Australia proposes dual track privacy compliance for digital advertisers

Privacy law expert Peter Leonard delivered unexpected news to digital advertising professionals at the IAB Australia Data & Privacy Summit on August 6, 2025, revealing that Australia's regulatory landscape had potentially shifted overnight. Speaking at the NSW Teachers Federation Conference Centre, Leonard disclosed that the Productivity Commission had released its interim report on "harnessing data and digital technology" at 10:30 PM the previous evening, fundamentally challenging existing privacy reform proposals.

"I had to revise my paper today on the metro on the way here because at 10:30 last night the productivity commission dropped its interim report on harnessing data and digital technology," Leonard told the summit audience. The Principal and Director at Data Synergies explained that the report included a crucial chapter titled "supporting safe data access and use through outcome-based privacy regulation."

The commission's proposal introduces what Leonard described as a "dual track compliance regime" that could offer digital advertisers an alternative to increasingly complex notice and consent requirements. "Instead, the productivity commission says, 'Hey, hang on a bit. We should be thinking about a dual track and that dual track might look something like this,'" Leonard explained during his presentation titled "Navigating pixel and tracking code reforms and enforcement: the past is not a guide to the future."

According to Leonard, organizations would be able to choose between two compliance pathways. "So an organization could elect either to comply with the revised privacy regime based upon notice and consent and however it might be changed after what I like to call trench 1.5 because we'll never see trench 2," he stated. "Or they can elect to take an outcomes-based approach and that would be based on a new concept which asks the question is what an organization doing in the best interests of the person concerned or some concept like that."

This alternative could prove particularly attractive for digital advertising companies. Leonard suggested that many industry participants "might consider that what you're doing is in the best interests of the person concerned. You're delivering them more relevant advertising material to their interests and maybe you're ready to go down that path and avoid having to deal with the full notice and consent regime."

The timing proves significant given mounting regulatory pressure on the digital advertising sector. Leonard noted that enforcement priorities now include "advertising technology (ad tech) such as pixel tracking," with the Office of the Australian Information Commissioner taking an increasingly active stance following investigations including the TikTok case.

Leonard cautioned the audience about potential risks inherent in dual track systems. "One thing to pause and think about is how the trench 1.5 track might develop if in fact that alternative is made available," he warned. "There is a risk always that when government allows a safety valve or a safe harbor that they kind of double down on the other side and make the other side requirements even more onerous because an organization has the choice of the safe harbor."

Drawing from international examples, Leonard highlighted emerging challenges beyond traditional privacy frameworks. He referenced recent airline pricing practices where carriers "had started charging higher per-person fairs for single passenger bookings than for identical itineraries with two people," describing this as airlines "weaponizing their fairs against solo travelers who can't clone themselves."

These examples illustrate broader regulatory trends toward scrutinizing personalized treatment of individuals. "If instead you go down a track which says it's not a question of whether they are identifiable or not but whether data is being used to individuate to personalize the treatment of an individual and then ask the question was that data used in the best interest of the person concerned or contrary to their best interests," Leonard explained.

Leonard referenced New York legislation that became effective in May 2025, requiring companies using personalized algorithmic pricing to include specific disclosures. "Quote this price all in large case this price was set by an algorithm using your personal data," he stated, describing the mandatory notification requirements.

The privacy expert emphasized that current regulatory frameworks may inadequately address contemporary data practices. "All of our privacy law today is built on the concept of a reasonably identifiable individual," Leonard observed. "And let's face it, the reason many times that clean rooms are proposed are to try and work a way through the regulatory regime to find a way to personalize to individuals without using directly information about a reasonably identifiable individual."

Leonard suggested the dual track approach could provide "an alternative way of addressing this in a potential safe harbor for digital advertisers who are willing to think about the best interests of people and potentially it gets us away from this really technical and engaged process around notice consent disclosures and provides an alternative track based upon a safe harbor of best interests of people concerned."

