when personal information is collected, and APP 8 sets the steps required before personal information is disclosed overseas, which is exactly what using offshore hosting, analytics, or email platforms involves.

What changed in privacy law, precisely

• Since 13 December 2022, the maximum civil penalty for serious or repeated interference with privacy is the greater of $50 million, three times the benefit obtained, or 30 percent of adjusted turnover during the breach period.
• The Privacy and Other Legislation Amendment Act 2024 received royal assent on 10 December 2024, adding tiered mid-level penalties of up to 2,000 penalty units and administrative penalties of up to 200 units, with the OAIC able to issue infringement notices. We cite penalty units rather than dollars deliberately, because the unit value is indexed and dollar figures in circulating guides go stale.
• A statutory tort for serious invasions of privacy commenced on 10 June 2025. It is enforced through the courts rather than the OAIC, and it applies more broadly than the Privacy Act itself, which means a business inside the small business exemption can still be sued under it.
• In November 2024 the OAIC published dedicated guidance on third-party tracking pixels, requiring due diligence, data minimisation, and transparency in privacy policies about pixel use.

Data breaches: the trigger, the clock, and who gets told

The Notifiable Data Breaches scheme is triggered when personal information is accessed, disclosed without authorisation, or lost, and this is likely to result in serious harm. Both the affected individuals and the OAIC must be notified. The OAIC's guidance gives entities up to 30 days to assess a suspected breach once there are grounds to suspect one, with an expectation of much faster where possible, and notification itself must then happen as soon as practicable. The practical implication for a website owner is the same as in New Zealand: decide who assesses, who notifies, and how, before an incident rather than during one.

Consumer law: the single price rule is the one that catches websites

The Australian Consumer Law lives in Schedule 2 of the Competition and Consumer Act 2010, and its section 18 prohibition on misleading or deceptive conduct needs no intent: an honest mistake that misleads still contravenes it. For pricing, the ACCC's rule is concrete. A business must display the total price as a single figure, being the minimum a customer could pay including taxes, duties, and unavoidable or pre-selected fees. Consumer-facing prices must therefore include GST, and where a partial price such as a monthly instalment is shown, the total must be at least as prominent. This is stricter than New Zealand, where GST-inclusive display for consumers is enforced through general misleading conduct provisions rather than a single-price rule.

Drip pricing, where fees are added step by step through a checkout, has been litigated. The Federal Court found Jetstar and Virgin Australia engaged in misleading drip pricing over their booking flows, with penalties of $545,000 and $200,000 respectively. Fee disclosure belongs at the start of a purchase process, not the end of it.

Consumer guarantees, refunds, and reviews

• Consumer guarantees apply automatically to online sales and cannot be excluded: acceptable quality, fitness for purpose, and matching the description among them. Misleading customers about these rights is itself unlawful.
• There is no general change-of-mind right for ordinary online retail in Australia, the same position as New Zealand and unlike the EU and UK. If a store voluntarily offers a change-of-mind policy it must honour it, and blanket no-refunds signs are illegal because they misrepresent the guarantees.
• Fake and incentivised reviews are squarely unlawful. The ACCC's own enforcement page records Service Seeking penalised $600,000 and HealthEngine $2.9 million over review conduct. Incentives for reviews must apply regardless of whether the review is positive, and must be disclosed.

The Spam Act is opt-in, and enforcement is real money

The Spam Act 2003 covers commercial electronic messages by email, SMS, MMS and instant messaging, and it is an opt-in regime: consent first, express or inferred from an existing relationship. Every message needs accurate sender identification and a functional unsubscribe that is free or low cost, works for at least 30 days after sending, requires no login, and is honoured within five business days. The contrast with the United States matters for anyone using American marketing playbooks: CAN-SPAM permits unsolicited email until the recipient opts out. Australia does not.

The regulator, ACMA, enforces at a scale that surprises people. The Commonwealth Bank paid $7.5 million in 2024 over more than 170 million marketing emails without a working unsubscribe, its second penalty after $3.55 million in 2023. Kmart paid $1,303,500 in 2023 for emailing people who had unsubscribed, and Ticketek paid $515,040 the same year, a figure usually rounded down to half a million, for messaging without consent and after unsubscribes. The recurring failure across these cases is not exotic: it is unsubscribes that did not work or were not honoured, which is an engineering problem before it is a legal one.

Domains: .au has rules that .nz does not

Every .au licence requires an Australian presence, satisfied by an ABN, ACN or ARBN, by citizenship or permanent residency, or, for foreign entities, by owning or applying for an Australian trade mark, with com.au requiring the domain to exactly match that trade mark. New Zealand's .nz has no presence requirement at all, so a New Zealand business can hold .nz freely but needs a qualifying route for .au. Direct second-level .au registration, such as example.au, opened on 24 March 2022 and drops the close-connection requirement, needing only a validated Australian presence. One more difference worth knowing: WHOIS privacy is prohibited for .au, and auDA expressly bans proxy registration, so Australian registrant details are public in a way New Zealand individuals can avoid.

On identifiers: an ABN is eleven digits, an ACN is nine, and the Australian Business Register runs a free lookup API updated hourly, which makes live ABN validation in a checkout or onboarding form practical. Displaying an ABN on a website is standard practice and useful for anyone vetting you, but the hard legal requirements attach elsewhere: tax invoices over $82.50 must carry it, and a supplier who fails to quote an ABN on payments over $75 generally faces 47 percent withholding by the payer.

A practical checklist for an Australian business website

1. 01Work out whether the Privacy Act covers you. Over $3 million turnover, any health-related service at any size, or trading in personal information means yes.
2. 02If covered, publish a privacy policy that reflects what your site actually does, including any tracking pixels, and note where data goes overseas.
3. 03Display consumer prices GST-inclusive as a single total, with any fees disclosed at the start of the purchase flow rather than dripped through it.
4. 04State your returns policy accurately: consumer guarantees always apply, change-of-mind is your choice, and once published your policy binds you.
5. 05Never fabricate or incentivise reviews without disclosure applied equally to positive and negative ones.
6. 06Make marketing email and SMS opt-in, identify the sender, and test the unsubscribe path end to end, since a broken unsubscribe is the single most penalised failure in Australian spam enforcement.
7. 07Secure your .au eligibility route before building a brand on the domain, and know that your registrant details will be public.
8. 08Write a one-page breach plan naming who assesses, who notifies the OAIC and customers, and on what clock.