Do Tracking Pixels Breach the Privacy Act? OAIC Says Yes

Key Takeaways

• In June 2026 the OAIC found two health service providers, Medmate Australia and Monash IVF, breached the Privacy Act through tracking pixels, in determinations dated 11 June 2026
• Both were found to have breached the same three principles: APP 3.3 (collecting sensitive information without consent), APP 5.1 (failing to notify), and APP 7.1 (using it for direct marketing without consent)
• The OAIC’s reasoning: a business collects data under the Privacy Act by commissioning and controlling a pixel, even when the raw data sits on Meta’s or Google’s servers, not its own
• The investigation began with a scan of 50 health service provider websites in November 2024, well before either determination issued
• A generic accept-all cookie banner does not meet the Privacy Act’s consent standard: voluntary, informed, current and specific
• Both organisations were ordered to stop the non-compliant collection within 60 days; neither faced a monetary penalty in these determinations
• Health service providers, cosmetic clinics and cosmetic dental practices included, have no small-business turnover exemption from the Privacy Act

Yes. As of June 2026, the OAIC has a live answer, not a theoretical one. Two determinations, dated 11 June 2026, found that Medmate Australia and Monash IVF each breached the Privacy Act through their use of third-party tracking pixels on health-service websites. Both cases involved the same kind of setup a cosmetic clinic or cosmetic dental practice runs today: a treatment or booking page, a pixel from an ad platform, and no consent gate in front of it. Neither business ran a cosmetic clinic. The reasoning applies regardless.

What the OAIC Actually Found

The Australian Privacy Principles, published by the OAIC, are the rules a Privacy Act entity follows when it collects, uses or discloses personal information. Two determinations dated 11 June 2026, Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41 and Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40, applied those rules to tracking pixels for the first time.

The Commissioner found both organisations breached:

• APP 3.3, which requires consent before an entity collects sensitive information, and treats health information as sensitive information
• APP 5.1, which requires reasonable steps to notify an individual, or make them aware, that their information is being collected
• APP 7.1, which restricts using or disclosing personal information for direct marketing without consent

The investigation traces back to a scan of 50 health service provider websites the OAIC ran in November 2024, roughly nineteen months before the determinations were finalised. Legal commentary on the determinations (Clayton Utz, Allens and Gadens have each published analysis) reports the Commissioner’s finding that a business commissions and controls a tracking pixel’s deployment, and can customise what it captures, and that this control is enough to make the business a collector of the data under the Privacy Act, whether or not the raw data is ever stored on that business’s own servers. Neither determination imposed a monetary penalty. Both organisations were directed to stop the non-compliant collection within 60 days unless they could bring it into line with the Act.

Takeaway: the OAIC’s theory of “collection” reaches past whoever owns the server. If your website commissions the pixel and decides where it fires, the Privacy Act treats your business as the collector.

The OAIC’s own community attitudes research, cited by the Commissioner alongside these determinations, found 9 in 10 Australians consider it neither fair nor reasonable to be targeted on the basis of their sensitive health data. That is the regulatory backdrop the Medmate and Monash IVF rulings sit inside.

What That Means for the Build

Three things change in the code, not just the privacy policy.

1. Consent gates the tag, not just the banner display. In Google Tag Manager this means setting ad_storage and analytics_storage to denied by default via gtag('consent', 'default', {...}), and firing marketing tags only after gtag('consent', 'update', {...}) runs on an affirmative click. A tag that fires on page load regardless of banner state, then gets suppressed later by a cosmetic overlay, still collected the data before the overlay loaded.

2. The banner has to separate categories, not bundle them. “Accept all cookies” as a single button does not produce specific consent, because the visitor cannot separately agree to analytics and decline marketing pixels. A compliant banner needs at minimum an Essential/Analytics/Marketing split, each togglable on its own, with marketing defaulted off.

3. Vendors get named, not summarised. The consent record and the privacy policy both need to name each pixel provider individually, “Meta Pixel”, “Google Ads remarketing tag”, “TikTok Pixel”, not a generic line about “third-party cookies for advertising purposes”. A visitor cannot give informed consent to a vendor they were never told about.