The regulatory environment faces additional uncertainty from international developments. Leonard noted that the European Union is reconsidering its approach: "The EU is not going to set the path for Australia. Donald Trump is not going to set the path for Australia because he's made it clear that his path is concerned with one thing only, make America great again."

Regarding EU AI regulation specifically, Leonard was critical: "EU AI regulation is stupid. It's overcooked. It was developed before Gen AI came on the scene. It's completely unfit for purpose of dealing with applications of Gen AI."

The pathway for implementation involves Treasury rather than traditional privacy regulators. "We know that the productivity commission recommendations go to Jim Charas. Jim Charas has got the money, so he's more important than Michelle Roland, the attorney general, who never has the money," Leonard explained, referencing Treasurer Jim Chalmers' central role in determining reform outcomes.

Leonard concluded with broader observations about privacy reform dynamics: "Privacy reform almost always happens not because a particular privacy reform has been demonstrated to be in the best interests of the public. It usually comes because there's some existential political crisis that causes the government to react."

The expert warned against assuming predictable regulatory development. "Don't think that we are necessarily in a process of trying to influence development of privacy law to be optimal for the digital advertising sector. Although that is what we're trying to do, the simple reality is government will be buffeted by headwinds that are often unpredictable and cause privacy reform to head off in all sorts of strange directions."

Leonard's two key takeaways emphasized uncertainty: "My first key takeaway is the past is not a guide to the future. And my second takeaway is that however privacy regulation develops is not likely to be around what is the best or most appropriate form of regulation for digital advertising."

The commission's report arrival timing created immediate implications for industry planning. "As of 10:30 last night, the world may have changed. It depends on whether the Productivity Commission's interim recommendations carried through as final recommendations," Leonard concluded. Industry participants have until September 15, 2025, to provide feedback on the proposals before final recommendations are developed.

Current enforcement developments support Leonard's urgency around regulatory adaptation. The OAIC has identified tracking pixels as an enforcement priority, with guidance indicating that "collecting personal information covertly without the knowledge of the individual is likely to be an unfair means of collection." Organizations must also "comply with the direct marketing obligations under APP 7 when using tracking pixels to target individuals with online ads."

Digital advertising professionals have responded by prioritizing first-party data strategies. Recent IAB Australia research found that 80% of industry professionals consider first-party data critical for targeting decisions, with 92% viewing data usage as essential for commercial success.

Leonard's presentation occurred alongside other significant privacy developments globally. France's data protection authority recently proposed stricter email tracking consent rules, while Germany's competition regulator found Apple's app tracking framework may violate competition law.

The dual track proposal represents the most significant potential change to Australian privacy law since the Privacy Act's inception. If adopted following the commission's final report in December 2025, the framework could influence international privacy governance by demonstrating alternatives to consent-only regulatory models.

Industry adaptation continues through technological innovation. Google's Display & Video 360 recently introduced privacy-preserving advertising solutions, while Adobe launched data collaboration tools for first-party data sharing. These developments complement regulatory frameworks that could enable outcomes-focused data practices.

The commission expects artificial intelligence to add more than $116 billion to Australian economic activity over the next decade. Privacy regulation enabling data innovation while protecting individual interests could prove crucial for realizing these economic benefits, making Leonard's revelation at the IAB summit particularly significant for industry strategic planning.

Timeline

• August 5, 2025, 10:30 PM AEST: Productivity Commission releases interim report "Harnessing data and digital technology"
• August 6, 2025: IAB Australia Data & Privacy Summit where Peter Leonard reveals dual track implications for digital advertising
• August 11, 2025, 12:00 PM AEST: Productivity Commission conducts explanatory webinar
• September 15, 2025, 5:00 PM AEST: Industry submission deadline
• December 2025: Final report delivery to Australian Government
• Early 2026: Potential parliamentary consideration and implementation

PPC Land explains

Dual Track Privacy Compliance: The proposed regulatory framework allowing organizations to choose between two distinct compliance pathways - traditional notice and consent mechanisms or an outcomes-based approach centered on demonstrating best interests for individuals. This system represents a fundamental departure from single-pathway privacy frameworks, offering flexibility for organizations confident in justifying their data practices through consumer benefit rather than procedural compliance.

