Australia's Privacy Act overhaul gives people an unqualified right to opt out of direct marketing, expands personal information to cover device IDs and cookies, and brings a registered SMS Sender ID requirement from 1 July plus a Children's Online Privacy Code from December. First-party data just went from nice idea to necessity.
The era of buying audiences you never spoke to is closing. First-party data just stopped being a strategy slide and became a requirement.
Australia is in the middle of its biggest privacy overhaul in decades, and the parts that touch marketing are arriving on fixed dates. This is not a future consultation. It is a set of deadlines.
People are getting an unqualified right to opt out of direct marketing. The definition of personal information is expanding to explicitly include technical identifiers like IP addresses, device IDs and cookie identifiers, which drags a lot of so-called anonymous targeting into scope. Businesses will need to be transparent about the use of algorithms and profiling in advertising. From 1 July 2026, branded text messages that show an organisation's name at the top must have that sender ID registered on the SMS Sender ID Register as part of the government's anti-scam push. A Children's Online Privacy Code applies to services likely to be accessed by children from 10 December 2026.
The throughline is a hard shift away from third-party data and toward data you collect directly, with consent, from your own customers.
Why it matters
For Australian businesses, this reshapes targeting, list building and measurement at the same time. If your acquisition leans on third-party audiences and broad device-level tracking, the ground is moving under it. If you have invested in owned channels and consented first-party data, you are positioned for exactly where the law is heading.
The SMS change has the nearest deadline and the simplest fix. Miss it and your branded messages stop showing your name, which guts trust and open rates.
Date the SMS Sender ID Register requirement takes effect for branded business texts in Australia. Source: ADMA and Norton Rose Fulbright, 2026.
What to do about it
Register your SMS sender ID now if you send branded texts. The 1 July deadline is close and the fix is administrative, not strategic.
Audit where your audience data comes from. Anything that depends on third-party identifiers needs a first-party replacement plan.
Make opt-out genuinely easy and respect it immediately. The unqualified right means no more friction-filled unsubscribe flows.
Review any service likely to reach children well before December. The Children's Code carries real obligations and real penalties.
Build the consented first-party data asset now. It is where the law, and the AI shift, are both pointing.