The Pixel Problem: Why privacy is becoming a media investment issue
Tracking Pixels and Privacy Risk
The Office of the Australian Information Commissioner (OAIC) has made tracking technologies a clear focus, with its 2026 updates to Australian Privacy Principle guidance reinforcing data minimisation requirements and addressing practices including tracking pixels and inferred information.
That direction was reinforced with the release of the Government’s second tranche of proposed Privacy Act reforms including a new fair and reasonable test for the collection and use of personal information. If enacted, organisations would increasingly need to consider not only whether data can be collected and used, but whether doing so is reasonable, necessary and consistent with what people would expect.
Its recent investigation into third-party tracking pixels has also highlighted the potential privacy risks. These can arise when organisations collect and share sensitive information with advertising platforms.
For Australian advertisers, agencies and ad-tech providers, this isn’t simply a compliance issue. It is quickly becoming a media investment issue.
A tracking pixel is a data decision
It might sound harmless: a piece of code that helps measure a conversion or optimise a campaign.
But depending on its configuration, a tracking pixel can capture information about URLs, pages visited, transactions and other online behaviour. It can then pass that information to a third-party platform. This becomes particularly important in sensitive categories, and where the context in which a pixel is placed can itself reveal or allow sensitive information to be inferred.
Consider an example from the healthcare sector. Once someone has demonstrated a clear intent to book an appointment, a tracking pixel could be doing more than simply recording that activity. Depending on its configuration, it could also transmit potentially sensitive information about that person’s interaction with the site. That information may be passed to a third-party platform.
Take something like an IVF inquiry. If someone begins but does not complete a request for information form or booking form, retargeting such as, “don’t forget to come back and send your details” may rely on information about their activity that reveals or allows an inference about their health or circumstances.
That distinction is increasingly important under Australian privacy guidance. An individual does not necessarily have to explicitly provide sensitive information. Online behaviour may also reveal sensitive information, including through the pages someone visits or actions they take online. What someone can reasonably infer will depend on the context. That makes understanding where you place a pixel, what it collects and how you intend to use that information especially important. Beyond the privacy implications, individuals may find that level of retargeting intrusive. It can also undermine trust in the brand.
The question is therefore not simply whether retargeting is effective, although advertisers absolutely need to ask that. It is also whether the data being collected, inferred, shared and used is permitted, necessary and reasonable for that purpose.
Privacy needs to move upstream
Organisations need to embed privacy considerations at the start of the process. This should not be an afterthought once media architecture decisions have already been made.
As our clients’ agency partner, we need to understand the data infrastructure sitting underneath media investment.
Organisations should ask these questions before implementing a tracking pixel:
- What information will it collect?
- Why do we need it?
- Where will it go?
- Could it reveal something sensitive?
- Can we achieve the same objective with less data?
- When should that data stop being used?
The OAIC reinforces the principle of data minimisation: organisations should only collect personal information that is reasonably necessary for their functions and activities.
In terms of media strategy, that is a powerful principle. Data minimisation can become a media planning principle: Do more with less.
That means using privacy risk to encourage greater discipline around which signals actually improve a media decision. Rather than collecting data simply because the technology enables it, ask whether it genuinely adds value.
Better privacy should mean better media strategy
This is the opportunity for the Australian advertising industry.
Privacy doesn’t have to mean inferior targeting, worse measurement or less effective advertising. It should mean more deliberate decisions about which data actually earns its place in the media plan.
That puts privacy alongside targeting, measurement and investment decisions as part of media strategy itself.
This isn’t an alert to man the panic stations. We aren’t heading towards a world without pixels, programmatic advertising, or audience data.
We’re heading towards a world where the reasons for collecting and using that data matter more. The competitive advantage may belong to the advertiser that knows exactly which data it needs, why it needs it, and when it should stop using it, and has the structures in place to govern those decisions.
Privacy is becoming part of the media plan.