Outcomes-Based Approach: A privacy compliance methodology requiring organizations to prove their data processing activities serve the best interests of affected individuals rather than following prescribed procedural requirements. This approach shifts regulatory focus from process adherence to substantive outcomes, potentially benefiting digital advertisers who can demonstrate personalized advertising enhances consumer experience through relevant content delivery.

Productivity Commission: Australia's independent research and advisory body tasked with conducting inquiries into economic policy matters affecting national productivity growth. Established under the Productivity Commission Act 1998, the organization provides evidence-based recommendations to government on regulatory reform, competition policy, and economic efficiency measures across various industry sectors.

Notice and Consent: The traditional privacy compliance framework requiring organizations to inform individuals about data collection practices and obtain explicit permission before processing personal information. This mechanism forms the foundation of most contemporary privacy laws, though critics argue its complexity and implementation challenges often fail to achieve meaningful protection or user understanding.

Digital Advertising: The practice of delivering promotional content through digital channels including websites, mobile applications, social media platforms, and connected devices. Modern digital advertising relies heavily on data collection and algorithmic targeting to personalize content, making it particularly sensitive to privacy regulation changes that affect data availability and usage permissions.

First-Party Data: Information collected directly by organizations through their own customer interactions, websites, applications, and services. This data type has gained strategic importance as privacy regulations restrict third-party data sharing, with 80% of Australian advertising professionals considering it critical for targeting decisions according to recent industry surveys.

Australian Privacy Principles: The mandatory privacy standards under Australia's Privacy Act 1988 governing how organizations collect, use, store, and disclose personal information. These principles establish baseline requirements for privacy protection, with APP 3 addressing fair collection practices and APP 7 covering direct marketing obligations that particularly affect digital advertising operations.

Best Interests Test: The proposed evaluation criterion for outcomes-based privacy compliance requiring organizations to demonstrate their data processing activities benefit rather than harm affected individuals. This test would shift regulatory burden from procedural compliance to substantive justification, potentially offering advantages to organizations providing demonstrable consumer value through personalized services.

Privacy-Enhancing Technologies: Technical solutions designed to enable data processing while minimizing privacy risks through methods including encryption, differential privacy, secure multi-party computation, and data minimization. These technologies have gained prominence as organizations seek to maintain data utility while complying with increasingly stringent privacy requirements across international jurisdictions.

Regulatory Framework: The comprehensive system of laws, guidelines, enforcement mechanisms, and oversight bodies governing privacy and data protection practices. Australia's framework encompasses federal Privacy Act requirements, state-based regulations, industry codes, and enforcement actions by the Office of the Australian Information Commissioner, creating a complex compliance environment for digital advertising operations.

Summary

Who: Peter Leonard, Principal and Director at Data Synergies, revealed Australia's Productivity Commission recommendations at the IAB Australia Data & Privacy Summit, affecting digital advertisers, privacy regulators, and data processing organizations. Commissioner Stephen King led the inquiry into data and digital technology productivity benefits.

What: A dual track privacy compliance system allowing organizations to choose between traditional notice and consent requirements or an outcomes-based approach demonstrating data practices serve individual best interests. The framework challenges attorney general privacy reform proposals and was revealed through Leonard's presentation analyzing the overnight report release.

When: The interim report was released August 5, 2025, at 10:30 PM AEST, with Leonard presenting the implications at the IAB summit on August 6, 2025. Industry submissions are due September 15, 2025, with final recommendations expected December 2025.

Where: Australia's privacy regulatory framework, revealed at the NSW Teachers Federation Conference Centre during the IAB Australia Data & Privacy Summit, with potential influence on international privacy governance models and digital advertising practices across global markets.

Why: Economic productivity concerns drive the proposal, as Leonard explained that current privacy regulations may "entrench existing problems" and hinder the $116 billion economic benefit potential from AI and data technologies over the next decade, with regulatory reform driven by unpredictable political pressures rather than optimal digital advertising frameworks.