Tracking pixels, analytics and the Privacy Act: what apps and portals can track

Why did pixels on logged in pages become a regulatory problem?

Because a pixel on a logged in page can send a third party platform information that is tied to a real, identifiable person, often including what they are doing and why. On a public marketing page, a pixel mostly learns that someone visited. Inside an app or portal, it can learn which condition someone is booking for, which loan they applied for, or what they typed into a form.

The OAIC published guidance on tracking pixels and privacy obligations on 4 November 2024. It describes how a pixel loads on a page and sends data such as form inputs, IP address, geolocation, items viewed and URL information to the provider’s server, where the platform can match it to its own users. Its key points: the Privacy Act doesn’t prohibit pixels, but organisations must do their own due diligence, configure pixels to collect the minimum necessary, keep sensitive information out, and be transparent. The OAIC also notes that many pixel providers’ terms place responsibility for compliance on the customer, meaning you.

The guidance focuses on websites, but a footnote says pixels are also used in apps, emails and other channels and that organisations should consider the guidance there too. For product teams, that covers in app analytics SDKs as well.

When is analytics data personal information?

Analytics data is personal information when it is about a person who is identified or reasonably identifiable, and that bar is lower than many teams assume. A person doesn’t need to be named.

The OAIC says an individual can be reasonably identifiable where information collected through a pixel, such as an IP address, URL information or a hashed email address, can be linked or matched with other information held by the third party platform. In that case both your organisation and the platform have obligations. Where it is unclear, the OAIC encourages organisations to err on the side of caution and comply.

Common ways analytics leaks identity in apps:

• User IDs, email addresses or phone numbers sent as event properties.
• URLs that contain names, record numbers or search terms, such as /patients/1234/notes or ?q=bankruptcy+advice.
• Form field values captured automatically by “autocapture” or session recording features.
• Hashed emails sent for ad matching. Hashing doesn’t make the data anonymous if the platform holds the same hash.

What should health, finance and other sensitive pages never send to Meta or Google?

Sensitive information should not reach third party advertising platforms through pixels, and on some sites even a page view reveals it. Sensitive information under the Privacy Act includes health information and information about racial or ethnic origin, political opinions, religious beliefs and other categories.

The OAIC’s guidance is direct. Sensitive information can only be collected with consent; organisations should generally seek express opt in consent if it is likely to be collected and disclosed through a pixel; and pixels should generally be configured to prevent its collection and disclosure. It gives the example of a flight booking where a special assistance request reveals a hearing impairment, and notes that merely visiting a mental health or counselling site can reveal sensitive information. In those cases, it says avoiding third party pixels may be preferable.

Page or event	Advertising pixel?	Product analytics?
Public marketing pages	Possible, minimised, disclosed	Yes
Sign up started or completed	Possibly a conversion event with no personal data	Yes
Logged in dashboard	No	Yes, without identifiers in URLs or events
Condition, diagnosis or treatment pages	No	Aggregate only, no condition detail in events
Loan, hardship or debt pages	No	Aggregate only
Forms with free text	No	Never capture field values

How do server side tagging, consent and minimisation help?

Server side tagging moves the decision about what each vendor receives from the visitor’s browser to a server you control. That makes minimisation enforceable rather than hopeful.

Google describes server side tagging in Tag Manager as processing data on a server you control rather than in the user’s browser, with clients that receive data and transform it into events before tags send it on. In practice, the browser sends one first party request; your server strips IP addresses, user IDs, query strings and anything else not needed, and forwards only approved fields to each vendor. A browser pixel, by contrast, sends whatever the vendor’s script collects.

Server side tagging doesn’t make tracking lawful on its own. You still need to:

1. Minimise. Send only the fields each purpose needs. The OAIC suggests considering deploying pixels only on certain pages rather than the whole site.
2. Get consent where it is required, especially before any sensitive information is involved.
3. Offer an opt out from targeted advertising. APP 7 applies to targeted online ads using personal information, and the OAIC gives a banner or pop up on first visit as one way to provide notice and an opt out.
4. Consider overseas disclosure. If the vendor sends data offshore, APP 8 requires reasonable steps to ensure the recipient doesn’t breach the APPs.

