Australia’s Privacy Commissioner has ruled that two health providers breached privacy laws after using website tracking pixels to collect sensitive health information without obtaining appropriate consent, setting an important precedent for organisations handling personal data online.
The determinations against Medmate Australia Pty Ltd and Monash IVF Pty Ltd follow a year-long investigation by the Office of the Australian Information Commissioner (OAIC) into the use of third-party tracking technologies on health-related websites.
Tracking pixels collected sensitive health information
Tracking pixels are small pieces of code embedded in websites that collect information about users’ online activity, often to support advertising, analytics, and audience targeting.
The Privacy Commissioner found that using these technologies to collect sensitive information from visitors to health-related websites and then using that information for targeted social media advertising constitutes the collection of sensitive information under the Privacy Act 1988 and requires user consent.
The ruling establishes that organisations cannot rely on the sophistication of digital advertising technologies to avoid their legal obligations when handling sensitive personal information.
“Today’s decision establishes that the advanced technology used for tracking and targeted advertising in the online realm still has to be used in compliance with the Privacy Act,” the Privacy Commissioner said.
Privacy ruling sets new expectations
The commissioner said Australians may have become accustomed to online tracking, but community expectations are very different when sensitive health information is involved.
Research commissioned by the OAIC found that nine in 10 Australians believe it is neither fair nor reasonable to be targeted with advertising based on their sensitive health information.
Read also: National Media Literacy Strategy to help Australians navigate AI-driven misinformation risks
The commissioner said organisations must obtain consent before using tracking technologies to collect sensitive information, including data relating to health, political opinions, race, or ethnicity.
OAIC urges organisations to review website tracking
Alongside the determinations, the OAIC released a report, Your Life, Pixelated: How Tracking Pixels Watch Your Every Click, following an inspection of 50 Australian health service provider websites.
The regulator is encouraging all organisations covered by the Australian Privacy Principles to review how tracking pixels and similar technologies are used on their websites to ensure they comply with the Privacy Act.
The findings highlight the growing scrutiny of online tracking technologies as regulators seek to balance digital innovation with stronger protections for personal information.
Privacy becomes a governance priority
The determinations reinforce that privacy compliance extends beyond traditional data security practices to include the design and operation of websites, digital marketing tools, and online advertising technologies.
For organisations collecting sensitive personal information, the decision serves as a reminder that transparency and informed consent are becoming central expectations of digital governance. As regulators increase their focus on online tracking, privacy is no longer simply a legal compliance issue—it is increasingly a matter of public trust.
Public Spectrum is the first knowledge-sharing platform in Australia to embrace the entire public sector. This website is a platform where you can connect, collaborate, empower, inspire, and upskill with public sector professionals.
Latest
Popular