Cookie banners are everywhere, so most Australian business owners assume they are legally required here too. They are a European import. The Privacy Act 1988 works differently from GDPR, and copying a banner template from a European site can leave you worse off than having none: a banner that promises choice while the tags load anyway is a promise you are not keeping.
We worked through this properly for our own website, which uses Microsoft Clarity for analytics and an OpenAI Ads measurement pixel, and this is the honest version of what we found. It is general information rather than legal advice, and it is part of the web development and SEO work we do.
What the Privacy Act actually requires
Australian privacy law is built on the Australian Privacy Principles, and three of them do the work here.
- APP 1: a privacy policy that explains what personal information you collect, how, and why. Analytics cookies and advertising pixels belong in it, by name, with what they collect and what it is used for.
- APP 5: notification at collection, done in a way that is reasonable in the circumstances. A clear link to the relevant section of your policy usually satisfies this for a business website. A banner or pop-up is one way to do it, not the only way.
- APP 3: consent for sensitive information. Health, financial hardship, religion and similar categories need consent to collect. This is where pixels become dangerous, because an ad pixel firing on a booking page for a health service can disclose sensitive information to an advertising platform without anyone deciding to.
In November 2024 the Office of the Australian Information Commissioner published guidance on third-party tracking pixels. It expects organisations to disclose pixels in their privacy policy, to notify visitors, to keep sensitive information away from ad platforms, and to configure pixels deliberately rather than pasting in the default snippet. Ad tech is on the OAIC’s list of regulatory priorities for 2025 to 2026, so this is being looked at.
When a banner is the right call
- You have meaningful traffic from the EU or the UK. GDPR and the ePrivacy rules require prior consent for non-essential cookies for those visitors, whatever your own law says.
- Your pixels could touch sensitive information. A clinic, a lawyer or a financial adviser should either keep ad pixels off sensitive pages entirely or gate them behind real consent.
- Your vendors require it. Microsoft Clarity has enforced consent signals for visitors from the EEA, the UK and Switzerland since October 2025, and simply sets no cookies for them until it receives one. OpenAI’s pixel ships with a consent flag you are expected to use where consent is required. Both require you to disclose them in your privacy policy.
For a business-to-business site serving Australians, none of those usually applies, and the honest answer is disclosure done well rather than a banner done badly.
What we do on this site
Our privacy policy names each tool, the cookies it sets, what is sent and to whom, with links to the vendors’ own statements. The footer carries a Cookies link straight to that section on every page. We send Clarity no consent signal, so European visitors get no Clarity cookies at all, and there is no banner because nothing on the site needs one.
Common mistakes
- Installing a banner that changes nothing when a visitor clicks “reject”.
- Naming one vendor in the policy and forgetting the others that a tag manager loads.
- Running conversion pixels on pages where the visit itself reveals something sensitive.
- Treating the privacy policy as a one-off document rather than something that changes when the site does.
What to do this quarter
- Inventory every third-party script and pixel on your site, including anything loaded through a tag manager. Your browser’s developer tools will show you.
- Update the privacy policy with each vendor, the cookies involved, the purpose, and a link to the vendor’s privacy statement, then link to that section from the footer.
- Decide about a banner based on your audience and the sensitivity of your pages. If you need one, implement a consent mode that genuinely gates the tags, and test it.
Privacy done honestly is a trust signal, and it costs far less than the penalties and awkward emails that follow getting it wrong. If you would like your site checked, book a consultation.