Tracking Pixels on Your Website and Your Privacy Obligations

Tracking pixels are one of the most common tools in online advertising. They sit quietly on a web page and report back on what visitors do. Many businesses add them so they can measure ads and show offers to people who have already visited. Few stop to think about the privacy side.

The Office of the Australian Information Commissioner published guidance on tracking pixels in November 2024. It is aimed at private sector organisations that use them on their websites. The message is clear. If you put a pixel on your site, responsibility for using it properly sits with you.

What a tracking pixel is

A tracking pixel is a piece of code from another company that you place on your website. When someone loads a page with the pixel, it collects data about their activity. That data is sent to the provider’s server. The visitor usually has no idea it is happening.

Businesses use pixels for a few reasons. They help analyse website traffic and measure whether a campaign worked. They also let you target ads to visitors on other platforms. The OAIC explains that the platform can match the data with its existing users, so those people later see targeted ads.

If you have followed advice on using Facebook for your business, you may already have a pixel installed. Social platforms often suggest adding one early. That makes it worth checking what your site is already sending and to whom.

Does the Privacy Act apply to your business?

The Privacy Act does not cover every business. The OAIC says a small business with an annual turnover of $3 million or less is generally not covered. Turnover here means income from all sources. It does not include assets held, capital gains or proceeds from capital sales.

Some smaller businesses are covered no matter what they earn. The OAIC list includes health service providers and businesses that trade in personal information. It also includes contractors providing services under a Commonwealth contract, among others. A small business can also choose to opt in to the Act.

You can read the full list on the OAIC page about small business and the Privacy Act. Even if your business sits outside the Act, the guidance is a sensible standard to follow. Customers tend to trust businesses that are open about how they use data. The OAIC itself notes that greater consumer confidence and trust is one benefit of opting in.

Pixel data can be personal information

Personal information under the Act covers people who are identified or reasonably identifiable. It can include technical and inferred information. The OAIC says data such as IP addresses, page addresses or hashed email addresses can count. That depends on whether it can be linked to other data the platform holds.

Both your business and the pixel provider may have obligations for that information. It is not always obvious whether pixel data is personal information. For that reason, the OAIC strongly encourages organisations to err on the side of caution. In practice, that means treating the data as personal information unless you are confident it is not.

Check the pixel before it goes live

The OAIC expects organisations to understand how a pixel works before using it. You should identify the privacy risks and put steps in place to manage them. Provider terms often place compliance responsibility on the customer. So read the contract and keep an eye on any changes to it.

A Privacy Impact Assessment is one way to do this well. The OAIC links it to privacy by design. Useful questions include what data is collected and how the provider uses it. You should also ask whether the data goes overseas and how long it is kept.

This kind of planning is easiest at the start of a project. If you are building your first website, decide early which tracking tools you need. It is far simpler than removing data flows after launch. The OAIC is also clear that due diligence should not be a set and forget exercise.

Collect only what you need

Under Australian Privacy Principle 3, collection must be reasonably necessary for your business functions. The test is objective, so you must be able to justify it. The OAIC suggests looking at less intrusive options first. First party email marketing to people who have given consent is one example.

The guidance also recommends data minimisation. Configure the pixel to collect the least data needed for your purpose. You might only place it on certain pages rather than across the whole site. Fewer pages and fewer data points mean less risk.

Take extra care with sensitive information

Sensitive information includes details such as health or religious beliefs. Collecting it requires consent, which the OAIC says should generally be express opt in consent. Pixels should be set up so they do not send sensitive information to platforms. On some pages, simply visiting can reveal something sensitive, such as a mental health service page.

For those pages, the OAIC suggests avoiding pixels entirely. This matters for health, counselling and similar businesses. Many of these are covered by the Act regardless of turnover. A careful page by page review is worth the time.

Tell people what you are doing

Pixels are invisible, so transparency is important. The OAIC says it would usually be unfair to collect personal information covertly without the person’s knowledge. Under APP 5, you should take reasonable steps to notify people at or before collection. That may include naming the pixel providers and any overseas recipients.

A banner or pop up that links to fuller privacy information is an accepted method. Your privacy policy also needs to be clear and current under APP 1. It should disclose that you use pixels and what kinds of information they collect. It should also explain why you handle that information.

Targeted ads are direct marketing

Using pixel data to show ads to people on other platforms is direct marketing. The OAIC says this must comply with APP 7. You can only use data in ways people would reasonably expect. You must also give a simple way to opt out and stop when someone asks.

The OAIC says organisations should let website users opt out of targeted ads that use tracking pixels. Again, a banner or pop up is one example of how to offer this. Sensitive information can only be used for direct marketing with consent. If the provider sends data overseas, APP 8 also requires reasonable steps so the recipient does not breach the principles.

None of this means you have to abandon online advertising. It means planning campaigns with privacy in mind from the start. Our social media marketing tips for beginners cover the basics of reaching people on these platforms. Combine those ideas with clear notices and simple opt outs.

Review your pixels regularly

Websites change over time and so do pixel providers. A pixel set up years ago may now collect more than you realise. The OAIC recommends regular reviews of how pixels are deployed. It also suggests considering marketing channels that are less intrusive on privacy.

A yearly check is a simple habit to build. List every pixel on your site, what it collects and why you still need it. Remove anything you no longer use. Looking back at the highs and lows of social media marketing shows how quickly platforms and their tools change.

Frequently asked questions

Is a tracking pixel always personal information?

Not always, but it often can be. Data such as IP addresses or hashed email addresses may count if it can be linked to other data. The OAIC encourages businesses to err on the side of caution.

Does the Privacy Act cover my small business?

It depends on your turnover and what your business does. Businesses with turnover of $3 million or less are generally not covered. Health service providers and some others are covered regardless.

Do I need a cookie banner for pixels?

The OAIC says you should take reasonable steps to tell people about pixels. A banner or pop up linking to fuller information is one accepted method. It can also be used to let visitors opt out of targeted ads.

Can I use a pixel on a health service website?

You need to take extra care. Health information is sensitive and generally needs express consent. The OAIC suggests avoiding pixels on pages where a visit alone reveals sensitive information.

This article is general information about Australian privacy law and is not legal advice. Privacy rules and OAIC guidance can change, and other laws may also apply to your business. Speak with a qualified lawyer about your own situation.