Keynote address
Good morning and thank you for the opportunity to speak today.
Before I start, I would like to acknowledge the Gadigal of the Eora Nation, the traditional custodians of this land and pay my respects to the Elders both past and present. I’d also like to extend that respect to any Aboriginal and Torres Strait Islander peoples here today.
We have a happy coincidence of events today in that I have the pleasure in announcing the release of one of our flagship publications – The 2026 Australian Community Attitudes to Privacy Survey.
This is a national survey we carry out every 3 years that monitors Australians’ attitudes to privacy, experiences of privacy risks and misuse of personal information, and expectations of organisations and government. It is the most comprehensive reference guide to what Australians are thinking about privacy and one that is constantly referred to by the privacy community, civil society, government and the community.
There is another coincidence of events in that this marks the 25th anniversary – the silver anniversary – of our the first ACAPS Report in its current form. That’s a demonstration of its longevity and its continuing relevance.
While 25 years may seem a long time ago – and that year, 2001, was of course marked by the tumultuous events of September 11 – I’m struck by many of the similarities in concerns.
In the 2001 survey, we find a strong desire among the community to gain control over how their personal information was used with more than 9 in 10 people wanting businesses to seek permission before using their personal information for marketing.
Respondents also spoke about the risks of internet cookies and the use of data matching by government to reduce welfare abuse – subjects that are still of significant concern.
Our 2026 survey found that Australians’ expectations about privacy continue to sharpen as the information ecosystem becomes more complex, data-intensive and difficult to navigate.
It is certainly a dynamic international environment in which we operate. One only has to look at the headlines – particularly around artificial intelligence. We have the debate over Anthropic’s new AI model – Mythos – that has taught itself to hack into software infrastructure systems believed to be among the most secure in history. We have two prominent AI researchers publishing a book – “If Anyone Builds it, Everyone Dies”. That’s worth an intake of breath!
The other week it was reported that a Melbourne psychiatrist has refused new patients unless they agree to allow her to use an AI scribe to transcribe the conversations in their sessions. Over in South Korea, shoppers are using facial recognition technology to pay for their purchases.
It’s heady stuff and if these issues were being discussed 25 years ago it was in the pages of science fiction novels. As a regulator, it requires a determined effort to isolate the signal from the noise and focus on what actions will make the most positive impact for Australians.
The 2026 ACAPS points to a community that places a high value on privacy but does not consistently experience privacy protections as workable in practice. Trust is uneven across sectors, and wariness of emerging technologies is increasing, particularly in terms of fairness, accountability and the practical ability to exercise rights. Australians want greater transparency, more proportionate collection of personal information, and a fairer go when using digital services.
ACAPS 2026 also explores issues including perceptions of consent and control, fairness and proportionality in collection and use, complaint and dispute resolution, support for deletion/erasure, and attitudes to AI and biometric uses involving personal information.
Some of the headlines:
- 93% said protecting their personal information is really important to them, and 87% told us they're more concerned about their privacy today than they were 5 years ago.
- Australians don't feel they have genuine choice and control when it comes to their personal information. 67% of people told us they didn't feel that handing over personal data was a genuine choice and more than half of people said they agreed to hand over their personal information, because if they didn't, they'd miss out on essential services or opportunities.
- Over the past year, 73% of Australians have experienced at least one privacy concern, that's up from 64% in 2023. A third of Australians were notified their personal information was involved in a data breach. And of those who were, 62% experienced scams in the aftermath.
- Only 10% of people think organisations handle their data fairly, and 9 in 10 told us they didn't want their data collected for one thing to be used for another without their consent, like targeting ads, training AI models, or being sold onto third parties. But the good news is, 68% of people told us they'd be more likely to use digital services if their data was handled fairly.
- Consent often doesn’t feel like a genuine choice. 65% say sharing information rarely or never feels like a genuine choice and 68% say the same about consent. 52% say they accept sharing because they might otherwise miss out on essential services or opportunities.
Let’s look at some of the specific details in more detail. Firstly, artificial intelligence.
Artificial intelligence
Artificial intelligence (AI) in Australia has a trust issue.
Australians are cautious when it comes to AI and their trust in AI is highly conditional on context and sector. Only 4% of Australians trust AI companies to protect and use their personal information. 4%!
That’s not far off a flat line. For extra context, that 4% should be seen against trust rates of 74% for health service providers and 68% for Australian Government agencies.
This doesn’t mean Australians are set against AI. It goes to fundamental questions: who is using my personal information for AI? What is it being used for? What are the impacts on me? What are the dangers?
Transparency is key. When AI is used, people expect transparency that the use is limited to the service provided and that they have the ability to challenge any decisions that might affect them.
