Legal Requirements for Websites and Apps: Australia

A genuinely small Australian business may be outside the main privacy law — subject to specific exceptions. The Privacy Act's $3 million turnover threshold has not been formally repealed, and coverage must be assessed against its exceptions. Meanwhile the parts with no threshold have been getting sharper: a statutory tort for serious invasions of privacy since June 2025, penalties up to $50 million, and a 10 December 2026 automated-decision disclosure duty and a separate deadline for registering the Children’s Online Privacy Code. The distinctively Australian rules are the ones about young people. Since 10 December 2025, age-restricted social media services must take reasonable steps to keep under-16s off — and the definition reaches any service whose significant purpose is social interaction, not just the big platforms. Consumer law is the other thing to internalise: Australian Consumer Law guarantees cannot be excluded by your terms, no matter what your terms say. This is the Australia chapter of our pre-launch legal checklist. Run that prompt sequence first, then layer this on.

Key takeaways

• The A$3M small-business exemption exists, but health information, trading in personal information, and a growing list of designated services cut through it.
• The 13 Australian Privacy Principles are the framework: notice at collection, purpose limitation, security, access and correction, and accountability for data you send overseas.
• Notifiable Data Breaches scheme: assess suspected breaches within 30 days, notify the OAIC and individuals for eligible breaches.
• Since June 2025, individuals can sue directly for serious invasions of privacy — no regulator required.
• 10 December 2026: privacy policies must disclose automated decision-making that significantly affects people, while the Children’s Online Privacy Code must be finalised and registered; confirm its final commencement and transition provisions.
• Social media minimum age 16 since 10 December 2025, with penalties up to A$49.5 million; "reasonable steps" means layered age assurance, not a checkbox.
• Spam Act: consent, sender identification, and an unsubscribe honoured within 5 business days.

Does the Privacy Act apply to you?

The Privacy Act 1988 applies to Australian Government agencies and to "APP entities" — businesses with an annual turnover over A$3 million, plus a set of small businesses regardless of turnover:

• anyone providing a health service and holding health information — which can include some wellness, fitness, mental-health and telehealth services, depending on the activity
• businesses that trade in personal information (buying or selling lists or data)
• credit reporting bodies, contractors to the Commonwealth, and residential tenancy databases
• from 1 July 2026, providers of certain AML/CTF designated services, which brought a large number of professional-services small businesses in for the first time
• any small business that opts in to coverage

Two more reasons not to rely on the exemption: future changes must be checked against enacted law, and several obligations that matter — the Spam Act, Australian Consumer Law, the Online Safety Act, the statutory tort — have no turnover threshold at all.

The Australian Privacy Principles that shape your build

• APP 1 — open and transparent management. A clearly expressed, up-to-date privacy policy, freely available, covering what you collect, why, how it's held, how to access and correct it, how to complain, and whether it goes overseas and where.
• APP 3 — collection. Collect only what's reasonably necessary for your functions. Sensitive information (health, biometrics, sexual orientation, religion, political views, criminal record) generally needs consent.
• APP 5 — notification at collection. Tell people at or before collection — a line on the form, not just a policy link.
• APP 6 — use and disclosure. Use it for the purpose you collected it for; secondary uses need consent or a listed exception.
• APP 7 — direct marketing. Individuals can opt out, and you must offer a simple way to do so in every message.
• APP 8 — cross-border disclosure. If you send personal information overseas, you must take reasonable steps to ensure the recipient complies with the APPs — and you generally remain accountable for their breaches. Every foreign SaaS tool in your stack is an APP 8 question.
• APP 11 — security. Reasonable technical and organisational measures, plus destruction or de-identification when the information is no longer needed. The 2024 amendments made the "organisational" half explicit.
• APP 12 and 13 — access and correction, generally within 30 days.

Notifiable Data Breaches. If you suspect an eligible data breach — unauthorised access or disclosure likely to result in serious harm — you have 30 days to assess, and must then notify the OAIC and affected individuals as soon as practicable.

Penalties. Serious or repeated interferences with privacy: up to A$50 million, three times the benefit obtained, or 30% of adjusted turnover. Mid-tier civil penalties and infringement notices (in the tens of thousands) now cover more ordinary failures, including not having a compliant privacy policy.

The statutory tort. Since June 2025, individuals can sue directly for serious invasions of privacy — intrusion upon seclusion or misuse of information — with damages available for emotional distress and no need for the regulator to act first.

The December 2026 milestones

Automated decision-making transparency. From 10 December 2026, if you use personal information in a computer program to make, or substantially help make, a decision that could reasonably be expected to significantly affect a person's rights or interests, your privacy policy must say so — what kinds of information are used, and what kinds of decisions are made. If your product scores, ranks, approves, prices or filters people, start writing that section now.

Children’s Online Privacy Code. OAIC’s current development page states that the code must be finalised and registered by 10 December 2026. The draft concerns covered APP entities and specified online services. Registration is not sufficient evidence of the final operative date, transition period or duties; verify the final instrument before treating the draft as binding.

Under-16s and social features

Since 10 December 2025, age-restricted social-media platforms must take reasonable steps to prevent Australians under 16 from holding accounts. Scope is functional and includes statutory conditions and exclusions; it is not established just because an app has a profile or a comment.

