Cybersecurity Policy Report, Guidance on Use of Tracking Pixels Issued in Australia, (Nov 4, 2024)
By Tony Foley
The Office of the Australian Information Commissioner (OAIC) has released guidance for private sector organizations designed to ensure that they meet their obligations under Australian privacy law when using third-party tracking pixels on their websites.
The guidance is a response to industry demand for greater detail on the impact of the Privacy Act on tracking technologies, as well as general interest in the topic across government, media, and the community, OAIC said today in a news release.
Tracking pixels are pieces of code generated by third-party providers and used by many social media companies and other digital platforms. They can be placed on an organization’s website to collect user activity information. When a user visits a webpage, pixels load and send specified types of data to the server of the third-party provider.
The news release notes that pixels are one of many tracking tools, including cookies, that permit granular user surveillance that, while important for businesses, may also cause privacy concerns.
“[M]any of these tracking tools are harmful, invasive and corrosive of online privacy,” Australian Privacy Commissioner Carly Kind said. “This is a real concern in the community with our Australian Community Attitudes to Privacy Survey 2023 finding that 69% of adults did not think it fair and reasonable that their personal information was used for online tracking, profiling and targeted advertising, with that rising to 89% when material was targeted at children.”
The new guidance makes it clear that it is the responsibility of the organization seeking to employ a third-party tracking pixel on their website to ensure that it is configured and used in compliance with Privacy Act requirements. Before deploying such a pixel, organizations must understand how the product works, identify the potential privacy risks involved, and implement risk mitigation measures. A failure to conduct appropriate due diligence can create a range of privacy compliance and other legal risks. Among the specific issues addressed in the guidance are the following:
Sensitive information should only be collected through tracking pixels with express data subject consent;
Third-party providers transferring information gathered using tracking pixels must do so in accordance with the law’s privacy principles;
With respect to direct marketing, organizations must comply with the provisions of Australian Privacy Principle 7, which includes, among other requirements, providing individuals with the opportunity to opt out of such processing; and
Organizations should conduct regular, ongoing reviews of tracking technologies employed on their websites to ensure that they remain appropriate and lawful.
News: InternationalLegislation DataPrivacy