Tranche 2 Just Landed: What Marketers Running Retargeting Need to Check Right Now
By the AdFixus team
On 31 August 2026 the Attorney-General’s Department released the second tranche of Australia’s privacy reforms, the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026. Forty proposals, submissions closed 18 September, and a rewrite of the core of the Privacy Act.
If your team runs retargeting through an ad platform, this is for you. The draft introduces a consent trigger for “trading” personal information (amendment 4.2) that, in IAB Australia’s own words, “captures the disclosure of PI for uses that support or inform direct marketing, e.g. cookies and pixels in programmatic advertising.” That is a description of your retargeting stack.
Before you panic: this is a draft, not law. The bill has not been tabled in Parliament, and the details can still move. What is already enforceable is a smaller, more immediate set of rules. It helps to separate the two.
What’s already enforceable: check this week
The Medmate and Monash IVF determinations (June 2026) and the tranche one reforms (December 2024) are live. If any of these fail, you’re exposed today, independent of Tranche 2.
- Singling out = personal information: Retargeting that lets an ad platform identify or “single out” a visitor is collecting PI, even with no name.
- Website operator liability: You’re liable for every pixel on your site, including ones your agency deployed.
- Point-in-time notification: You need a banner or pop-up at collection. A “direct marketing” line in your privacy policy is not enough.
- Express opt-in for sensitive data: Health, fertility, finance or religious inferences from page visits need express consent, not implied.
- Direct marketing = opt-out: Targeted ads are direct marketing under APP 7; you must provide a simple, working opt-out.
- Penalties: Up to $50M, 3x the benefit, or 30% of turnover for serious breaches; $330K per administrative breach; $66K infringement notices.
The first civil penalty under the new regime was A$5.8M (October 2025), and the OAIC has flagged AdTech and pixel tracking as a 2025-26 enforcement priority. 69% of Australian adults already oppose online tracking. This is not hypothetical.
What Tranche 2 would add: the watchlist
If the bill passes in this form, retargeting picks up several new obligations. The ones that matter most:
“Trading” your data requires consent. This is the big one. You can’t disclose PI as part of an exchange for value without consent. IAB’s summary is explicit that this “captures cookies and pixels in programmatic advertising.” There are two carve-outs: data that is strictly necessary to deliver a requested service (and never usable for marketing), and data from publicly available documents (including social posts). Disclosing to a true processor acting on your documented instructions is also out of scope. But a classic pixel that feeds a retargeting audience into an exchange sits squarely inside.
Group-level targeting is direct marketing. The new, technology-neutral APP 7 catches targeting an individual “as part of a group” using PI. That is audience segmentation. Each retargeting communication must carry an opt-out, and where an advertiser and a platform are both in the loop, the platform is generally responsible for the opt-out unless it is acting only as a processor.
The PI definition widens to “individuation”. Information now catches anything that relates to a person who is “recognised, singled out, or treated as a distinct individual.” Collection includes drawing inferences through data analysis or AI. Behavioural audience segments are the obvious target.
New sensitive categories. Precise geolocation (within 500m, tracked over time) and genomic data become sensitive. One useful nuance works in your favour: inferring a sensitive attribute is not itself collecting sensitive information, until you use or record it. IAB’s example: a halal meal order is fine; using it to market a religious festival is sensitive collection.
Consent gets an “unambiguous” test. Consent must be voluntary, informed, current, specific and unambiguous. Bundled consent and dark-pattern interfaces that make refusal hard won’t survive. Implied consent survives, but only where it is genuinely inferable.
72-hour breach notification. A hard deadline to notify the OAIC of an eligible breach. Missing it is itself an interference with privacy.
A processor shield, with a catch. A processor following a controller’s written instructions is mostly shielded from the APPs (except APP 1 privacy policy and APP 11 security). The catch: it only works where both parties are APP-regulated. If you’re a sub-$3M business, you may not be covered, and the shield can’t protect you.
Two clarifications so you don’t over-read the draft: it does not remove the small business exemption, and it does not mandate pre-ticked or bundled consent. It tightens what counts as valid consent.
The checklist: what to check on your site
Work through these now, regardless of Tranche 2’s fate:
- Inventory every tag. Document each pixel, tag and CAPI endpoint, and where the data goes. If it reaches an exchange, DSP or external audience, that’s the flow to scrutinise.
- Classify each flow. Is it collection, a “trade” (disclosure for value or exchange), or a processor disclosure? The classification drives the consent requirement.
- Check your consent. Express (not implied), unbundled, unambiguous, and captured before the pixel fires. If your CMP pre-loads scripts or uses “by continuing you accept,” you have a gap.
- Verify point-in-time notification. A real banner or pop-up at collection, not a policy link.
- Map your sensitive pages. Health, finance, fertility, religion, politics. Confirm those contexts aren’t being sent to ad platforms, and that you’re not using inferred sensitive attributes.
- Audit geolocation. Do you run a location SDK that can pin within 500m over time? If so, treat it as sensitive.
- Confirm the opt-out. A simple, working opt-out in every retargeting communication. Know whether you or the platform owns it.
- Tidy the processor paperwork. Where you rely on a processor, do you have documented written instructions? Is the counterparty APP-regulated?
- Refresh your privacy policy and collection notice. Name the third parties, the purposes, and any overseas transfers. Keep it current.
- Test the breach playbook. Can you actually hit 72 hours?
So do you actually need to do anything?
If you already run a compliant CMP that blocks pre-consent collection, takes an express opt-in, excludes sensitive contexts and honours opt-outs, you’re largely covered on the enforceable baseline. Tranche 2 would raise the bar (the trading trigger, 72 hours, the unambiguous consent test), but it is not law, and the specifics can shift before it is tabled.
The realistic move: close the enforceable gaps now, document your position, and track the bill. Don’t wait for the draft to become law to start the conversation with your agency.
The structural point
The reason retargeting keeps drawing regulatory attention is architectural. Third-party pixels are built to leak data out to an external graph you don’t control, and you then carry liability for a flow you can’t govern. That is the lesson of Medmate, and it is exactly what the trading trigger is designed to reach. First-party infrastructure avoids the problem at the root. AdFixus runs in your own environment, creates identities only after a consent click, keeps data PII-free, and doesn’t build cross-site identity graphs or sell segments. Same retargeting and measurement, without the data flow the OAIC is now targeting.
AdFixus provides privacy-by-design first-party infrastructure for publishers and advertisers. For a compliance review of your current tracking stack, contact the AdFixus team.
Sources
- IAB Australia, Privacy Amendment (Personal Data Protection) Bill 2026: Key Changes, Exposure Draft Summary (September 2026)
- Dentons, Privacy reform take two: A substantial rewrite of Australia’s Privacy Act (3 September 2026)
- OAIC, Medmate and Monash IVF determinations (June 2026)
- OAIC, tracking pixels guidance (November 2024) and APP 3 Guidelines Version 1.2 (May 2026)
