IAB Tech Lab has finalised a standard for machine-readable data-deletion requests just as Australia's Privacy Act reform removes the small business exemption and adds a right to erasure. Marketers whose measurement cannot delete a named person on request are building a liability. Audit for deletion before the December disclosure deadline.
The Take: The advertising industry just turned data deletion from a nice idea into a shared technical standard, and Australia's own privacy overhaul is landing on the same beat. If your measurement cannot forget a named person on request, it is about to become a liability. Build for deletion now, not after the first complaint.
The mechanics: IAB Tech Lab has finalised version 2.0 of its Data Deletion Request Framework and put updates to its Global Privacy Protocol out for public comment until 11 September 2026, according to MarTech. The framework standardises how a deletion request is verified and passed between platforms, so "please delete my data" becomes a machine-readable instruction rather than an email someone ignores. Version 2.0 also tightens how identity and deletion tokens are defined and improves the feedback a platform gets when a deletion succeeds or fails. The update also lines up with a refreshed multi-state privacy agreement that covers United States consumer laws.
The context: This matters more in Australia than it first looks. Australia's Privacy Act reform has removed the small business exemption, pulling most Australian businesses under the Australian Privacy Principles for the first time, per law firm Corrs. A right to erasure and clearer deletion expectations come with it, and a separate children's privacy code adds tighter limits on direct marketing to under-18s.
From this date, Australian businesses must disclose in their privacy policy where they use automated decision-making, including AI
The deadline: The regulator has named advertising technology and AI systems as priority targets. A measurement setup that hoovers up first-party data with no way to delete a named person is exactly the profile the OAIC is looking for.
For Australian operators: Audit where customer data actually lives across your analytics, CRM, ad platforms and anything you have handed to partners. Confirm each one can delete a single person on request and prove it. Map which vendors you rely on to handle customer data and drop any that cannot honour a deletion request end to end. Write the automated-decision-making disclosure into your privacy policy ahead of the December deadline rather than after, because the standards and the law have both decided deletion is not optional.