For five years operators were told to build first-party data capture. Most built the collection and never built the competence to use it, with only about one in ten Australian businesses now analysing their data to make decisions. A fresh OAIC investigation and the new statutory tort mean the data you never query is a standing legal risk, not a dormant asset.
Data you hold without consent and without use is not a moat. It is a mortgage you forgot you signed.
The Take: The data sitting in your CRM is not an asset quietly gaining value. For most Australian operators it is a cost centre you rarely open, and as of this week it carries legal exposure a regulator is prepared to chase through the Federal Court. The smart move is not to collect more. It is to earn the right to the little you can actually use.
For five years the advice to every business owner has run the same way. Third-party cookies are dying, so build your own data capture, own the customer relationship and the rest sorts itself out. Operators listened. They bought the forms, the loyalty apps and the consent pop-ups. They filled the warehouse. What almost none of them built was the second half of the sentence, the part where the data turns into a decision.
Why is the data you collected worth so little?
Because collecting and using data are separate skills, and most Australian businesses built only the first. Just 10% now analyse their data to make decisions, down from 24% three years ago.
The gap is not my opinion. The Australian Bureau of Statistics put a number on it. In its Characteristics of Australian Business 2024-25 release, only 10% of businesses actively collected or analysed data to make informed decisions, down from 24% in 2021-22. The share using predictive analysis to plan fell from 18% to 6% over the same period.
Read that twice. Over three years, while every conference told operators to become data businesses, the proportion actually using data to decide anything more than halved.
Something else moved in the opposite direction. AI use jumped from 1% to 12%. So the tools got cheaper and more capable, the raw material piled up and the number of businesses turning either into a decision shrank. That is not a resourcing problem. It is a competence problem, and no software licence fixes it.
Of Australian businesses actually analyse their data to make decisions, down from 24% three years ago
The data you are not using has started to bite back
Here is the part that changes the maths. Unused data used to be merely wasteful. Now it is a standing risk.
On Wednesday the Office of the Australian Information Commissioner opened a formal investigation into the China-based software maker behind the HeyCyan app, which powers a range of cheap AI smart glasses including the A$89 pair Kmart sold until they went out of stock in August. Privacy Commissioner Carly Kind said that, without any response from the maker to her preliminary questions, she had no assurance it was protecting the personal data of Australians as required by the Privacy Act. Meta, Google and Kmart engaged. The data collector at the centre of it did not.
That investigation carries teeth. The Commissioner can compel information, order a company to stop a practice and pursue civil penalties through the Federal Court for serious or repeated breaches.
It arrives on top of a bigger shift most owners missed. Since June 2025, Australia has had a statutory tort for serious invasions of privacy, which means an individual can now sue a business directly for mishandling their information. The regulator is no longer the only one who can come for you. Your customer can.
So the loyalty database you never query is not a dormant asset. It is a pile of other people's personal information that you are legally responsible for and commercially doing nothing with. That is the worst trade in business. All of the liability, none of the return.
What first-party data is actually worth
Let me say the quiet part plainly. First-party data is not your most valuable asset. The trust that lets you keep collecting it is.
A customer who believes you will handle their information with care, use it to make their experience better and not leak it to a maker in another country will keep giving it to you. That willingness is the asset. The rows in the table are just a record of it. Lose the trust and the rows become a cost. Keep the trust and even a small, clean dataset compounds.
In our benchmarking of Australian businesses across six marketing capabilities, measurement is consistently the weakest. The operators most eager to capture customer data are routinely the ones least able to tell you whether their marketing works at all. They have built the collection muscle and left the using muscle to wither.
Here is what the ABS picture looks like laid side by side.
The tools are racing ahead. The judgement to use them is going backwards. A business that closes that gap, even a little, pulls away from the rest without spending a dollar more on acquisition.
A note on methodology. Our read here is directional, drawn from how we score Australian businesses across six capabilities rather than any single dataset count. You can see how we score and where measurement tends to sit.
What I would do about it
Stop collecting first. Before you add one more field to a form, open the data you already hold and answer one question. When did we last make a decision from this? If the answer is never, you have found a liability, not an asset.
Then work in this order.
Delete what you cannot use. Every record you hold is risk you carry. If you are not going to act on a field, do not collect it and purge what you already have. A smaller dataset you understand beats a larger one you fear.
Pick one decision the data should drive. Not ten. One. Which customers are worth a second contact, which product gets reordered, which channel actually brings people back. Wire your data to that single decision and make it weekly.
Earn the consent properly. Tell people plainly what you collect, why and for how long. A clear exchange of value for information holds up to both the regulator and the customer. A buried checkbox does not.
Name an owner. Data with no owner is data that goes unused and unprotected. One person, accountable for both.
Where this leaves you
This is my opinion, formed from sitting on both the client and agency side. The post-cookie decade sold operators a collection habit and called it a strategy. The businesses that win from here are not the ones with the biggest databases. They are the ones who collect less, understand what they keep and keep the trust that lets them collect at all.
If you want to see where measurement sits against the other capabilities we track, start with the New Rebellion Lens.
Frequently asked questions
Is first-party data still worth collecting?
Yes, when you have a decision it will drive and the consent to hold it. The trouble is not collection. It is collecting by default and using by accident.
What changed legally for Australian businesses holding customer data?
Since June 2025 a statutory tort lets individuals sue directly for serious invasions of privacy, and the OAIC is actively investigating data handlers. Holding data you do not protect is now a direct liability.
How much Australian business data actually gets used?
Per the ABS, only 10% of businesses analysed data to make decisions in 2024-25, down from 24% three years earlier. Collection rose. Usage fell.
Does more AI fix the measurement gap?
No. AI use climbed from 1% to 12% while decision-making from data fell. The tool is not the constraint. The judgement to use it is.