You might have heard a lot about online privacy in the last few months. I certainly have. In April-May, I completed ADMA’s ‘Cookies Masterclass’. Our browsers and devices are getting smarter at blocking all types of tracking, and this masterclass delved into the implications for online marketing.

In Australia, the Privacy Act is being reviewed ‘to better empower consumers, protect their data and support the digital economy’. Questions around online privacy have been driven in part by personalised advertising and marketing.

The Australian Attorney General’s Department released a discussion document in October. It covers questions and submissions being considered in the review. This gives some insights into what might be coming.

According to the Deloitte Australian Privacy Index 2021, 65% of respondents were unhappy about receiving targeted advertising based on their online activity. So, while advertisers find that targeted advertising works, people on the receiving end don’t love it.

The unease around targeted advertising has prompted these kinds of questions in the review:
Should we extend the definition of personal information to include data such as our device IDs and geo-location, since these can be used to single us out and target us with advertising?
When is it okay for organisations to infer our preferences from our web browsing and store that information (known as ‘profiling’)?

If you are a small business owner, you’d be partly right to think that this doesn’t really concern you. This is because businesses with less than $3 million annual turnover are exempt from the Privacy Act in Australia. There are exceptions to that exemption – healthcare businesses, for example, are not exempt.

You also have privacy-related obligations when you use services such as Google and Facebook for advertising and tracking. Generally this involves publishing a privacy policy on your website and stating how you use cookies associated with your use of these services. See ‘Is your Privacy Policy up to Speed?‘.

I believe that any business that conducts online marketing should try to keep on the right side of what their customers would reasonably expect from them.

The current law places a lot of responsibility on the individual to protect their own privacy. We have to read privacy notices and give consent when needed. We all know that this doesn’t really work. The notices are nearly impossible to understand and, usually, the only options are to accept the terms or not use the service.

In the future, there may be more onus on organisations handling personal information to:

• state clearly the how the data will be used (not just the primary purpose)
• disclose the types of third-party organisations with whom the data may be shared (not just ‘our partners’, which could mean anything).
• ensure that privacy notices are ‘clear, current and understandable’. Standardised formats and icons may be required.

[UPDATED SEPTEMBER 2020] If you are a healthcare business owner, you are probably well aware of the Australian Privacy Principles and your obligations relating to these. All private health service providers, irrespective of size, must have a Privacy Policy describing how they manage people’s personal information. Your policy will state how you comply with the areas covered by the 13 Privacy Principles. For example:

• What personally identifiable data are you collecting and for what purpose?
• How do you collect this data?
• How do you keep it secure?
• When do you share or disclose personally-identifiable data?
• What measures are taken to ensure the accuracy of data?
• How your customer can access the data you hold about them and ask for corrections to be made.

You may be less familiar with the need to update your Privacy Policy when you start using analytics on your website. Google Analytics is the tool of choice for most people who want to start understanding website traffic and whether the website is achieving its goals.

Your Privacy Policy is about being transparent with your audience but also about compliance, so this article provides an overview and includes links to source documents. Please get a legal opinion to clarify the requirements for your specific situation.

The Google Analytics terms of service specify that you need to post a Privacy Policy. It needs to cover:

• You must say that you are using cookies (Google Analytics places cookies on the user’s browser to track visits to your website).
• You must say that you are using Google Analytics and how it collects and processes data. Google suggests pointing to their own description of this by linking to their article “How Google uses information from sites or apps that use our services”.

There are extra requirements if you have switched on Advertising Features within Google Analytics. In this case Google Analytics is collecting data about your visitors from advertising cookies on their browser, if those cookies are present. This enables extra advertising-related reporting. The Demographics and Interest Reports fall under this ‘advertising-related’ category.

Remarketing is another Advertising Feature (separately enabled), and allows you to create remarketing audiences within Google Analytics based on people’s behaviour on your website and their demographics and interests.

If you have enabled Advertising Features, your Privacy Policy needs to include:

• The Google Analytics Advertising Features you’ve implemented.
• Information about how cookies and identifiers are being used – including advertising cookies or other cookies set by your partners when someone visits your website.
• How visitors can opt-out of Google Analytics Advertising Features. For example, through Ads Settings on their browser, Ad Settings for mobile apps, or through Advertising opt-out services.

See Google’s Policy Requirements for Google Analytics Advertising Features.

Google also encourages website owners to link to their information on Google Analytics opt-out browser add-ons. These can be installed by anyone to prevent their data from being used by Google Analytics.

You are not allowed to send any personally-identifiable information to Google Analytics. This might occur in a scenario where a person fills out forms or logs on to your website, and the page URL subsequently includes a name or other personally-identifiable information. This kind of information must be removed before the data is sent to Google Analytics.

Google Analytics terms of service also requires that you “will comply with all applicable laws, policies and regulations relating to the collection of information from Users”. this means not just local privacy laws, but also any other applicable laws. Some of these can be far-reaching …

Things get more complex if you are an Australian business that either collects personal information from residents of Europe, or has a website that is accessed by residents of Europe. In this case, the GDPR (General Data Protection Regulation) applies to you.
GPDR applies for countries in the European Economic Area (EEA). The UK also enacted very similar laws after Brexit.
GDPR has additional compliance requirements, both in terms of the consents you obtain from website visitors (including opt-in consent when your website sets cookies on the user’s browser) and your Privacy Policy. Make sure you understand your legal position.
I have seen it suggested that, if you do not want to do business with people in the EEA, it is a good idea to include statements on your website saying that you do not offer services to people in these countries and you do not accept sign-ups to your email list from them.

You’ll need to display your Privacy Policy on your website if you are using website analytics. It could be a menu item or a link from your header or footer.
Make sure your staff are familiar with your Privacy Policy and understand what it means for their day-to-day job roles. It’s a great topic for a staff meeting discussion or training refresher.

Get in touch to find out whether your Google Analytics implementation is in good shape. Work on your analytics and learn at the same time by choosing a ‘done with you’ service.