Does the Privacy Act apply to first-party data?

If your business is covered by the Privacy Act (generally businesses with annual turnover above $3 million, plus some smaller businesses such as health service providers and those trading in personal information), the Australian Privacy Principles apply to personal information you collect, including through websites and apps. Get legal advice on whether and how it applies to you.

Are tracking pixels a privacy issue in Australia?

They can be. The OAIC's guidance on tracking pixels says organisations remain responsible for personal information collected and disclosed through pixels on their sites, should understand what data pixels send, configure them carefully and be transparent in their privacy policies. Pixels on sensitive pages, such as health services, need particular care.

Do we need a customer data platform?

Not always. Many businesses get most of the value from a well-structured CRM, ecommerce platform and analytics, connected cleanly. A CDP helps when you have many sources and channels and need identity resolution and audience activation across them. Start with use cases, then choose tools.

How do we get customers to share more data?

Offer clear value in exchange: better recommendations, saved preferences, faster checkout, useful content or loyalty benefits. Explain what you collect and why, ask only for what you will use, and make it easy to update or withdraw. Trust and relevance work better than gated forms with many required fields.

What should a preference centre include?

Topic and channel choices (email, SMS, push), a clear one-click unsubscribe from all commercial messages, separation of transactional and marketing messages, and an audit record of each change. Preferences must sync to every system that sends messages, and unsubscribes must be honoured within five working days under the Spam Act.

Web Development6 min read

First-Party Data Strategy in Australia: Collection, Consent, Privacy and Practical Use

First-party data strategy for Australian businesses: what to collect, Privacy Act and OAIC pixel guidance, consent, architecture and use cases.

What is a good first-party data strategy?

Start with a few use cases that matter to customers and the business, collect only the data those use cases need with clear notice and choices, configure tags and pixels deliberately, store data in a governed system of record, connect it to the tools that act on it, and measure whether each use case works. In Australia, the Privacy Act, OAIC guidance on tracking pixels and the Spam Act shape what you can collect and how you can use it.

This guide is for marketing, ecommerce and product leaders in Australian businesses. It is general information, not legal advice. For connecting systems, see customer data integration; for measurement, product analytics implementation.

Key takeaways

Begin with use cases, not a data lake.
Collect the minimum data each use case needs.
Audit every tag and pixel, especially on sensitive pages.
Keep consent and preferences with the customer record.
Choose a system of record before adding a CDP.
Measure each use case against a baseline.

Use cases first

Use case	Data needed	Measure
Personalised recommendations	Browsing and purchase history, preferences	Click-through, conversion, repeat purchase
Lifecycle email and SMS	Consent status, purchases, lifecycle stage	Engagement, unsubscribes, revenue per send
Better service	Order history, support tickets	Resolution time, satisfaction
Smarter acquisition	Customer value segments	Cost per acquisition by segment
Product decisions	Feature usage, feedback	Adoption, retention

Australian privacy and marketing rules

APP 3: collect only personal information reasonably necessary for your functions; sensitive information generally needs consent.
APP 5: tell people what you collect and why at or before collection.
APP 6: use and disclose information for the primary purpose, or permitted secondary purposes.
APP 7: direct marketing rules, including an easy way to opt out.
APP 11: keep data secure and destroy or de-identify it when no longer needed.
Spam Act: commercial emails and SMS need consent, sender identification and a working unsubscribe.
Tracking pixels: the OAIC says organisations remain responsible for data their pixels collect and disclose (OAIC).
Privacy reforms are continuing; check current OAIC guidance and get legal advice.

Collect through value exchanges customers understand: accounts, saved preferences, wishlists, loyalty, quizzes and service interactions. Write plain-language notices next to forms. Record marketing consent with source, time and wording, and keep it with the customer record so every channel respects it. Audit tags quarterly: remove unused pixels, restrict what pixels send, and avoid pixels on pages about health, finances or other sensitive matters unless you have assessed the risk. See privacy by design.

Architecture

Layer	Typical tools	Notes
Collection	Website, app, POS, forms, support	Event naming plan; server-side where sensible
System of record	CRM or ecommerce platform	One customer ID; consent stored here
Analytics	GA4, product analytics, warehouse	Clear definitions and retention settings
Activation	Email, SMS, ads, personalisation	Respect consent and suppression lists
Governance	Data map, access controls, retention	Owners and review dates

Hypothetical example: an Australian homewares retailer

This example is hypothetical. A retailer relied on ad platform audiences and had a dozen pixels nobody owned. They chose three use cases: abandoned browse reminders for subscribed customers, product recommendations on site, and better order support. They removed unused pixels, limited what the remaining ones sent, added a preference centre linked to the CRM, and stored consent with each customer. Recommendations used on-site behaviour and purchase history only. Each use case had a baseline and a holdout group, and the team reviewed the data map with their privacy adviser.

Common mistakes

Collecting everything 'just in case'.
Pixels added by agencies and never reviewed.
Consent stored in one tool and ignored by others.
Buying a CDP before agreeing use cases.
No retention or deletion rules.
Claiming uplift without a baseline or holdout.

Customer data integration for consent management and identity.
Ecommerce event tracking for event plans.
Ecommerce analytics for revenue definitions.
Ecommerce personalisation for activation.
AI search traffic tracking for new acquisition channels.

Preference centres for email, SMS and push

A preference centre lets customers choose which messages they receive and on which channels, instead of a single all-or-nothing unsubscribe. It reduces opt-outs and keeps consent records clear.

Offer choices by topic (orders, offers, product news) and channel (email, SMS, push).
Keep transactional messages separate from marketing; commercial messages need consent under the Spam Act.
Make every commercial email and SMS include a working unsubscribe, honoured within five working days.
Check the Do Not Call Register before telemarketing calls, where it applies.
Sync preferences to every sending system (email platform, SMS provider, app push, CRM) quickly.
Record when, where and how each preference was given or changed.
Let signed-in customers manage preferences in their account, and others through a secure link.

Conclusion

A first-party data strategy succeeds when it starts with customer-facing use cases, collects only what those need with clear notice and consent, controls tags and pixels, keeps a governed system of record, and measures results. Australian privacy and marketing rules are part of the design, so involve privacy advice early.

Organising your customer data?

ZSpace Labs is an India-based, remote-first technology studio working with Australian and international businesses on tracking, CRM and data integrations, analytics and conversion audits and AI personalisation and automation. We are not lawyers, but if it would help to plan the technical side, we are happy to talk it through.

Start a Project

FAQ

Common questions.

Information a business collects directly from its own customers and visitors, such as account details, orders, preferences, support history and on-site behaviour. Zero-party data usually means information customers deliberately share, such as preferences in a quiz. Third-party data comes from other organisations.