What the Privacy Act 1988 says about fingerprinting
The Privacy Act 1988 (Cth) is Australia's primary federal privacy statute. It does not mention 'fingerprinting', 'device identifier', or 'browser fingerprint' by name. It does not need to: section 6 defines 'personal information' as 'information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true, and whether or not the information or opinion is recorded in a material form'. A browser fingerprint composed of canvas output, font enumeration, WebGL renderer strings, audio context fingerprint, screen resolution, time zone, and installed plugins qualifies the moment it is used to recognise the same user across sessions. The question is not whether a name is attached - it is whether the hash can be traced back to a real individual with reasonable effort.
The 13 Australian Privacy Principles (APPs), found in Schedule 1 to the Act, are the operational rules. APP 3 governs collection of solicited personal information and requires that an APP entity must not collect personal information unless the information is reasonably necessary for one or more of the entity's functions or activities. APP 5 requires notification at or before collection. APP 6 restricts use and disclosure to the primary purpose of collection, or a secondary purpose the individual would reasonably expect. APP 7 governs direct marketing and provides an opt-out right. APP 11 requires reasonable steps to protect personal information from misuse, loss, and unauthorised access. APP 12 gives individuals the right to access their personal information.
The Privacy Act applies to 'APP entities', defined to include Australian Government agencies and private-sector organisations with an annual turnover of more than A$3 million. The small-business exemption in section 6D is the most consequential threshold for product teams to understand: it currently excludes the vast majority of Australian businesses from the Act's reach, though active legislative review may remove it.
The 2024 statutory tort: private litigation risk for fingerprinting
Before June 2025, an individual whose privacy was invaded by a fingerprinting deployment could only complain to the OAIC. The OAIC would then decide whether to investigate, attempt conciliation, or make a determination. The process was slow and the individual had no direct control over outcomes.
The statutory tort of serious invasions of privacy, introduced by the 2024 amendments and commencing in June 2025, changed that. An individual can now bring a civil action directly in a court if they can show that the defendant intruded upon their seclusion, or misused their private information, in circumstances where a reasonable person in the plaintiff's position would have had a reasonable expectation of privacy. The intrusion or misuse must be serious. The court can award damages including for emotional distress, and can grant injunctions.
For fingerprinting, the practical concern is deployments that function as covert surveillance - tracking users across unrelated sites without any disclosure, building profiles that the user has no reason to suspect exist. A fingerprinting deployment that is undisclosed, persistent across contexts, and used for purposes (such as behavioural profiling or targeted advertising) that the user would not reasonably expect is a candidate for a serious-invasion claim. The tort is new and its application to fingerprinting has not yet been litigated, but the OAIC has indicated it will use its intervention powers to support individuals in appropriate cases.
Sensitive information and biometric data
Section 6 of the Privacy Act defines 'sensitive information' as a closed category that includes health information, genetic information, biometric information, biometric templates, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sexual orientation or practices, and criminal record. Sensitive information requires consent for collection under APP 3(3), and additional protections apply throughout the APPs.
Biometric information is defined in section 6 to mean information about an individual's biological characteristics that can be used to verify or authenticate the individual's identity. A device fingerprint composed of passive hardware signals is not biometric information in the classical sense - it is not a retinal scan or a voiceprint. However, the moment an organisation uses a fingerprint as a persistent identifier to verify that a returning user is the same person as a previous visitor, the use of that fingerprint shifts toward the biometric-identification function described in the definition. The OAIC has not published guidance that draws a bright line between a 'device fingerprint as a unique identifier' and 'biometric information used for identification'. Teams using persistent fingerprint hashes as a primary means of re-identifying users should seek legal advice on whether their specific use case crosses the biometric line.
The small-business exemption: why it matters and why it may change
Section 6D of the Privacy Act currently provides that an organisation is not an 'APP entity' if its annual turnover, together with the annual turnover of any related bodies corporate, is A$3 million or less. The OAIC estimates that this exemption covers approximately 94% of Australian businesses by count.
The practical effect for fingerprinting is significant: a startup, small e-commerce operator, or SaaS business with revenue below the threshold is not bound by the APPs when processing Australians' personal information, including fingerprint hashes. There is no 'small business' safe-harbour equivalent in the GDPR regime; this is a genuine structural difference.