The minister amended the rules in March 2026. Assess the current definition, exclusions and guidance, rather than relying on a static list of platform names. See eSafety’s regulatory page.

Where age assurance is needed, consider privacy, accuracy, accessibility and review paths. Other online-safety duties may apply independently of the minimum-age rule.

If you sell

Australian Consumer Law provides consumer guarantees — acceptable quality, fit for purpose, as described, delivered within a reasonable time — that cannot be excluded, restricted or modified by your terms. A refund policy saying "all sales final" is itself a misleading representation. Digital products and subscriptions are covered.

Unfair contract terms in standard-form consumer and small business contracts now carry civil penalties, not just voidness. Auto-renewal clauses, unilateral variation clauses and one-sided termination rights are the common offenders in SaaS terms.

Misleading or deceptive conduct (section 18) is the broadest provision in Australian commerce and covers pricing, claims and comparisons. Single-price disclosure rules mean the total minimum price must be prominent.

Spam Act 2003. Consent (express or reasonably inferred), accurate sender identification with contact details, and a functional unsubscribe honoured within 5 business days. Applies to email, SMS and instant messaging.

GST. Non-resident businesses supplying digital products or services to Australian consumers must register for GST once they exceed A$75,000 in annual turnover from those supplies.

Accessibility

The Disability Discrimination Act 1992 makes it unlawful to discriminate in the provision of goods, services and facilities — which the Australian Human Rights Commission has long applied to websites. There's no prescribed private-sector standard, but WCAG 2.1 Level AA is the reference used in government policy and in practice. Complaints go to the AHRC and can proceed to the Federal Court.

The Australia-specific prompt

Run this after the ten prompts in the main checklist:

Add Australian compliance mechanics to this app. Implement each item and report exactly what changed:

1. A privacy policy meeting APP 1: what we collect, why, how it is held, how to access and correct it, how to complain to us and then to the OAIC, and whether personal information is disclosed overseas and to which countries.
2. Collection notices at the point of collection: on every form, a short statement of purpose. List every form and confirm each has one.
3. A cross-border disclosure list: every third-party service that stores or processes personal information outside Australia, what it receives, and the country. Report the list — I need it for APP 8.
4. A list of every place the app makes an automated decision about a user, or uses personal information to substantially assist a decision — scoring, ranking, approval, pricing, eligibility, filtering, content moderation. For each: what data it uses and what the decision affects. Then add a section to the privacy policy describing them in plain language.
5. Direct marketing: a simple opt-out in every message and in account settings, an unsubscribe honoured immediately in the system, sender identification and contact details in every message, and a stored record of how consent was obtained.
6. A breach response path: an internal incident log with dates, and an admin notice reminding that suspected eligible breaches must be assessed within 30 days.
7. If the app has any social feature — profiles, following, feeds, posting to other users, direct messaging combined with public content — describe each one plainly so I can assess whether this is an age-restricted social media service. Do not assert a conclusion; give me the facts.
8. If minors could plausibly use this app: restricted defaults for accounts under 18, no profiling or targeted advertising for those accounts, and age assurance that does not rely solely on a self-declared date of birth.
9. If we sell: total minimum price shown prominently, no term that purports to exclude or limit consumer guarantees, renewal date and amount shown before purchase and in account settings, and cancellation in at most two clicks.
10. An accessibility pass against WCAG 2.1 Level AA — report findings by severity before fixing anything.

For each item report PASS or explain what blocked it.
Copy prompt

Pre-launch checklist — Australia

• Privacy Act coverage assessed honestly (turnover, health information, designated services)
• APP 1 privacy policy published and current
• Collection notices on every form
• Overseas disclosure list compiled; APP 8 position understood for each vendor
• Automated decisions inventoried and described, ready for the 10 December 2026 disclosure duty
• Breach assessment process defined with the 30-day clock in mind
• Social features assessed against the social media minimum age definition
• Children's defaults and age assurance in place if under-18s could sign up
• Terms contain nothing purporting to exclude consumer guarantees; no unfair contract terms
• Spam Act: consent recorded, sender identified, unsubscribe within 5 business days
• Accessibility audited against WCAG 2.1 AA
• GST registration checked if selling digital products into Australia

What the build checks establish

The prompts are implementation requests, not a legal certification. Two-click controls and consent-first defaults are practical design choices, not universal statutory requirements. Confirm jurisdiction, exceptions, retention and provider contracts separately. Verify controls with test accounts and actual browser/network behaviour; a builder’s PASS based only on code inspection is incomplete evidence.

Official sources and review scope

Updated September 14, 2026. The linked sources support the scope and corrections discussed here; this is an editorial review, not an exhaustive legal opinion or a certification of your product. Check the operative rule when acting.

• OAIC small-business scope
• OAIC children’s-code milestones
• OAIC automated-decision transparency

Australia is mid-reform, and the December 2026 dates are already on the calendar. Run the pre-launch checklist, then the Australia prompt above. Selling elsewhere? See the United States, the European Union, the United Kingdom, Canada, Brazil and Israel. You can build this.