This chart is a build model showing how a generic accept-all banner scores against the four elements of valid consent the OAIC applied in the Medmate and Monash IVF determinations. It is not a scored assessment of any specific vendor’s banner product.

Which Scripts Actually Trigger the Consent Requirement

Not every tag on a clinic site carries the same exposure. This is the decision matrix to run against your own tag stack.

Takeaway: the fix is never “remove all tags”. It is knowing which tags carry the URL and identifier combination the OAIC’s determinations treated as sensitive information, and gating those specifically.

This is an illustrative model, not a measured study. It ranks page types by how directly the URL or page content ties an identified visitor to a specific treatment, which is the exposure the OAIC’s determinations targeted. Confirmation pages score lower than the booking form itself but higher than general content, because most tag stacks still fire on them even after a rebuild focuses attention on the entry point.

A Worked Example: Cosmetic Clinic

A Perth cosmetic injectables clinic runs a Meta Pixel across its site, including /treatments/anti-wrinkle-injections and a booking form at /book?treatment=anti-wrinkle-injections. The site has a cookie banner with a single “Got it” button that dismisses without asking anything.

Applying the OAIC’s reasoning: the clinic commissioned the pixel, chose which pages it runs on, and can see the resulting audience data in Meta’s Ads Manager. That makes the clinic a collector of the data under APP 3.3, and the “Got it” button gives no specific, informed consent to that collection. The fix mirrors the build changes above: consent categories split into Essential/Analytics/Marketing, marketing defaulted off, and the pixel blocked from /treatments/* and /book* paths until a visitor opts in specifically. The treatment page URL itself is a separate exposure covered in the Meta Pixel payload breakdown, since the consent finding and the URL-structure exposure are two different problems needing two different fixes.

A Worked Example: Cosmetic Dentistry

A cosmetic dentistry practice runs Google Ads conversion tracking and a remarketing tag on /smile-makeover and /veneers-consultation, plus a session replay tool that records mouse movement and form field entry on the booking form. The privacy policy has one line: “This site uses cookies to improve your experience.”

On the reasoning applied in the Monash IVF determination, the remarketing tag collects sensitive information (a URL indicating cosmetic dental treatment interest, tied to a persistent identifier) without valid consent, and the privacy policy fails APP 5.1’s notification requirement because it names neither vendor nor purpose. The build fix: name Google Ads specifically in the policy and the banner, gate the remarketing tag behind the marketing consent category, and separately review the session replay tool’s field-level capture, since a booking form on a treatment page is exactly the page type the OAIC’s investigation targeted.

What to Check on Your Own Site

1. Open a treatment or procedure page, open your browser’s network tab, and filter for facebook.com/tr, googletagmanager.com, and tiktok.com. Reload the page without clicking anything. Do any of those requests fire before you interact with the consent banner?
2. Open your consent banner and check whether “Accept” is the only meaningful button, or whether Analytics and Marketing can be declined separately.
3. Read your own privacy policy’s tracking clause. Does it name Meta Pixel, Google Ads, or TikTok Pixel individually, or only say “cookies”?
4. Repeat the network check on your booking confirmation page. Confirmation pages are the most commonly missed, because they load after the visitor has already committed to a treatment.
5. Check whether a session replay or heatmap tool is active on any page containing a treatment selection or a health question, and whether it is covered by the same consent gate as your ad pixels.

The Enforcement Anchor

This is not a hypothetical risk category. It is a decided pair of determinations against health service providers, for exactly this conduct.

Medmate ([2026] AICmr 41) and Monash IVF ([2026] AICmr 40), both dated 11 June 2026, are the primary sources for this chart. Neither company is a cosmetic clinic or cosmetic dental practice, Medmate is a telehealth provider and Monash IVF is a fertility service, but both are health service providers under the Privacy Act, the same category a cosmetic clinic or a cosmetic dental practice falls into. Both determinations found the same three-part breach pattern, and both entities were ordered to cease the non-compliant collection within 60 days unless they could rectify it. Neither determination reports a monetary penalty at this stage.

Where This Gets Hard

Two genuine limits, and neither has a clean answer yet.