However, the 2024 amendments explicitly directed a review of the section 6D threshold, and the Attorney-General's Department has signalled that removal or significant reduction of the exemption is the likely outcome. The timing of any change depends on the legislative timetable, but product teams building for multi-year horizons should build APP-compliance into their architecture now rather than rely on an exemption that may disappear. There are also existing carve-outs that already bring some small businesses inside the Act regardless of turnover - businesses that trade in personal information, businesses related to a large organisation, and businesses that provide health services.
Australian Privacy Principles most relevant to fingerprinting
- APP 1: Open and transparent management of personal information. Organisations must have a clearly expressed and up-to-date privacy policy that covers what personal information is collected, how it is used, and whether it is disclosed overseas. A fingerprinting deployment must appear in the privacy policy.
- APP 3: Collection of solicited personal information. An organisation must not collect personal information that is not reasonably necessary for its functions or activities. Collecting a full fingerprint hash when only a session token is needed fails this test.
- APP 5: Notification of collection. At or before collecting personal information, the organisation must take reasonable steps to notify the individual. Passive, undisclosed fingerprinting does not satisfy APP 5.
- APP 6: Use or disclosure of personal information. The fingerprint can only be used for the primary purpose of collection or a secondary purpose the individual would reasonably expect. A fingerprint collected for anti-fraud cannot be repurposed for targeted advertising without a new basis.
- APP 7: Direct marketing. Individuals have the right to opt out of direct marketing. Fingerprinting used to power direct-marketing targeting triggers APP 7's opt-out right, and the opt-out must be simple and effective.
- APP 11: Security of personal information. Reasonable steps must be taken to protect fingerprint hashes from misuse, loss, or unauthorised access or disclosure. If they are no longer needed, they must be destroyed or de-identified.
- APP 12: Access to personal information. Individuals have the right to request access to personal information held about them, including fingerprint-derived identifiers.
Common fingerprinting purposes under the Privacy Act
| Purpose | Personal information? | APP 3 necessity? | APP 6 use permitted? | APP 7 opt-out applies? | Consent required? |
|---|---|---|---|---|---|
| Anti-fraud at login or payment | Yes | Yes, if scoped to fraud detection | Yes, primary purpose | No | No, but disclose in privacy policy |
| Account-takeover detection | Yes | Yes | Yes, primary purpose | No | No, but disclose in privacy policy |
| Bot mitigation on a public form | Yes | Usually yes | Yes, primary purpose | No | No, but disclose |
| Cross-site behavioural advertising | Yes | Questionable - requires documented justification | Only if disclosed as primary or reasonably expected secondary purpose | Yes | Recommended; required if biometric classification applies |
| Direct marketing on first-party site | Yes | Yes, if proportionate | Yes, but opt-out must be offered | Yes | No, but opt-out mechanism mandatory |
| Selling fingerprint-derived audience segments | Yes | Unlikely to satisfy necessity test | No, without separate disclosure and consent | Yes | Yes, or at minimum clear disclosure with opt-out |
| Product analytics on own service | Yes | Often yes | Yes, if disclosed | No | No, but privacy policy must disclose |
| Persistent re-identification across unrelated sites | Yes | Unlikely to satisfy necessity test | No, without specific basis | Yes | Yes |
| Biometric-purpose identification (fingerprint as identity verifier) | Yes (sensitive information) | Yes, with higher bar | Only for the consented purpose | Yes | Yes - explicit consent required under APP 3(3) |
APP 3 necessity: the collection filter
APP 3(3) requires that an APP entity must not collect personal information that is not reasonably necessary for one or more of the entity's functions or activities. For fingerprinting, this is the first compliance question to answer before any other APP analysis: is there a specific function - fraud prevention, account security, bot mitigation - that genuinely requires a fingerprint, or is the fingerprint being collected because it is available and might be useful later?
