On 11 June 2026, the Office of the Australian Information Commissioner (OAIC) published two determinations against Medmate Australia Pty Ltd (Medmate) and Monash IVF Pty Ltd (Monash IVF), finding both entities interfered with individuals’ privacy via the use of website tracking pixels.

In the absence of an express regulatory framework for tracking technologies in Australia, the two determinations confirm that the concept of what constitutes personal information must be interpreted broadly. The Australian privacy regime may apply in full where tracking pixels are used and, where health or other sensitive information is collected (e.g. where certain information can be inferred from an individual’s browsing activity), consent is required.

The determinations

Medmate and Monash IVF, both health service providers, were found to have breached Australian Privacy Principles (APPs) 3.3, 5.1 and 7.1 of the Privacy Act 1988 (Cth) (Privacy Act) in relation to their deployment of tracking pixels.

The determinations confirmed that the use of tracking pixels involved a “collection” of personal information under APP 3 and, in the case of the two entities in question, a collection of health information. The Commissioner found that:

  • Transmission of pixel data across a third-party server constitutes creation of a “record” for the purpose of the Privacy Act.
  • Browsing a health service provider’s website reveals health information (or allows inferences about health to be drawn) which constitutes sensitive information under the Privacy Act. The use of tracking pixels by both Medmate and Monash IVF to retarget health-related ads suggests that both respondents made inferences that visitors to their respective websites were experiencing certain health issues.

The OAIC also noted that pixels are distinct from cookies, which can be removed or configured at the discretion of the user. As such, cookie consent pop-ups will not constitute valid consent for the use of tracking pixels. Cookie banners are also not sufficient to notify website visitors of information relating to the collection of their personal information via tracking pixels, as required under APP 5.2.

Both entities were ordered to cease use of tracking pixels until appropriate consent mechanisms were implemented, and to destroy sensitive information held in pixel provider dashboards.

Tracking pixel use in the health sector

Separately to the determinations, the prevalence of pixels has been on the OAIC’s radar for some time. In a related blog post dated 24 June 2026, the Privacy Commissioner published the results of a scan of 50 health service providers’ websites conducted in October and November 2024. The findings underscore that use of tracking technologies in the health sector is widespread and poorly governed: 96% of websites scanned used tracking technologies, and 52% used at least one third-party tracking pixel.

The OAIC expressed particular concern that pixels are sometimes deployed without the health service provider’s awareness. Where providers were aware of their usage, some were under the under the (false) impression that web browsing data was de-identified, hashed or pseudonymised such that privacy obligations did not apply.

Key takeaways

As a result of these determinations, businesses subject to the Privacy Act are recommended to:

  • Audit their websites for tracking pixels. The OAIC’s website inspection indicated that entities may be unaware of which tracking technologies are deployed on their websites, particularly if marketing teams have installed pixels without oversight from other parts of the business.
  • Assess the sensitivity of data collected via tracking pixels, specifically the inferences that can be drawn from browsing activity.
  • Configure tracking pixels to minimise the collection of personal information and, if there is a chance that sensitive information may be collected, consent must be obtained.
  • Ensure that their privacy policies accurately describe the use of tracking pixels, the types of information collected, and the third parties to whom information is disclosed.
  • Separately to privacy policies, consider how individuals will be informed of the collection of their personal information via tracking pixels. A pop-up or form of collection notice addressing the matters required under APP 5.2 should be provided to individuals immediately upon visiting a website, separate from cookie banners.
  • Conduct a privacy impact assessment before deploying tracking pixels, particularly for websites relating to health or other services where browsing activity may reveal sensitive information.