Tracking pixels, targeted advertising and compliance—lessons from recent OAIC determinations

Medmate provides a range of health services, including telehealth consults, online prescriptions and mental health support. During the period the subject of the OAIC's investigation, Medmate had two active tracking pixels on its website. Both collected information about individuals' engagement with the website, such as when an individual viewed a website page and the specific content they engaged with, as well as details related to any purchases the individual made. One of the pixels also enabled full URLs, phone numbers and hashed email addresses to be transmitted to the pixel provider when users used the Medmate website. The investigation identified that the URLs transmitted from the pixel sometimes included sensitive information, including health conditions or medication sought.

During the relevant period, Medmate paid for online advertising campaigns on the pixel provider's platforms that leveraged the tracking pixel data. These campaigns had target audience and demographic parameters, such as individuals that had purchased certain types of medicine by state or had previously made use of Medmate telehealth services. It also created custom audience functions to retarget individuals based on their interaction with the website, and to track individuals that submitted forms and viewed website pages.

Monash provides fertility treatments and assessments, including assisted reproductive treatments. It had various pixels deployed during the period of time that was the focus of the OAIC's investigation. These collected information about individuals' engagement with the Monash website, including when an individual viewed a page, the specific content they engaged with, and whether they began or submitted a webform, or booked an appointment. One pixel also enabled full URLs visited, IP addresses, and device and browser information to be transmitted to the pixel provider when users visited the website. A custom pixel was enabled on URLs containing webforms, meaning that where an individual navigated to a page relating to a specific IVF-related service, and began or completed a form on that page, that behaviour was individually tracked and transmitted. The Advanced Matching feature on the pixel, which enabled the matching of website visitors to the pixel provider's user profiles, was also active for an unknown period. The investigation identified that the URLs transmitted from the tracking pixels included pages relating to specific fertility and reproductive health services sought.

During the relevant period, Monash paid for online advertising campaigns on a number of pixel provider platforms and other digital advertisers that used the tracking pixel data collected from the website. These campaigns had target audience and demographic parameters, including individuals' interests, age range, location, and prior visits to the website within a specified period; as well as excluded audiences, based on individuals' prior interaction with Monash or particular webpages on the website.

In the twelve months before the investigation commenced, Monash ran campaigns on a social media platform relating to specific fertility and reproductive health services, including egg donation and freezing, endometriosis, IVF and sperm donation. It also created custom audience lists using other sources of customer information, including names, email addresses, phone numbers, gender and location, and uploaded these to the pixel provider's dashboard to retarget advertising to existing or known customers.

A key issue for businesses is whether data collected by tracking pixels and cookies constitutes personal information under the Act.

Medmate and Monash submitted to the Commissioner that individuals were not reasonably identifiable from the tracking pixel data because the organisations did not have access to direct identifiers such as names, passport numbers or dates of birth. The Commissioner rejected this argument, noting that the definition of personal information under the Act does not expressly require that an individual be specifically identifiable by direct identifiers. 

She instead adopted a new formulation of 'reasonably identifiable' focused on individuation rather than identification.  

Crucially, this means an organisation does not need to know, or be able to reasonably identify, the name of an individual (or other direct identifiers) to have collected their personal information. It is sufficient that the entity can use the collected information to treat that person differently on an individualised basis (such as personalised advertisements).  

Applying this standard, the Commissioner found that both organisations had collected personal information from individuals via the deployment of tracking pixels. Specifically:

• Medmate had deployed tracking pixels that captured data about website users' activity, including searches for particular medications and conditions. Pixel providers matched this data against their own platform data to identify users who were logged into their accounts. Those users were then served targeted health-related advertising based on their prior activity on Medmate's website.
• Monash had deployed tracking pixels that captured data about users' browsing behaviour on its website. That data was shared with pixel providers, which used it to serve IVF-related advertisements to female visitors aged 25–45 who had visited IVF-related pages within the preceding days and were logged into their accounts on the provider's platform.

In each case, the ability to deliver individualised advertising based on tracking pixel data was sufficient to satisfy the 'reasonably identifiable' threshold, even without the identity of targeted individuals being known to Medmate or Monash.

This interpretation of 'reasonably identifiable' goes materially further than many practitioners and organisations had understood, and the implications are significant. Organisations that have previously assumed their use of pixel data does not engage the Act—whether because they do not 'know' the individuals behind the data, or because they reviewed their practices against the November 2024 guidance and concluded they were compliant—should urgently reassess that position.

The broader implications may be even more significant. The Privacy Act Review Report specifically contemplated that individuation should remain outside the definition of personal information,² citing concerns about limiting valuable uses of data in ways that do not harm or affect the individuated person. There were also practical questions raised about how the Act's remaining protections are to apply to such data—eg how organisations are to respond to information access requests or complaints, or notify individuals of a data breach, in circumstances where the organisations are not in fact able to identify the individual.

