Australia's second-tranche Privacy Act reform reclassifies cookies and device IDs as personal information and demands genuine consent. Most businesses will file it under compliance. That is a mistake, because it is really a marketing performance problem, and first-party consent is becoming the acquisition advantage competitors cannot buy back.
Consent stopped being a checkbox the day it became the only legal way to keep measuring.
The Take: Australia's second privacy tranche is not a memo you forward to your lawyer and forget. It reclassifies the cheap identifiers that half the market quietly built its targeting on, and it rewards the businesses that already earn real consent with something their competitors cannot buy back. Treat this as a marketing decision now or lose the ability to measure later.
What actually changed on 31 August?
The exposure draft landed on 31 August 2026 with about 40 measures. Public consultation closes 18 September 2026. It recasts consent as genuine and counts technical identifiers as personal information.
On 31 August 2026 the Attorney-General released exposure draft legislation carrying around 40 measures, the most substantive privacy overhaul in more than a decade. Consultation runs until 18 September 2026. The draft expands personal information to cover IP addresses, device IDs and cookie identifiers, introduces a fair and reasonable test and a trading concept that requires consent to disclose personal information for money or direct marketing. Consent itself has to be voluntary, informed, current, specific and unambiguous. Pre-ticked boxes and dark patterns are out.
Why this is a marketing problem, not a legal one
Most operators will read the summary, decide it is a job for counsel and move on. That is the mistake.
This is not a compliance job. It is an acquisition job. The moment a cookie identifier or a device ID becomes personal information, every targeting and measurement setup that leaned on those identifiers without genuine permission stops being a grey area and becomes a switched-off input. Retargeting pools shrink. Lookalike seeds thin out. The conversion signal you fed back to the ad platforms gets quieter. None of that arrives as a legal fine first. It arrives as a rising cost per acquisition and a report you can no longer trust.
The businesses that spent the last few years asking properly, storing consent and giving people a real reason to say yes are about to find that work compounding. They can still measure. They can still personalise. They can still build audiences that belong to them.
Which businesses just lost their targeting?
Sort the market into two piles. The first built acquisition on borrowed identifiers and assumed permission. The second built it on a first-party relationship. The reform draws the line straight between them.
The first pile is about to pay more for less. The second pile just widened its moat.
The number the reform is built on
Australians did not wait for legislation. They moved first. 87% of Australians say they are more concerned about their privacy than they were five years ago, and that concern is the political fuel behind all 40 measures.
Share of Australians who are more concerned about their privacy than they were five years ago. Source: OAIC, 2026
The commercial half of that survey is the part operators keep missing. 68% said they would be more likely to use a digital service if they knew their data was handled responsibly. Read that number again. Two thirds of the market is telling you that earning trust is a way in, not a tax on growth.
The businesses that treated permission as a relationship will still have a market to sell to. The rest will be guessing.
What I would do about it
Do not wait for the bill to pass. The consultation closes 18 September 2026 and the direction is already clear enough to act on.
Australia's advertising market is forecast to reach about A$30.7 billion in 2026, up 6.5%. A rising market with a shrinking pool of usable identifiers means the operators who own their consent get to spend that money with precision while the rest pay more and guess.
How we read this methodology
What we see across the Australian businesses we work with is consistent. The ones with a real first-party consent base recover from every platform and policy change faster, because their measurement does not depend on anyone else's permission settings. When we assess a business we score its data and consent maturity. It is usually the gap that explains why two competitors with similar budgets get very different returns. You can see how we score that here.
The bottom line
My opinion, stated as opinion: this reform is the best thing to happen to disciplined marketers in a decade, and a slow-motion problem for the businesses that outsourced their audience to the ad platforms. Consent is turning into the acquisition advantage rather than the compliance chore. The businesses building it now will still be able to measure and grow when the identifiers the rest relied on go quiet. That is exactly the work we do inside NR Studio.
Frequently asked questions
When does Australia's Privacy Act second tranche take effect?
The exposure draft was released on 31 August 2026 and public consultation closes 18 September 2026. It is draft legislation, so the exact commencement dates will follow the bill, but the direction is set. Building first-party consent now is the safe move.
Are IP addresses and cookies really personal information now?
Under the draft, yes. It explicitly expands personal information to include technical identifiers such as IP addresses, device IDs and cookie identifiers. Any targeting or measurement that relies on them without genuine consent is exposed.
What counts as valid consent under the reform?
Consent must be voluntary, informed, current, specific and unambiguous. Pre-ticked boxes, buried opt-ins and dark patterns are restricted. A real opt-in with a clear purpose is the standard.
Is this only a concern for big platforms?
No. The right to erasure is aimed at large platforms, but the consent, trading and fair and reasonable rules apply broadly. Any Australian business that markets using personal data should treat this as its problem.