The regulator found what the policy missed.
Why your current governance framework is underestimating your true regulatory exposure.
What you'll walk away with in five minutes:
- How to spot governance gaps before a regulator does.
- A practical framework for finding AI and automation you've overlooked.
- One question to ask your executive team this week.
Also this week: Fisher & Paykel Chief Digital Officer Rudi Khoury on the enterprise AI build-vs-buy equation: what to own, what to buy, and where the real advantage actually sits.
The OAIC scanned 50 Australian health service provider websites. 52% were using a third-party tracking pixel, and 77% of those never mentioned it in their privacy policy.
Check your own policy against your own site this week.
What the regulator did
Between October and November 2024 the OAIC scanned those 50 sites for third-party tracking pixels, the small pieces of code that report a visitor's behaviour back to an advertising platform.
It published the findings on 24 June 2026 in a report called Your life, pixelated: how tracking pixels watch your every click.
The OAIC engaged 12 organisations directly, and none of them had conducted a Privacy Impact Assessment before the pixels went on.
On 11 June the Commissioner made determinations against Monash IVF and Medmate. Monash IVF was found to have contravened APP 3.3, APP 5.1, APP 5.2 and APP 7.1.
Published analyses of the determination report seven tracking pixels on the site, including a custom Meta Pixel that tracked visits to fertility web forms: egg freezing, embryo donation, genetic carrier screening.
They ran from 2012 until December 2024. The remedies were orders not to repeat the conduct and to take specified steps, with no civil penalty.
How the gap appears
A policy can be written from the business's description of its systems. A pixel can be added later in a campaign, by a vendor or elsewhere in the marketing stack. The policy is not necessarily reopened...
None of the 12 organisations engaged had run a Privacy Impact Assessment before using tracking pixels. The difference between the policy and the live system had not been formally assessed before deployment.
What December requires
What this means for business: the December requirement is a disclosure rule. The operating challenge is knowing which automated decisions are actually running across the business before you can disclose them accurately.
APP 1.7 to 1.9 commence on 10 December 2026. They require an APP entity's privacy policy to describe the kinds of personal information used by a computer program, and the kinds of decisions it makes or substantially assists, where the decision could reasonably be expected to significantly affect a person's rights or interests.
The disclosure sits in the privacy policy, the same document the OAIC has just tested against what was actually operating on health-service websites.
The pixel scan was not a test of automated-decision compliance.
It looked at health websites and tracking code, so it tells us nothing about the future APP 1.7 failure rate.
What it does show is the operating failure APP 1.7 will expose: a privacy policy can be drafted from an incomplete picture of the systems the business is actually running.
In the scan, third-party pixels were operating on sites without being disclosed in the policy. In December, the same gap matters if a qualifying automated decision is operating without being captured in the organisation's decision inventory and privacy-policy disclosure.
What Western Australia already requires
What this means for business: WA goes further than the federal rule. If your company delivers services to the WA Government, don't assume this is only a public-sector issue: depending on the contract and the statutory definition, you may already be in scope.
The main privacy provisions of the Privacy and Responsible Information Sharing Act 2024 commenced on 1 July 2026. Its Information Privacy Principles bind Western Australian public sector entities and their contracted service providers, together called IPP entities. IPP 10 applies where an IPP entity uses automated decision-making that involves personal information collected on or after 1 July 2026 to make a significant decision about a person.
Where it applies, the entity has to assess the automated process for how to eliminate or minimise the risk of harm, bias and discrimination, whether there's a process for individuals to request human intervention, and whether the handling of personal information complies with the Act. Individuals have to be told automated decision-making was used, and information about it has to be provided on request.
APP 1.7 to 1.9 work differently. They require disclosure in the privacy policy, and they create no notification duty, no right to contest a decision and no mandatory impact assessment. The OAIC's own issues paper on automated decision transparency calls the federal obligation "a less onerous obligation" than the WA regime.
A private company can be caught by the WA rules when it is a contracted service provider to WA government. Whether that applies depends on the contract and the statutory definition of an IPP entity.
The one-page decision inventory
Build the disclosure from a list. One row per decision, eight fields.
The first five fields identify and map the decisions that may need December disclosure. Fields six and seven make that work operationally. Field eight is not required by it, and it's the one I'd keep anyway.
Some automated decisions produce contested cases. Someone disputes the outcome, the model returns something the business won't stand behind, or the customer asks for review. Those cases leave the automated path and land on a person, usually in a team sized before the automation went in.
Field six is not something the December obligation requires you to describe. It tells you whether a review path exists. Field eight is what that path costs in operating capacity when a decision is contested.
Whether a particular system is captured by APP 1.7 is fact-specific, and the OAIC's guidance is still in development. The regulator has stated it intends to publish before commencement. Build the inventory as operational preparation for that guidance, and have your own adviser rule on marginal cases.
I've read the OAIC's media release, published report, and determinations register. Because the full determination text sits on AustLII, these pixel counts and dates reflect published sector analyses.
Pick one automated decision in your business this week and complete field eight: when someone contests the decision, map where it goes and who absorbs the work.
Ramon.
Continue the conversation
When AI starts to become strategic, what should your business actually own - and what should it buy?
This week's episode of the Applied AI Australia podcast is with Rudi Khoury, Chief Digital Officer at Fisher & Paykel, on Build vs Buy: The Enterprise AI Equation.
We get into focus, partnership, what to build, what to buy, and where the real value sits inside the organisation.
About Applied AI Australia
Applied AI Australia helps boards and executive teams turn AI investment into measurable business value.
We work at the point where AI meets the operating business: what to fund, what work to change, where value should land and who owns the result.
Disclaimer
Nothing in this newsletter is legal, financial or professional advice. It is research, pattern recognition and practical operating observations for Australian boards and executives. Before acting on any of it, speak with your own adviser.
Primary sources
OAIC, Your life, pixelated: how tracking pixels watch your every click, 24 June 2026; OAIC privacy determinations register, Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40 and Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41, both 11 June 2026; OAIC, APP Guidelines Chapter 1; OAIC, Automated Decision-Making Transparency Obligation issues paper; Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1; Privacy and Responsible Information Sharing Act 2024 (WA), IPP 10; WA Office of the Information Commissioner, Privacy and accountability in automated decision making.
Ready to deploy AI with confidence?
Get board-ready frameworks and strategic guidance for Australian executives navigating AI transformation.
Discuss your AI problem