Regie is the Legal Transformation Lead at Sprintlaw, with a law degree from UNSW. Regie has previous experience working across law firms and tech startups, and has brought these passions together in her work at Sprintlaw.
Contents
If you run a website in Australia, chances are you use cookies and similar tracking tools for analytics, ads, or improving user experience.
That’s normal - but it does mean you’re collecting data from visitors. And if that data can identify someone (even indirectly), you’re handling personal information under Australian law.
This is where a clear, compliant Cookie Policy comes in. It helps you meet legal obligations, build trust and reduce risk - especially as regulators and browsers tighten the rules around tracking technologies.
In this guide, we’ll explain what cookies are, when Australian law expects you to obtain consent, what to include in your Cookie Policy, and practical steps to roll out a compliant cookie banner and preferences centre.
What Are Cookies And Why Do Websites Use Them?
Cookies are small files stored on a user’s device when they visit your site. They remember preferences, measure performance and, in many cases, enable advertising and personalisation.
Common categories include:
- Strictly necessary cookies - required for your site to function (e.g. shopping cart, login, security). These generally don’t require consent.
- Analytics/performance cookies - help you understand traffic and usage (e.g. page views, device type).
- Functionality cookies - remember user settings or choices (e.g. language, region).
- Advertising/targeting cookies - track browsing across sites to build profiles and serve personalised ads.
Websites also use other trackers (pixels, SDKs, local storage, fingerprinting). In a policy and banner, it’s best to cover “cookies and similar technologies” so you’re not ignoring newer tools that do the same job.
Do Australian Laws Require A Cookie Policy Or Consent?
Australia doesn’t have a stand‑alone “cookie law”. However, cookies are regulated through a combination of privacy and consumer laws. The key question is whether a cookie (or combination of data points) can identify a person. If yes, it’s personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply.
When The Privacy Act Applies
Most businesses with annual turnover of $3 million or more (and some smaller businesses in specific categories) are “APP entities”. If you are an APP entity, you must be transparent about how you collect and use personal information via cookies, and - for certain types of tracking - obtain valid consent.
Even if you’re under the $3 million threshold, you may still choose to follow best‑practice standards because customers expect transparency and major ad tech platforms require it. Having a clear Privacy Policy and a dedicated Cookie Policy is now industry standard.
Consent For Non‑Essential Cookies
In practice, you should obtain consent before setting non‑essential cookies (analytics, advertising, social media) and provide a way for users to change their preferences later. This aligns with global expectations (think GDPR and major browsers’ policies) and reduces risk of misleading conduct under the Australian Consumer Law.
If you target or have users in the EU/UK, you’ll also need to comply with their cookie consent rules. In those cases, consider Sprintlaw’s GDPR Package to make sure your approach is robust across jurisdictions.
Cookie Policy Vs Privacy Policy: What’s The Difference?
These documents work together but do different jobs.
- Privacy Policy - explains, at a high level, what personal information you collect, why, how you use and disclose it, cross‑border transfers, security and how users can access or correct their data. Every serious online business should have a clear Privacy Policy.
- Cookie Policy - dives into the specifics of cookies and similar technologies: the types you use, who sets them (you vs third parties), purposes (analytics, ads), how long they last, and how users can manage their preferences or opt out.
Some businesses combine these into one document. Others keep the Cookie Policy separate and link it from the banner so users can review details easily. Either approach can work - what matters is clear, accurate and accessible information, backed by a consent mechanism that actually controls non‑essential cookies.
What Should Your Cookie Policy Include?
A well‑drafted Cookie Policy is transparent, practical and tailored to your tech stack. At minimum, cover:
- Plain‑English explanation of cookies and similar technologies.
- Categories of cookies used (strictly necessary, analytics, functionality, advertising/targeting).
- Purposes for each category (e.g. load balancing, fraud prevention, measuring campaign performance, audience building).
- Who sets them - first‑party (your site) and third‑party (e.g. analytics providers, ad networks, embedded social tools).
- Storage duration - session vs persistent, and typical retention periods.
- How users can control cookies - link to your banner/preferences centre and explain browser‑level controls.
- Third‑party disclosures - note that third‑party providers may collect data for their own purposes (with links to their policies where appropriate).
- Cross‑border disclosure - if cookie data is processed overseas, explain the countries or categories and relevant safeguards.
- Updates - how you’ll notify users when the policy changes and the date of the latest update.
If you collect personal information directly in forms (e.g. newsletter sign‑ups), pair your Cookie Policy with a short Privacy Collection Notice so users know exactly what they’re consenting to at the point of collection.
How Do You Implement Cookies Lawfully? A Practical Step‑By‑Step
1) Map Your Cookies And Trackers
Start with a cookie audit. List every cookie and tracker running on your site: what sets it, what it does, and whether it’s essential. Include tags and pixels deployed via your tag manager.
This inventory lets you categorise cookies properly and avoid “unknown” cookies slipping through. It also helps you keep your Cookie Policy accurate over time.
2) Decide Your Consent Model
In Australia, best practice is a consent banner that:
- Blocks non‑essential cookies until the user opts in.
- Offers granular choices (e.g. “analytics”, “ads”) rather than an all‑or‑nothing toggle.
- Includes a clearly labelled “Reject” option on the first layer (not hidden).