First, no determination has been published against a cosmetic clinic or cosmetic dental practice specifically. Medmate and Monash IVF establish the legal theory and the consent standard, but a regulator applying the same reasoning to a different kind of health-service website is a reasonable inference, not a guarantee. The OAIC says a business that commissions and controls a tracking pixel is a collector of the resulting data; the build consequence is that gating consent before any pixel fires is the safer engineering default regardless of business type; whether that reasoning applies identically to your specific tag stack and page structure is a question for your medical defence organisation or your lawyer.

Second, attribution degrades once marketing pixels are consent-gated and default off. A clinic running per-treatment ad campaigns will see fewer conversions attributed at the ad platform, because a meaningful share of visitors will not opt in to marketing cookies. There is no configuration that delivers full ad-platform attribution and a compliant consent gate at the same time. That is a real trade-off, not a technical gap waiting on a better plugin.

Status

In force. The Australian Privacy Principles, including APP 3, APP 5 and APP 7, have applied to health service providers since March 2014 regardless of turnover. The June 2026 Medmate and Monash IVF determinations did not create a new obligation; they applied an existing one to tracking pixels for the first time in a published determination, as at 11 August 2026. This is separate from the automated decision-making transparency obligation commencing 10 December 2026, and separate again from the proposed broader small-business exemption removal, which remains unlegislated with no commencement date as at this review.

Health service providers, cosmetic clinics and cosmetic dental practices among them, have carried this obligation since March 2014. The tracking pixel determinations did not start the clock; they are the first published test of it.

Frequently Asked Questions

Does a tracking pixel on a clinic website breach the Privacy Act?

It can, and the OAIC confirmed this in June 2026 when it found Medmate Australia and Monash IVF each breached three Australian Privacy Principles by using third-party tracking pixels on their health-service websites without proper consent. The Act does not name tracking pixels specifically; it applies its existing collection, notice and direct-marketing rules to whatever technology a business uses.

Do I collect someone’s data if the pixel provider, such as Meta or Google, holds it and not me?

Yes, on the OAIC’s reasoning in the Medmate and Monash IVF determinations. A business collects personal information under the Privacy Act if it commissions a tracking pixel, controls where it fires and can configure what it captures, even though the raw data sits on the pixel provider’s servers rather than the business’s own.

Does a cookie consent banner make pixel tracking compliant?

Not by itself. The OAIC found that neither Medmate nor Monash IVF had valid consent, because a generic accept-all banner does not meet the standard of being voluntary, informed, current and specific, and because cookie consent does not automatically cover a tracking pixel’s separate collection of sensitive information.

Is a cosmetic clinic or cosmetic dentistry practice covered by the Privacy Act even under 3 million dollars turnover?

Yes. Health service providers are covered by the Australian Privacy Principles regardless of annual turnover, so the general small business exemption does not apply to them. This has been the position since the exemption was introduced and is separate from any future broader removal of that exemption for other small businesses.

What happened to Medmate and Monash IVF after the OAIC’s rulings?

The Commissioner found both organisations had interfered with individuals’ privacy and directed them to stop the non-compliant collection within 60 days unless they could bring it into line with the Privacy Act. Neither determination imposed a monetary penalty.

Get Your Tracking Stack Checked

RockingWeb can review every pixel and third-party script on your site against the consent standard the OAIC applied in the Medmate and Monash IVF determinations, and return a written finding of what fires, when, and whether your current consent flow covers it.

Sources

1. OAIC - Australian Privacy Principles. Checked 11 August 2026.
2. OAIC - Privacy Commissioner finds privacy breaches in third-party tracking pixel investigation. Checked 11 August 2026.
3. AustLII - Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40. Checked 11 August 2026.
4. AustLII - Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41. Checked 11 August 2026.
5. Clayton Utz - OAIC determines the use of tracking pixels. Checked 11 August 2026.
6. Gadens - OAIC sweep highlights ad-tech privacy risks. Checked 11 August 2026.
7. Allens - Tracking pixels, targeted advertising and compliance. Checked 11 August 2026.

Last reviewed: 11 August 2026.