Australian Privacy Act: A Guide for SEO/GEO Buyers

The Privacy Act 1988 (Cth) applies to an SEO or GEO agency the moment it collects, uses or discloses personal information connected to Australia, regardless of where the agency's office sits. That is the single most important fact for any Australian business evaluating an overseas provider, and the single most important compliance obligation for any overseas provider taking on Australian clients. The 2024 reforms, the most significant since the Act's introduction, materially raised the stakes: serious or repeated breaches now carry penalties of up to the greater of AUD 50 million, three times the value of any benefit obtained, or 30% of adjusted turnover during the breach period, whichever is largest.

For SEO and GEO specifically, this is not an abstract legal backdrop. Both disciplines routinely involve activities that intersect directly with the Act: competitive monitoring using AI tools, citation and brand-mention tracking that touches third-party websites, analytics and CRM data shared with an overseas delivery team, and third-party SaaS monitoring platforms that are themselves often US-hosted. This article works through what actually changed in 2024 and 2025, what it specifically means for SEO and GEO delivery, and the governance checklist worth applying before signing with any agency, local or overseas.

What Actually Changed in 2024 and 2025

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024, with the majority of its amendments commencing the following day, alongside a small number of provisions with delayed start dates. It introduced a three-tier civil penalty structure, replacing what had been a single, blunter penalty regime. Serious or repeated interferences with privacy, the top tier, carry the AUD 50 million or 30% of adjusted turnover penalty described above. A new mid-tier, "interference with privacy" that is not classified as serious, carries civil penalties of up to AUD 3.3 million for a body corporate. A third, lower tier of administrative infringement notices allows penalties of up to roughly AUD 66,000 per contravention for specific procedural breaches, such as maintaining a non-compliant privacy policy, without requiring full civil litigation.

Two further changes matter specifically for a digital marketing or SEO/GEO context. First, a statutory tort for serious invasions of privacy commenced on 10 June 2025, giving individuals, not just the regulator, the right to sue directly for a serious privacy invasion involving intentional or reckless conduct. Second, the reforms introduced an automated decision-making transparency requirement: organisations that use wholly or substantially automated decision-making in ways that could reasonably be expected to significantly affect an individual's rights or interests must disclose this in their privacy policy. This requirement was deliberately delayed and commences 24 months after Royal Assent, on 10 December 2026, giving businesses a defined runway to prepare rather than an immediate obligation.

APP 8 and Why Contractual Clauses Alone No Longer Protect You

Australian Privacy Principle 8 governs cross-border disclosure of personal information, and it is the single most relevant principle for any Australian business engaging an overseas SEO or GEO agency. Under section 16C of the Act, when an Australian entity discloses personal information to an overseas recipient, the Australian entity remains directly accountable for how that overseas recipient handles the data, even where reasonable contractual steps were taken to protect it. This is a meaningfully stricter standard than it sounds: post-2024 reform, a data-processing agreement alone is treated as necessary but no longer automatically sufficient. Regulators increasingly expect organisations to demonstrate actual, ongoing visibility and control over how personal data flows through the systems and vendors involved, not just a signed clause sitting in a contract folder.

A separate, narrower exception mechanism was introduced from 11 December 2024, allowing transfers to prescribed countries or binding schemes without the same additional protections otherwise required, though Australia has not extended this treatment broadly and most cross-border SEO or GEO delivery arrangements, including delivery from Indonesia, still fall under the standard APP 8 accountability framework rather than this narrower exception. For a practical Australian buyer, this means the right question to ask an overseas provider is not simply "do you have a data-processing agreement," but "can you show me how you actually restrict, monitor and can prove what happens to our data once it leaves Australia."

What This Specifically Means for SEO and GEO Work

Three categories of routine SEO and GEO activity intersect with the Privacy Act in ways that are easy to overlook because they don't look like traditional "data handling" on the surface.

Competitive research using public AI tools. When an agency uses ChatGPT, Perplexity or Gemini to conduct competitive monitoring or brand research, current OAIC guidance requires that personal information must not be entered into publicly available generative AI tools unless explicit consent is obtained or there is a legitimate purpose directly aligned with the original collection. GEO monitoring limited to brand-level and generic product or service queries, without inputting any client or competitor's personal or customer data into the AI tool itself, does not trigger this obligation. The practical rule is simple: test queries about a brand or category are fine, pasting a client's customer list or a named individual's details into a public AI chat window is not.