The Commissioner's adoption of individuation as the operative test for 'reasonably identifiable' moves the Australian position closer to the European approach to personal data protection under the General Data Protection Regulation (the GDPR). The GDPR defines 'personal data' (the equivalent of personal information under the Act) broadly, as any information relating to an identified or identifiable natural person, including indirect identifiers. European regulatory guidance has long recognised that the ability to 'single out' an individual—ie to distinguish them from others and treat them differently—is itself sufficient to render data personal data, even where the individual's name and/or other direct identifiers are not known. By adopting individuation as the threshold for 'reasonably identifiable', the Commissioner has brought the Australian position materially closer to this European standard without the legislative reform that would ordinarily be expected to effect such a change.

While the Privacy Act Review Report (and the Government's Response) agreed in principle to making changes to the targeting of individuals using personal information, the Commissioner appears to have decided not to wait for the long-promised legislative reform.

In the Commissioner's view, the individuation interpretation of reasonably identifiable is supported by the Act's principles-based nature and the fact that the APPs are technology neutral, allowing concepts to adapt to changing technologies and evolve with the times.   

In the current regulatory environment, the Commissioner is taking a broad view of what constitutes sensitive information.

The Commissioner found that information relating to an individual's engagement with a health service provider's website is sensitive information, and that both organisations had collected sensitive information of this nature via tracking pixels. In arriving at this conclusion, the Commissioner specifically referred to:

• Use of information: Both Medmate and Monash had used the information collected via tracking pixels to retarget ads for health-related services to individuals that had previously visited their respective websites. The Commissioner considered this to be indicative of them having formed an opinion about the individual's health, a form of sensitive information.
• Kinds of information collected: The Commissioner found that the collection of particular kinds of information from individuals via tracking pixels amounted to the collection of health information (a form of sensitive information). In particular, the Commissioner considered that information about whether individuals submitted registration or contact forms (Monash), or submitted applications, requested contact, viewed particular content, added items to their cart, initiated checkout or made a purchase (Medmate), indicated further steps towards obtaining health services and was itself health information.

The determinations establish that collection of information about an individual's engagement with a health service provider's website can be sensitive information, on the basis that it either:

• reveals health information directly; or
• allows an inference or opinion to be formed about an individual's health, as website engagement demonstrates an individual's interest in the provision of a particular health-related service.

This finding has considerable practical implications for any health service provider operating a website. It means that the mere act of visiting a health-related website—including viewing pages about services, medications or conditions—is likely to be treated as health (and therefore sensitive) information for the purposes of the Act, attracting the higher protections that apply to sensitive information.

As Medmate and Monash were collecting sensitive information, they were required under APP 3.3 to obtain individuals' consent.

The determinations indicate that it will be challenging for organisations to successfully rely on implied consent in relation to the collection of sensitive information via tracking pixels.

The Commissioner was not satisfied that a cookies consent pop-up Medmate later introduced, which stated ‘[w]e use cookies to enhance your browsing experience, serve personalised ads or content, and analyse our traffic’, constituted valid consent. This was because:

• Individuals were not adequately informed: the consent pop-up did not refer to tracking pixels (which are distinct from cookies) or pixel providers, and individuals were unlikely to be adequately informed about the implications of providing consent, or the collection, use or disclosure of their personal information via tracking pixels.
• Consent was not specific: given sensitive information was involved, the level of specificity required was higher, and individuals should have been informed of the proposed collection, use or disclosure of their personal information.

The determination indicates that a generic cookies consent pop-up will be insufficient where sensitive information is collected via tracking pixels. Organisations that collect sensitive information in this way must implement consent mechanisms that are express, informed and specific, and that address tracking pixel use specifically, rather than relying on generic cookies consent language.

The Commissioner found that both Medmate and Monash failed to comply with APP 5.1, which requires an entity to take steps that are reasonable in the circumstances to notify individuals of specified matters in APP 5.2 at or before the time of collecting personal information, or, if not practicable, as soon as practicable after collection.

The Commissioner considered it was reasonable for Medmate and Monash to take steps to notify individuals of:

• the fact that the entity was collecting individuals' sensitive information via tracking pixels and the circumstances of that collection (APP 5.2(b));
• the purposes for which the entity collected the personal information—ie advertising and retargeting (APP 5.2(d)); and
• the fact that pixel data, from which an individual's health information could be inferred, was disclosed to pixel providers (APP 5.2(f)).

In considering whether Medmate and Monash took reasonable steps, the Commissioner made the following observations that will be widely applicable to businesses that use tracking pixels:

• The publication of a privacy policy in isolation is insufficient to notify individuals of the collection of their personal information.
• An organisation's privacy policy should contain accurate, up-to-date information regarding the use of tracking pixels.
• Where tracking pixels are used upon entering a website, individuals should be notified when they enter.
• Notification could take the form of a banner or pop-up, which should provide notice of relevant APP 5.2 matters or direct individuals to where more detailed information is located.

Businesses should ensure that they have appropriate measures in place to notify individuals of the use of tracking pixels and cookies to collect personal information, and that they are not relying on their privacy policy alone to notify individuals. At a minimum, organisations should make sure to notify individuals:

• that their personal information (or sensitive information where appropriate) is being collected via tracking pixels and the circumstances of collection;
• of the purposes for which they collect the personal information; and
• that this personal information was routinely disclosed to pixel providers.