Tracking Pixel Privacy Compliance Checklist

Following the OAIC’s June 2026 determinations against Monash IVF and Medmate Australia, which found both organisations breached the Privacy Act through their use of third-party tracking pixels, it’s clear that pixel tracking is now a regulatory priority. Both cases shared the same core failures: collecting sensitive information without consent, failing to notify individuals at the point of collection, and using pixel data for direct marketing without proper consent. These issues extend well beyond the health sector and are relevant to most Australian organisations running websites with third-party tracking technology.

This checklist distils the key obligations arising from those determinations into ten practical steps, covering everything from auditing existing pixels and conducting privacy impact assessments, to configuring pixels for data minimisation, implementing adequate collection notices, updating privacy policies, and managing marketing agency and vendor relationships. It’s designed as a working tool for organisations to benchmark their current pixel use against the APPs and identify gaps before they become compliance issues.