Citation and data scraping for tracking purposes. The OAIC has issued multiple formal determinations, including against Clearview AI, Monash IVF and Medmate, establishing that scraping publicly available information without consent can breach APP 3 (collection by fair means) and APP 5 (notification obligations) even where the underlying information was technically public. A related and striking finding from an OAIC review of health and service websites found 96% employed some form of covert tracking technology, and 52% deployed third-party tracking pixels without adequate disclosure, the basis for the Monash IVF and Medmate determinations. For GEO and SEO citation monitoring, this means tracking should stay at the brand, URL and page-structure level; scraping that extracts personally identifiable information from reviews, forums or directories carries genuine APP compliance risk.

Third-party monitoring platforms. GEO and AEO citation-tracking tools such as Otterly, Peec AI, Profound and Brandlight are typically US-hosted SaaS platforms. Sharing client analytics, contact data or customer information with these tools triggers the same APP 8 cross-border disclosure obligations described above, on top of whatever obligations already apply to the primary SEO or GEO agency relationship. The safer practice is to feed these platforms anonymised, aggregated or brand-level data only, and to disclose their use explicitly in an Australian-facing privacy notice rather than treating them as an invisible backend detail.

Opt-Out Rights and What They Mean for Retargeting

Individuals hold an unqualified right to opt out of their personal information being used for direct marketing and targeted advertising under the Privacy Act. For an SEO or GEO programme that leans on retargeting, personalised content recommendations, or any form of profiling-driven audience segmentation, this means consent mechanisms need to offer a genuine, frictionless opt-out rather than a buried setting, and cookie or tracking banners need to present neutral, non-pre-ticked choices rather than a default-to-accept pattern that technically satisfies a checkbox requirement without satisfying the spirit of the obligation. A related accountability point worth naming clearly: the OAIC has established that responsibility for privacy compliance in tracking sits with the organisation deploying the tracking script or pixel, not with the third-party pixel or SaaS provider whose code is being deployed. An agency cannot contractually hand this liability off to a tool vendor, and neither can the client hand it off to the agency without genuine oversight.

Where AI tools specifically are concerned, OAIC guidance directs organisations evaluating any commercial AI product, including the GEO monitoring and citation-tracking platforms discussed above, to assess four things before adopting it: the accuracy of the tool's outputs, its security posture, where it hosts data (which jurisdiction, and under what legal regime), and what level of access the tool's own developers have to data submitted through it. This is a more specific and more actionable checklist than "read the privacy policy," and it is reasonable for an Australian client to ask their SEO or GEO agency to walk through these four points for every third-party tool touching their data, not just take the agency's word that "everything is compliant."

Where Privacy Compliance Meets Marketing Claims

Privacy Act compliance does not sit in isolation from how an agency's performance claims are regulated. The Australian Securities and Investments Commission and the Australian Competition and Consumer Commission have both increased scrutiny of misleading digital marketing claims through 2025 and into 2026, working from the Australian Consumer Law's general prohibition on misleading and deceptive conduct. This matters for SEO and GEO specifically because performance claims, "we'll get you to page one," "guaranteed AI citations," sit close enough to consumer-facing representations that an agency substantiating its claims with real, dated evidence is doing double duty: it is good practice for winning business, and it reduces genuine regulatory exposure for both the agency and, by association, the client whose marketing the agency is producing. An agency that is disciplined about data governance and an agency that is disciplined about substantiating its performance claims tend, in practice, to be the same agency, because both disciplines come from the same underlying habit of treating evidence and accountability as non-negotiable rather than optional polish.

Does the Small Business Exemption Apply to Us?

The Privacy Act generally exempts private sector organisations with an annual turnover of AUD 3 million or less from most of its obligations. This exemption is not absolute: it does not extend to health service providers, businesses that trade in personal information, credit reporting bodies, or contracted service providers to Commonwealth government agencies, regardless of turnover. A small business exemption review has been under discussion since the government's 2023 response to the Privacy Act Review Report, which agreed in principle to eventually narrow or remove it, though as of mid-2026 no confirmed removal date has been legislated. A separate, targeted expansion took effect from 1 July 2026, bringing real estate agents, lawyers, accountants, conveyancers and precious metals dealers under the Act through anti-money-laundering reforms, regardless of turnover.

The practical implication for a smaller Australian business engaging an SEO or GEO agency is that even where the client itself sits under the AUD 3 million threshold and is technically exempt, a responsible agency should still apply APP-aligned practices as standard, both because client turnover can change and because most SEO/GEO agencies, including any handling data at meaningful scale, are unlikely to qualify for the exemption themselves regardless of their client's size.

What Enforcement Actually Looks Like

Two recent enforcement outcomes illustrate that this is not a theoretical risk. Meta Platforms settled for AUD 50 million in December 2024 over the Cambridge Analytica data breach affecting more than 300,000 Australians, following Federal Court proceedings the OAIC commenced back in March 2020, a reminder that these processes can run for years before resolution. Separately, Australian Clinical Labs received the first-ever civil penalty issued under the Act, AUD 5.8 million in October 2025, for failing to adequately protect the health information of 223,000 individuals following a 2022 cyberattack, with roughly AUD 1.6 million of that penalty attributed specifically to Notifiable Data Breach scheme failures rather than the underlying breach itself. The OAIC has also demonstrated it will run proactive compliance sweeps rather than waiting for complaints, reviewing around 60 entities in a January 2026 review cycle.

