A website is not a brochure with a few legal documents attached to the footer. In Australia, the moment a site collects a name through a contact form, sends a promotional email, or makes a claim about a product or service, separate legal obligations attach to the business behind it. Three regimes do most of the work: the Privacy Act 1988 (Cth) for personal information, the Spam Act 2003 (Cth) for commercial electronic messages, and the Australian Consumer Law (ACL), which is Schedule 2 of the Competition and Consumer Act 2010 (Cth), for the claims the site makes and the contracts it forms. Each of them applies whether or not the business set out to break the law.
The practical question for a business owner is not whether the site "should" have a privacy policy. It is which duties actually apply to the way the site operates, and whether the site is set up to meet them. This article sets out who must comply with each regime, what the duties require, what non-compliance can cost, and the checks worth running on your own site.
Who must comply: the triggers that bring your website into scope
The regimes bite at different thresholds, so the first step is working out which ones your business sits inside.
- Privacy Act: the Act applies to APP entities, including organisations with annual turnover above $3 million in the previous financial year. A business that has not yet traded for a full year is tested against its current-year turnover. Certain businesses are covered regardless of size, including health service providers that hold health information, businesses that disclose personal information for a benefit or reward, contracted service providers to the Commonwealth, and credit reporting bodies.
- Spam Act: there is no size threshold. If the business sends commercial electronic messages, meaning email, SMS or MMS with an Australian link, the Act applies to those messages.
- ACL: the consumer protections apply to conduct in trade or commerce, which effectively covers any business selling goods or services to consumers in Australia whatever its size. The unfair contract terms protections carry their own thresholds, discussed below.
A business under the $3 million mark is not off the hook for the other regimes. And being outside the Privacy Act does not make a business immune from complaints: if a site promises to handle information in a particular way and then does the opposite, the mismatch can still be costly even where the Act does not strictly apply.
Privacy duties under the Privacy Act
Where the Privacy Act applies, the Australian Privacy Principles (APPs) set the standard. For a website, four of them do most of the work.
Privacy policy: APP 1
APP 1 requires open and transparent management of personal information. An APP entity must have a clearly expressed and up-to-date privacy policy that sets out what kinds of personal information it collects and holds, how and why it collects it, how it uses and discloses it, how an individual can access and correct their information, and how they can complain about a breach. The policy must be available free of charge, which for most businesses means a link in the site footer. Failing to have a policy, or to keep it accurate, is itself a civil penalty provision under the Act.
Collection notices: APP 5
APP 5 requires an entity to take reasonable steps to notify individuals of certain matters at or before the time their personal information is collected, or as soon as practicable afterwards. Those matters include the identity and contact details of the entity, the purposes of the collection, the main consequences of not providing the information, and the usual disclosures the entity makes. This duty reaches everything a website collects directly, including contact form submissions, newsletter sign-ups, bookings, account creation and purchases, and also information collected indirectly through analytics and tracking tools.
Collecting only what is needed: APP 3
APP 3 limits collection to personal information that is reasonably necessary for the entity's functions or activities. A site that asks for more than it needs, or that collects sensitive information such as health details without consent, starts from a position of non-compliance before the data is even used.
Security and breach notification: APP 11 and Part IIIC
APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Part IIIC adds the notifiable data breach scheme. If the business becomes aware of reasonable grounds to believe there has been an eligible data breach, broadly meaning unauthorised access, disclosure or loss of personal information that is likely to result in serious harm, it must prepare a statement for the Office of the Australian Information Commissioner (OAIC) and notify affected individuals as soon as practicable.
Direct marketing duties under the Spam Act
The Spam Act regulates commercial electronic messages, which includes promotional email, SMS and MMS sent to Australian recipients. The duties are threefold, and they connect directly to the wording on a website's sign-up forms.
- Consent: a commercial message must be sent with the recipient's consent, whether express or inferred from their conduct and existing business relationship. Consent cannot be inferred merely because an electronic address has been published. Pre-ticked boxes, bundled consent buried in long forms, and wording that does not say what the subscriber is signing up for are the classic problem areas. Businesses should keep records of when and how consent was given.
- Sender identification: each message must identify the sender accurately, so recipients know who is contacting them and how to reach them.
- Unsubscribe: each message must include a functional unsubscribe facility, presented clearly and conspicuously, with the unsubscribe address capable of receiving messages for at least 30 days. Unsubscribe requests must be honoured promptly, and the fact that a recipient has unsubscribed should flow through to any other lists that business uses.
Consumer law duties under the ACL
The ACL governs what a website can say and what its terms can do. Three duties deserve particular attention.
No misleading or deceptive conduct: s 18
Section 18 of the ACL prohibits conduct in trade or commerce that is misleading or deceptive, or likely to mislead or deceive. Website copy, pricing, testimonials, savings claims and promotional messaging all count. The test looks at the overall impression a reasonable reader would take away, so a technically true statement can still breach s 18 if the way it is presented is misleading.