- Links to your Cookie Policy and Privacy Policy for more detail.
Make sure the banner works for repeat visits and respects choices across pages. Maintain a record of consent decisions in case you need to demonstrate compliance later.
3) Configure A Preferences Centre
Give users an easy way to change their mind. A footer link to “Cookie Settings” should open a preferences centre where they can withdraw consent or adjust choices without friction.
Configure your tag manager so each category toggle actually controls the relevant scripts. If toggles don’t function, that can be misleading.
4) Update Your Policies And Website Footer
Publish your Cookie Policy and make sure it matches your audit and settings. Cross‑link it with your Website Terms and Conditions and Privacy Policy in the footer to keep everything easy to find.
If you use vendors that process data on your behalf, have a fit‑for‑purpose Data Processing Agreement in place that addresses lawful instructions, security and sub‑processors.
5) Check Your Marketing And Email Tools
Cookies often feed into marketing tools and email platforms. Confirm that your consent model aligns with your use of tracking pixels, custom audiences and remarketing lists. Ensure your email practices also comply with Australian email marketing laws.
6) Plan For Incidents And Changes
If there’s a data incident involving cookie identifiers or profiles, your team should know what to do. A practical Data Breach Response Plan helps you respond quickly and lawfully.
Re‑run a cookie scan after adding new plugins, pixels or ad partners. Update your policy and consent set‑up when your tech stack changes.
Common Pitfalls To Avoid
- Setting non‑essential cookies before consent - if your banner displays but scripts still fire, you’re not truly obtaining consent.
- “Implied consent” banners - banners that say “by using this site you consent” are falling out of favour and risk being misleading.
- Hidden reject options - burying the “reject” button or forcing users into complex settings pages can be considered dark patterns.
- Vague policy language - saying “we may use cookies” without naming categories, purposes or third parties doesn’t pass the transparency test.
- No way to withdraw consent - users must be able to change their cookie choices later, not just on the first visit.
- Ignoring third‑party behaviour - if your vendors use data for their own purposes, disclose it and assess your contractual protections.
Do Small Businesses Really Need A Cookie Policy?
If you run a basic, brochure‑style website with only strictly necessary cookies, a short notice in your Privacy Policy may be enough. But most sites use analytics and at least one marketing or social plug‑in - that’s where a dedicated Cookie Policy and genuine consent mechanism make sense.
Beyond compliance, it’s about trust. Clear disclosures show your brand respects user choice. Many ad tech partners now require a compliant banner and policy to use their services, so being proactive avoids interruptions to your marketing.
How Does A Cookie Policy Fit With The Rest Of Your Legal Docs?
Your website’s legal foundation typically includes:
- Privacy Policy - overall data handling, rights and contacts. This is the anchor doc your Cookie Policy references. You can get a tailored Privacy Policy to suit your operations.
- Cookie Policy - the detail on tracking technologies. Our team can prepare a practical policy and banner configuration via our Cookie Policy service.
- Website Terms - your site rules, IP ownership, acceptable use and liability limits. If you don’t have these yet, put in place clear Website Terms and Conditions.
- Collection Notices - short, page‑specific disclosures at forms or checkouts. A concise Privacy Collection Notice can sit next to your sign‑up fields.
- Processor Contracts - if vendors handle data for you, implement a robust Data Processing Agreement and vet sub‑processors.
Having these documents consistent and easy to find helps users understand your approach and minimises friction at sign‑up or checkout.
FAQs About Cookie Policies In Australia
Is Consent Always Required For Cookies?
No. Strictly necessary cookies (those required for the site or a service the user requests) generally don’t require consent. However, analytics, advertising and social media cookies should be off by default until the user opts in.
What If I Use Google Analytics Or Meta Pixel?
These tools involve third‑party tracking. Disclose them in your Cookie Policy, block them until consent, and ensure your banner categorisation actually controls their firing. Review your vendor settings to minimise data where possible.
Do I Need To List Every Single Cookie?
It’s best to describe categories and purposes, identify key third parties and give examples or a dynamic list. If your stack changes often, a regularly updated table (automated via your consent tool) is a good option.
Can I Bundle Cookie Consent With Other Consents?
Avoid bundling. Consent should be specific, informed and freely given. Granular toggles for different cookie categories are better than a single “I agree to everything” checkbox.
What If I Have EU Or UK Users?
Follow stricter consent rules (no pre‑ticked boxes, genuinely opt‑in). Consider aligning your Australian site to that standard for consistency, and speak with us about our GDPR Package if you actively target those regions.
Key Takeaways
- Cookies can be personal information, so transparency and user choice matter under Australian privacy and consumer laws.
- A Cookie Policy complements your Privacy Policy by explaining categories, purposes, third parties, durations and how users can control cookies.
- Use a consent banner that blocks non‑essential cookies until opt‑in, offers granular choices and provides an easy way to withdraw consent later.
- Keep your policy aligned with reality: audit your stack, configure your tag manager and maintain records of consent.
- Link your Cookie Policy with core website documents like your Website Terms and Conditions and a clear Privacy Policy.
- If you use vendors or target overseas users, back your practices with a Data Processing Agreement and consider international compliance needs.
If you’d like a consultation on drafting a Cookie Policy and rolling out a compliant consent banner for your website, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no‑obligations chat.
Regie Anne GardoceLegal Transformation Lead
