The Australian government has signalled that the Privacy Act's small business exemption will begin phasing out from July 2026, linked to anti-money laundering reforms. More than 100,000 businesses that were previously exempt will come under the Act's coverage.
This is one of four major privacy developments hitting Australian businesses in 2026. The others: mandatory disclosure requirements for automated decision-making systems from December 10, a Children's Online Privacy Code to be registered by December 10, and a landmark tribunal decision redefining what "collection" means for data processing.
The automated decision-making rules require any business using computer programs for decisions that significantly impact individuals to disclose what systems they deploy, what decisions those systems make and what personal information they process. If you use AI-driven lead scoring, personalised pricing or automated ad targeting, these rules apply.
The Children's Online Privacy Code applies to any digital service "likely to be accessed by children," even if designed for adults. It includes limits on direct marketing, deletion rights and age assurance requirements.
Australian businesses will come under Privacy Act coverage for the first time when the small business exemption phases out from July 2026
Why it matters
For Australian marketers, these changes affect how you collect data, how you target audiences and how you use automation. The small business exemption removal is the broadest change. If your business has annual revenue under $3 million, you were previously exempt from most Privacy Act obligations. That exemption is ending.
The automated decision-making disclosure rules have direct implications for marketing technology. Lead scoring, dynamic pricing, programmatic ad buying, AI-powered segmentation and personalisation engines all qualify as automated decision-making systems. If your martech stack makes decisions that affect individuals, you need to disclose that.
The Children's Online Privacy Code affects any business with a website or app that children might access. That is not limited to children's brands. E-commerce sites, content publishers and social platforms all fall within scope if children are "likely" to use them.
Entities deploying tracking pixels are now responsible for how those pixels collect and share data, even when a large platform provides the code. If Meta's pixel on your site collects data in ways that breach the Privacy Act, that is your problem.
What to do about it
Privacy compliance is no longer optional for small Australian businesses. The window to prepare is narrowing.