No false or misleading representations: s 29
Section 29 prohibits specific false or misleading representations about goods and services, including their quality, value, price, benefits, sponsorship and guarantees. Unlike s 18, a breach of s 29 is a penalty provision. Businesses should be able to substantiate any claim they publish, and the ACCC can require them to do so through substantiation notices.
Consumer guarantees and unfair contract terms
The consumer guarantees in the ACL apply automatically to goods and services supplied to consumers, and a term that purports to exclude them is void. That limits how far website terms can push risk back onto customers, whatever the terms say.
Separately, the unfair contract terms regime applies to standard form contracts, which includes most click-through website terms. An unfair term in a consumer contract or small business contract is void, and following the 2022 amendments proposing or relying on an unfair term is itself prohibited with penalties attached. A contract is a small business contract where at least one party employs fewer than 100 people or has a turnover under $10 million, so the protection reaches well beyond consumer sales.
Intellectual property duties
Copyright in Australia is automatic: original material is protected when it is created, and there is no registration system. That cuts both ways for a website. The business owns the copyright in material it creates, but it also needs to make sure that images, copy, designs, code and templates sourced from freelancers, stock libraries or other sites are actually licensed for the way they are being used. A licence that covers one use does not automatically cover republication, cropping or commercial use. Website terms can set out what visitors may do with the site's content, but they do not cure an infringement committed by the site itself.
What non-compliance can cost
The penalties across the three regimes are set by statute and actively enforced.
- Privacy Act: a serious interference with privacy can attract a civil penalty for a body corporate of up to the greatest of $50 million, three times the benefit obtained, or 30% of adjusted turnover. Individuals face up to $2.5 million. Other interferences with privacy carry penalties of up to 2,000 penalty units, currently $660,000, and the OAIC can also issue infringement notices, compliance notices and enforceable undertakings.
- Spam Act: penalties are set in penalty units, currently $330 each. A body corporate faces up to 100 units, or $33,000, for a contravention of the core prohibition on sending unsolicited messages, capped at 2,000 units, or $660,000, where multiple contraventions occur on the same day. Those caps rise fivefold where the business has a prior record. The ACMA pursues spam enforcement actively, through infringement notices, enforceable undertakings and court proceedings.
- ACL: false or misleading representations and unfair contract terms can attract penalties for a body corporate of up to the greatest of $100 million, three times the benefit obtained, or 30% of adjusted turnover, with individuals facing up to $2.5 million. On top of penalties, courts can order damages, injunctions, compensation and non-party redress, and the ACCC regularly pursues businesses over website claims.
Beyond the headline figures, non-compliance tends to surface first as customer disputes, refund demands and complaints to the OAIC, ACMA or ACCC, each of which can escalate into a formal investigation. The reputational cost of a regulator naming a business over its website practices is often the part that hurts most.
A practical compliance checklist
Run through these checks to catch the most common compliance gaps:
- Map what the website actually collects and through which tools, including forms, analytics, pixels, CRM integrations, booking systems and payment providers.
- Check the privacy policy against that map, and update it whenever a tool or feature changes.
- Review the wording on every form and sign-up box. It should say what is being collected, why, and how it will be used, and consent should not be assumed from pre-ticked boxes.
- Keep records of consent for marketing lists, and confirm every marketing email and SMS carries accurate sender identification and a working unsubscribe.
- Review the claims on the site and ask whether each one can be substantiated, including prices, testimonials, guarantees and performance statements.
- Check the website terms against the unfair contract terms rules and the consumer guarantees, particularly for subscriptions, auto-renewals and cancellation clauses.
- Confirm that images, copy, code and templates are properly licensed for how they are used.
- Schedule a review whenever the site changes materially, and at least annually.
When to involve a lawyer
A lawyer's role in website compliance is usually one of review and drafting rather than crisis response. A practitioner can compare the site's policies and terms against the way the business actually operates, identify where consent wording or disclosures fall short, redraft standard form terms to reduce unfair contract terms exposure, and advise on how the Privacy Act, Spam Act and ACL apply to a particular business model. Legal input becomes more important when a business introduces subscriptions, online payments, bookings, or new data collection, and it becomes essential once a regulator makes an inquiry or a data breach has occurred, when the timing and content of notifications matter.
The first thing to check: does your site do what its documents say?
Across all three regimes, the compliance gap that causes the most trouble is the same one: the site's legal documents have drifted out of step with what the site actually does. A business adds an analytics pixel, a CRM integration or a new marketing tool, and the privacy policy and consent wording stay where they were. The result is that the site's disclosures no longer match its data practices, and that mismatch is precisely what the OAIC, ACMA and ACCC look at first when a complaint arrives. It turns a routine inquiry into a penalty because the business cannot show its practices were ever aligned with its promises.
The first action worth taking this week is not drafting new documents. It is listing every form and tracking tool on the site, and comparing that list against the privacy policy and sign-up wording. If they do not match, that is the compliance issue to fix first, because everything else, the terms, the disclaimers, the marketing processes, builds on a site that accurately describes itself.