In this article (6 sections)
On 31 August 2026 the Attorney-General’s Department released draft legislation for the second, and much larger, round of changes to Australia’s Privacy Act 1988. Called the Privacy Amendment (Personal Data Protection) Bill 2026, it would change how tracking pixels, targeted ads, consent forms and data breaches work for any business that holds patient information, and that includes your practice.
Consultation closed on 18 September 2026. The Bill hasn’t been introduced to Parliament and has no start date, so nothing below is law today, but the direction is clear enough to check your setup now.
What the government released, and where it’s up to
The Attorney-General’s Department consultation published two documents: an exposure draft of the Bill and a 42-page consultation paper explaining it. The paper describes roughly 40 proposals.
Two things are worth keeping in mind. First, it’s a draft: the paper says the transition and commencement provisions haven’t been settled, and feedback will shape the final text. Second, it follows the Privacy and Other Legislation Amendment Act 2024, so this is the bigger, structural part of the overhaul rather than a tweak.
Why a small practice can’t treat this as a big-business problem
Most Australian businesses turning over $3 million or less sit outside the Privacy Act. Health service providers don’t. The OAIC’s small business guidance is plain that a small business providing a health service has to comply with the Australian Privacy Principles, and that already includes a one-chair practice.
Health information is also “sensitive information” under the Act, which carries the strictest rules.
The changes most likely to touch your marketing
Tracking pixels and remarketing could need consent
The draft introduces a new idea: “trading” personal information. It covers disclosing personal information for money or other value, or for direct marketing purposes, and the Bill says an organisation must not trade without the person’s consent unless an exception applies. The consultation paper reads “for direct marketing” broadly, and gives the disclosure of cookies or pixels in programmatic advertising as an example of what it may include.
For a practice, that points straight at the Meta pixel, the TikTok pixel and remarketing tags firing on your treatment pages and booking forms. There are carve-outs, including disclosure to a “processor” acting only on your documented instructions. Whether a given ad platform counts as your processor is a question the paper doesn’t settle for every setup.
Booking pages are the riskA pixel that fires on a “thank you for booking your implant consult” page can reveal more than a page view. It can tie a person to a treatment. That’s exactly the kind of data flow this Bill is aimed at, and it’s the first tag we’d take off.
Targeted ads now count as direct marketing
The new definition of direct marketing expressly includes targeted social media advertising and online behavioural advertising based on things like browsing history, including targeting a broader audience or cohort built from personal information. Direct marketing still won’t need consent, but people must be able to opt out simply, and each communication has to explain how.
Where an advertiser and a social platform are both involved, the paper says the platform will generally be responsible for the opt-out unless it’s acting solely as a processor. If your practice uploads its patient list to Meta or to Google’s Customer Match, get advice on how the “trade” rules apply to you before you do it again.
Consent has to mean something
Consent would have to be voluntary, informed, current, specific and unambiguous. The paper says pre-ticked boxes probably won’t do, and that bundling several permissions into one tick undermines the “voluntary” part. A new-patient form that rolls treatment, recall reminders and marketing into a single signature is the obvious thing to unpick.
A “fair and reasonable” test for everything else
The current collection, use and disclosure rules would be replaced by one test: is the handling fair and reasonable in the circumstances? The factors include what a patient would reasonably expect, transparency, data minimisation, genuine choice and proportionality. Where information relates to a child, the child’s best interests must be a primary consideration, which matters for family and paediatric practices running marketing.
72 hours to report a serious breach
Under the draft, once you have reasonable grounds to believe an eligible data breach has happened, you’d have 72 hours to give the Information Commissioner a statement. Practices would also need to have breach response procedures in place, and to destroy or de-identify personal information they no longer need. Records the law requires you to keep aren’t caught by that, because the existing exceptions are retained.
Want a marketing plan built for your practice?
Tell us where you are and the treatments you want more of. A real person goes through your site and calls you back.
Get my free auditHow much this matters for a typical practice
It’s worth keeping this in proportion. If your marketing is Google Search ads, a well-kept Google Business Profile and a website without social pixels, the practical change is modest: tidier consent wording, a shorter collection notice and a written breach plan. The practices with real work ahead are the ones running Meta or TikTok remarketing off treatment pages, or uploading patient lists to ad platforms. Neither is unusual in cosmetic dentistry and implants.
None of this changes what you can say in an ad; that’s still the National Law, covered in our plain-English guide to AHPRA advertising rules covers.
What to do this month
- List every tag on your website. Google Tag Manager, Google Ads, GA4, the Meta pixel, TikTok, call tracking. Note which pages each one fires on. This is the same inventory we start with in a technical SEO review.
- Take social pixels off booking flows. Confirmation pages, appointment forms and treatment enquiry forms first.
- Unbundle your consent. Separate treatment consent from marketing consent on new-patient and online booking forms, and remove any pre-ticked boxes.
- Pause patient-list uploads until you’ve had advice. Custom audiences built from your patient database are where the “trade” rules are least settled.
- Test your opt-outs. Unsubscribe from your own recall emails and SMS and check that the request is actually honoured.
- Write a one-page breach plan. Who decides, who calls your software vendor, who notifies the OAIC.
- Rewrite your collection notice in plain English. The draft wants notices that are short and clear, not exhaustive.
If you run paid campaigns, your conversion tracking will need a look too, because remarketing audiences are built from the same tags. We cover how we set that up for practices on our Google Ads for dentists page, and the wider channel mix is in our complete guide to dental marketing in Australia.
This is a summary of a draft Bill, not legal advice. Your professional indemnity insurer or a privacy lawyer can tell you how it applies to your practice.
The short version
- The draft Privacy Act Bill was released on 31 August 2026; it isn’t law yet and has no start date.
- Dental practices are covered regardless of size, and health information is sensitive information.
- Consent would be needed to “trade” personal information, and pixels in ad tech are named as an example.
- Targeted social ads would count as direct marketing, with clear opt-outs required.
- Start now: audit your tags, unbundle consent, pause patient-list uploads and write a breach plan.
Frequently asked questions
Is the Privacy Act reform law yet?
No. The Attorney-General’s Department released an exposure draft on 31 August 2026 and consultation closed on 18 September 2026. The Bill still has to be finalised and passed by Parliament, and no commencement date has been set.
Does the Privacy Act apply to a small dental practice?
Yes. The small business exemption doesn’t apply to health service providers, so a dental practice has to follow the Australian Privacy Principles regardless of turnover. The OAIC explains this in its small business guidance.
Will I have to remove the Meta pixel from my website?
Not necessarily, but the draft would require consent before personal information is traded, and the government’s paper names cookies and pixels in programmatic advertising as an example. The safest step now is to keep social pixels off booking forms, confirmation pages and treatment enquiry pages.
Do recall reminders count as direct marketing?
A reminder about a patient’s own care is different from a promotional message, but many recall emails mix the two. If a message promotes a service, assume the direct marketing rules apply and make sure it includes a simple way to opt out.
What is the 72-hour breach rule?
Under the draft, once you have reasonable grounds to believe a serious (eligible) data breach has occurred, you’d need to give the Information Commissioner a statement within 72 hours. An incomplete statement is allowed if you can’t provide everything in time, as long as you follow up.
Want a marketing plan built for your practice?
Tell us where you are and the treatments you want more of. A real person goes through your site and calls you back.