Which privacy respecting product analytics tools fit?

First party and privacy focused tools reduce what leaves your control, but you still decide what you collect, and the obligations remain yours.

Option	How it limits personal data	What to check
Plausible	Says it uses no cookies or persistent identifiers, counts unique visitors with a daily rotating salted hash, and doesn’t store raw IP addresses	Hosted in the EU, so data goes offshore; custom properties you add can still carry personal data
PostHog Cloud	Provides controls over collection, processing and storage; offers an EU cloud in Frankfurt	Its docs say deciding what you collect is your responsibility; review autocapture and session recording settings
Self hosted analytics	Data stays in infrastructure you choose, which can be an Australian region	You operate, secure and back it up
Google Analytics 4	Google says GA4 doesn’t log or store IP addresses	Event and URL data is still processed by Google; keep personal data out of both

For most apps, the useful questions are about features and funnels, not individuals: which screens are used, where people drop out, how long tasks take. Those can be answered with events that carry no personal information at all. Our data analytics service builds measurement on that basis.

What do the statutory tort, the children’s code and further reforms change?

They raise the stakes for careless tracking without changing the core rules above.

• Statutory tort. The OAIC confirms changes introducing a statutory tort for serious invasions of privacy commenced on 10 June 2025. It allows individuals to sue, and it isn’t limited to organisations covered by the APPs.
• Children’s Online Privacy Code. The OAIC says the code must be finalised and registered by 10 December 2026. It consulted on a draft from 31 March to 5 June 2026. Apps and services likely to be accessed by children should expect stricter rules on tracking and profiling.
• Further reform. The Attorney-General’s Department released an Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026, with submissions closing on 18 September 2026. The department says the Bill remains subject to further consideration by government, so treat its content as a direction of travel, not law.

Community expectations point the same way. The OAIC cites its 2023 community attitudes survey, in which 84% of Australians saw targeted advertising based on sensitive information as unfair and unreasonable.

For the AI side of the Privacy Act, see the Privacy Act and AI. For coverage questions, see does the Privacy Act apply to small business software.

What should your privacy policy and collection notices say?

Your privacy policy must clearly disclose your use of third party tracking pixels, and your collection notices must tell people at or before the time of collection. The OAIC treats these as separate obligations under APP 1 and APP 5.

Cover, in plain language: which tracking and analytics tools you use, what kinds of personal information they collect, why, which providers receive it, whether it goes overseas and to which countries, and how to opt out of targeted advertising. Update it whenever you add a tool, and make sure the in app notice matches what the code actually does.

An audit checklist for an existing app

Run this with a developer, a product owner and someone who owns privacy.

• List every pixel, tag, SDK and analytics script in the web app and mobile apps, including those added through a tag manager.
• Record which pages and screens each one loads on.
• Capture the actual network requests each sends, using browser developer tools or a proxy, on public and logged in pages.
• Look for personal information in URLs, page titles, event names and properties.
• Check whether autocapture or session recording captures form inputs.
• Remove advertising pixels from logged in and sensitive pages.
• Confirm consent and opt out flows work, and that tags respect them.
• Check where each vendor stores data and whether APP 8 steps are documented.
• Review each vendor’s terms for who carries compliance responsibility.
• Update the privacy policy and collection notices to match.
• Set a review date. The OAIC says due diligence shouldn’t be “set and forget”.

If the audit finds personal information has gone somewhere it shouldn’t, assess it against the Notifiable Data Breaches scheme.

How AWLabs approaches analytics in apps

We design analytics into the apps and portals we build from the start: first party events with no personal information by default, server side forwarding where third party tools are needed, no advertising pixels on logged in pages, and Australian hosting where the data warrants it. We can also audit an existing app against the checklist above. We start with a Development Consult, then a paid Discovery Audit, credited in full against the build, and price the work as a fixed price Schedule of Work with three options: The Minimum, The Recommended and The Complete. Senior engineers lead every build. We build to your requirements and provide evidence; your compliance remains yours, and this page is general information, not legal advice. See data analytics.