Australians remain cautious about the use of AI in decision-making that may affect them, with nearly all (96%) saying some conditions should be in place before it is used.
Australians expect organisations to be open about how AI is used and how decisions are made, including:
- being informed when AI is being used (79%, up from 71% in 2023)
- being informed if personal information will be shared with a third-party AI provider (74%).
Through our survey we found rising demands, when compared to 3 years ago, from the community, when it comes to the rights for a human review of decisions, validation of AI accuracy, testing for bias and discrimination, and the ability to challenge decisions made by AI.
We also received strong responses and resistance against personal information being retained by third-party AI providers beyond what is necessary, and against personal information being used to train external AI systems without consent.
Not surprisingly, acceptance of AI uses involving personal information varies considerably by application, with higher support for lower-risk, or protective uses, and greater resistance to high-stakes decision-making.
This goes to what I believe is a theme that unifies many of the findings, and one that has deep resonance with me. It is about the exercise of power. Australians consistently feel they often lose control of their personal information, they don’t know what their information is being used for, and they have no rights of redress. That feeling is exacerbated when the stakes are high – when critical moments in one’s life – a financial decision, a job application, housing security or a false identification – are on the line.
The OAIC has recognised this in our regulatory priorities – by seeking to rebalance power and information asymmetries. We are doing this by focusing on sectors and technologies that compromise rights and create power and information imbalances. This focus is one that engages the whole of our office and involves action across both our privacy and information access functions.
Getting back to AI we can see these attitudes to power, or powerlessness, mirrored in the ACAPS survey. The community are accepting of AI being used for fraud detection, with an acceptance figure of 64%. This falls away to 37% for facial recognition or biometric identification (37%), and for customer service chatbots.
Where most red flags occur are in those areas where, as I mentioned, the personal stakes are higher. Only one quarter view it acceptable for AI to be used for automated eligibility or risk-based decisions, such as loan approvals or benefit eligibility.
Keeping information safe
The next area I want to discuss is one that sits at the centre of privacy. It is not a new issue, but it does not lose its importance through repetition.
People want their personal information to be safe.
91% of Australians say the organisation that collected their personal information is responsible for it. To build trust with the Australian community, industry and government should focus on limiting collection of personal information to what's necessary and proportionate, giving people real choices when it comes to their personal data and providing easy pathways for accessing and contesting uses of personal information.
They want simple practical solutions where less data is collected, their information is treated responsibly and is deleted when it's no longer needed.
As the OAIC has said many times, organisations should only collect only what is necessary, keep it safe, and if it is no longer needed, delete. Regularly carry out information audits to ensure the best possible outcomes.
We have seen in major data breaches the situation where members of the community have been impacted despite it being many years since they last used a service, and finding out for that their information was retained for some reason. Let’s minimise this happening.
I’m sure many of us have had the experience of being requested to hand over personal information just to obtain basic retail services.
Our survey found high support for deletion and concern about secondary uses, indicating that organisations should not repurpose personal information indefinitely or in ways that are difficult to see, contest or reverse.
The exposure draft of the Children’s Privacy Code has a feature related to this that excites me. Parents and children will be able to request deletion, not just de-identification of their personal information. Entities will need to accede to such requests within 30 days. This proposed change will be transformative.
ACAPS 2026 found that people distinguish between necessary and excessive collection. Individuals view the provision of basic identifiers to access a service as reasonable, but 92% say there are some types of information organisations should never collect. Information about sexual orientation and biometrics feel excessive or unjustified in most situations, regardless of the organisation or purpose.
This sits with the notion of fairness.
Many Australians judge current data practices as unfair. Only 10% say organisations’ real-world practices are usually fair, while 35% say they are mostly or always unfair.
Secondary uses are a key ‘red line’. Around 9 in 10 say it is not fair and reasonable to use personal information for selling/trading personal information, online tracking, profiling and targeted advertising to children or other vulnerable individuals. The opposition to these practices has risen sharply since our previous survey,
Control and consent in practice
As I mentioned, imbalances in power are a major focus of the OAIC. And it is clear from our survey, that this is a concern of the population.
Again, we find that most people are willing to provide their personal information, provided clear limits and choices exist. There is a recognition of the importance of the digital economy and a willingness to embrace the services offered.
But most people feel they have limited real control. Three quarters report very little or no control over how their personal information is collected and used.
They say that consent often doesn’t feel like a genuine choice. As I mentioned earlier, two thirds say sharing information rarely or never feels like a genuine choice and a little more say the same about consent.
This issue of forced consent is very visible in our recent action in the rent-tech sector, one of the sectors we identified under of regulatory priority addressing power and information imbalances.
The decision involving the entity 2Apply was an important exploration of what agency consumers possess when they encounter applications that request excessive amounts of information and use unfair online choice architecture to do so.