Under the Notifiable Data Breaches scheme, an organisation that identifies unauthorised access, disclosure or loss of personal information likely to result in serious harm has up to 30 days to complete a reasonable assessment of whether the breach qualifies as notifiable, then must notify the OAIC and affected individuals as soon as practicable. This is considerably less prescriptive than the GDPR's 72-hour notification requirement, but "as soon as practicable" has been interpreted narrowly enough in practice, as the Australian Clinical Labs case shows, that treating it as a soft deadline is a genuine risk.

More Reform Is Coming, Not Finished

The 2024 amendments are widely described in Australian legal commentary as a first tranche, not the complete reform programme. The Attorney-General's Department's original Privacy Act Review Report, released in February 2023, set out 116 proposed changes; the government's response agreed to 38 of them outright, agreed "in principle" to a further 68, and rejected only 10. The 2024 Amendment Act implemented a relatively small subset of the fully "agreed" items, meaning a substantial number of "agreed in principle" changes, including a possible direct right of erasure and data portability rights broadly comparable to the GDPR, which Australian law currently lacks entirely, remain outstanding. Government and legal commentary through 2025 and into 2026 consistently flag a second reform tranche as likely during 2026, though without a confirmed legislative timetable as of this writing. For any business or agency building a Privacy Act compliance approach now, the practical lesson is to treat the current framework as a floor that will keep rising rather than a fixed target, and to build governance processes with enough flexibility to absorb further tightening rather than optimising narrowly for exactly what the 2024 Act requires today.

A Practical Governance Checklist

An Australian business evaluating any SEO or GEO agency, whether based locally or overseas, should be able to get clear answers to five questions before signing. Where is our data actually processed, and can the agency name the jurisdiction rather than describing it vaguely as "secure cloud infrastructure"? What third-party tools touch our data, and are they disclosed in a privacy notice we can read? What happens to our data if the engagement ends, is it deleted, returned, or does the agency retain it indefinitely? Does the agency have a named point of contact for a Notifiable Data Breach event, and a documented process for it? And finally, does the contract include explicit APP 8 clauses, not generic confidentiality language repurposed from an unrelated jurisdiction's template? An agency that answers all five clearly and specifically is treating Privacy Act compliance as infrastructure. An agency that answers vaguely is asking the client to carry accountability risk it hasn't priced in.

Frequently Asked Questions

Does using an overseas SEO or GEO agency automatically breach the Privacy Act?

No. Overseas delivery is entirely legal and common. What the Act requires is that the Australian client remains accountable for how the overseas recipient handles the data, which means the contract, data-processing agreement and the overseas agency's actual practices all need to genuinely support APP compliance, not just exist on paper.

Can our agency legally use ChatGPT for competitor research on our behalf?

Generally yes, for brand-level and category queries that don't involve entering personal information about identifiable individuals into the tool. The obligation is triggered by what data goes into the AI tool, not by using AI tools for research at all.

What's the difference between the statutory tort and a Notifiable Data Breach claim?

The statutory tort, effective from 10 June 2025, lets an individual sue directly for a serious, intentional or reckless invasion of privacy. The Notifiable Data Breach scheme is a regulatory notification obligation owed to the OAIC and affected individuals, and does not itself create a right for an individual to sue; the two are separate mechanisms that can both apply to the same incident.

Are we required to disclose automated decision-making in our marketing right now?

Not yet. That specific disclosure requirement was deliberately delayed and commences 10 December 2026, 24 months after the amending Act's Royal Assent, giving businesses a defined period to prepare rather than an immediate obligation.

Does the AUD 3 million small business exemption mean we can ignore all of this?

Not safely. The exemption doesn't cover health-related data, businesses that trade in personal information, or several other categories regardless of turnover, and a government review has signalled intent to narrow the exemption over time. Applying APP-aligned practices as standard protects against both current exceptions and likely future changes.

Arfadia builds Privacy Act-aligned data governance into every Australian engagement from the first proposal, a named data-handling approach, an APP 8-mapped data-processing agreement, and Notifiable Data Breach incident-response support, treated as standard infrastructure rather than a paid add-on. Tessar Napitupulu writes about privacy and governance as a GEO trust signal, not just a legal formality, in Cited or Silent, free to read with email registration. This deep dive pairs directly with Arfadia's GEO agency service for Australia and SEO company service for Australia, both built around this same governance approach.