My approach in this determination examined the concept of Online Choice Architecture, that is ‘the way information is presented and choices are structured [which] plays an important role in shaping consumers’ decision-making and behaviour online’. Did the practices in this particular matter undermine the individual’s choice and control over their personal information.
Harmful Online Choice Architecture practices can also be referred to as dark or deceptive patterns. In the context of 2Apply, I identified harmful Online Choice Architecture practices including confirmshaming and biased framing. ‘Confirmshaming’ is the use of emotive language to make a user feel guilty or embarrassed for not taking an action that is beneficial to the information-collecting entity. For example, a user who chooses not to buy insurance when purchasing an airfare might be required to click a button with the text, ‘I am willing to take the risk’, rather than simply ‘No’.
Confirmshaming can be a harmful Online Choice Architecture practice when it pressures users to provide more personal information than they would have, if not for the guilt or shame-inducing message.
‘Biased framing’ is the practice of presenting choices in a way that emphasises their supposed benefits or downsides. Biased framing can be harmful to the individual where the framing is beneficial to the entity and not in the interests of the user. Biased framing can result in individuals being encouraged to choose the option that results in the collection of more of their personal information.
In my determination I identified these practices, which can undermine individual agency and deprive the community of real rights to exercise control over their personal information. This puts them at odds with the requirements of APP 3.5, that personal information collection be fair and lawful.
The simple lesson from this determination, in line with our survey, is that people want practical choices that do not require trading away access to essential services in exchange for the secondary use or disclosures of their personal information.
Complaints
One of the striking conclusions from the survey – and consistent with the notion of power – is that the community find it challenging to exercise their rights when a privacy issue occurs.
And the number of those issues appear to be increasing. Over the past year, 73% of Australians have experienced at least one privacy concern and that's up from 64% in 2023. A third of Australians were notified that their personal information was involved in a data breach. Many experienced scams as a result.
Even where concerns arise, action is not assured. Concerns often don’t become complaints, and pathways appear hard to navigate. 64% had concerns in the past year, but 52% did not raise them, often because they felt it would not make a difference, it would be too hard, or they did not know how.
Banks and financial institutions, health services, and government agencies rated highest in dealing with complaints. At the other end of the scale, confidence in online retailers and social media platforms to deal with complaints sat at only 4% and 3% respectively.
The OAIC is keenly interested in these results. When entities fail to take action on privacy compliance, individuals who have nowhere else to turn come to us. The complaint queue is a measure of systemic non-compliance, and of the failure of first-instance dispute resolution.
So far this financial year we have received over 4,600 privacy complaints – the figures are 63% up on the same period in the previous year. While we have increased our finalisations by more than 30%, we cannot keep pace. (from Estimates brief). That is an incredible workload.
It is a problem that regulated entities have both the obligation and the opportunity to fix. APP 1 requires entities to implement practices, procedures and systems that enable them to handle inquiries and complaints. That requirement has, I think, been underweighted. We intend to change that – through upcoming determinations, through our engagement with the Attorney-General’s Department on Privacy Act reform, and by our focus in the recent Privacy Awareness Week on complaint handling as a trust-building instrument.
Even without legislative change, it is clear APP 1 sets the bar high already. It demands entities take action to ensure they can receive and deal with privacy complaints.
Dispute resolution is where privacy obligations stop being abstract and start being real. It is the point at which the rights individuals hold under the Privacy Act and the Australian Privacy Principles are tested in action – and the point at which trust is either built or destroyed.
This makes for sober reading for entities. If they wish to grow and thrive, they need to do better.
ACAPS reinforces the importance of clear, timely and accessible pathways for access and redress.
Conclusion
As regulator, the OAIC targets its efforts to have the most impact.
In the next couple of weeks, we expect to publish the results of our investigation into tracking pixels.
The specific interest here is in how tracking pixels that collect sensitive personal information should be deployed consistently with individuals’ rights, including the right to consent before sensitive information is used or disclosed. Here, as is the case with rental apps and AI training methodologies, it is not often clear how information is being collected and used. For the average individual, it is bewildering.
Power imbalances raise their head again. We will continue to probe privacy practices that compromise rights and put individuals at a disadvantage.
The 2026 Australian Community Attitudes to Privacy Survey is a comprehensive document and I urge you to examine it in detail. If it has a similar response to the previous surveys released over its 25-year history, it will be referred to again and again right up to the next volume appearing in 2029.
If there is one unambiguously bit of good news in the 2026 survey it is this: Around two-thirds of respondents say they would be more likely to use digital services requiring personal information if they believed their data was handled fairly and responsibly,
That’s right. Greater confidence in privacy practices will increase participation in digital services. That’s a wonderful incentive for entities to get cracking to put the right polices in place.