The OAIC has been clear that 'reasonably necessary' is an objective test, not a self-assessment. The entity must be able to demonstrate that a less privacy-invasive alternative would not achieve the same outcome. Collecting a full hardware fingerprint (including audio context, canvas hash, WebGL renderer, and installed fonts) when only a session cookie would serve the purpose fails APP 3's necessity filter. Collecting that same fingerprint specifically to detect fraudulent account takeover attempts, where cookie-based identification has already been defeated, is more defensible.
Proportionality within the fingerprint itself also matters. APP 3 does not just limit when you collect - it limits how much you collect. A fingerprint composed of the minimum signals required for the stated security purpose is more defensible than a maximal fingerprint that captures every available signal for possible future use.
APP 5 and the notification obligation
APP 5 requires that an APP entity take reasonable steps, at or before the time of collection (or as soon as practicable after), to notify the individual or ensure they are aware of certain matters. For fingerprinting, these include: the identity and contact details of the organisation; the fact and circumstances of collection; whether the collection is required or authorised by law; the purposes of collection; the consequences for the individual if the information is not collected; and any overseas disclosures.
Passive, undisclosed fingerprinting does not satisfy APP 5 by any reading. The notification does not need to be a pop-up consent banner - a clearly written privacy policy, made reasonably accessible and linked from the relevant page, can suffice for routine personal information collection. However, if fingerprinting is a material part of the organisation's data collection activity, it should be specifically named in the privacy policy, not buried in a generic 'device information' category.
For overseas processing - for example, using a fingerprinting SDK that sends hashes to infrastructure outside Australia - APP 5 notification must include disclosure of the countries to which information is likely to be disclosed. APP 8 then governs cross-border disclosure and requires that the overseas recipient handle the information in a way that is overall consistent with the APPs.
Enforcement context: Medibank, Optus, and OAIC's expanded powers
The OAIC's enforcement profile changed materially after the Privacy and Other Legislation Amendment (Enforcement and Other Measures) Act 2022, which raised the maximum civil penalty for serious or repeated interferences with privacy from A$2.22 million to the greater of A$50 million, three times the benefit obtained from the breach, or 30% of the organisation's adjusted turnover in the relevant period. Two high-profile investigations illustrate the post-2022 framework in practice.
The Medibank Private data breach of 2022 exposed the personal and health information of approximately 9.7 million current and former customers. The OAIC commenced a formal investigation and, in 2024, found that Medibank had failed to take reasonable steps to protect personal information as required by APP 11. The OAIC made a determination requiring Medibank to implement specific security improvements and referred the matter for civil penalty proceedings. The Medibank investigation is significant for fingerprinting because the OAIC's reasoning focused on systemic security failures rather than a single incident - a fingerprinting deployment with inadequate security controls around stored hashes is exposed to exactly the same APP 11 analysis.
The Optus data breach of 2022 exposed the personal information of approximately 9.8 million current and former customers, including passport and licence numbers. The OAIC investigated and, in 2024, found Optus had interfered with the privacy of individuals by failing to take reasonable steps to protect their personal information under APP 11. The case also examined whether Optus had collected more personal information than was reasonably necessary under APP 3. This dual APP 3 and APP 11 framing is directly applicable to fingerprinting deployments: over-collection at the signal level and inadequate security of stored hashes are independent compliance failures, each capable of grounding an OAIC interference determination.
Beyond Medibank and Optus, the OAIC has a pattern of accepting enforceable undertakings from organisations that self-report or cooperate with investigations. Enforceable undertakings are published on the OAIC's website and typically require the organisation to implement a privacy management framework, appoint a senior responsible officer, and commission an independent privacy audit. Fingerprinting-specific undertakings have not yet been published, but the OAIC's published assessment reports make clear that undisclosed tracking identifiers are treated as a serious compliance concern.
The Notifiable Data Breaches scheme and fingerprint stores
The Notifiable Data Breaches (NDB) scheme, in operation since February 2018, requires APP entities to notify both the OAIC and affected individuals when a data breach is likely to result in serious harm. A database of fingerprint hashes, if breached, can constitute a notifiable breach where the hashes can be used to re-identify users, link them across platforms, or enable account-takeover attacks.
The 'serious harm' threshold is assessed by reference to the sensitivity of the information, the number of people affected, and the likely consequences. A fingerprint store linked to user accounts - where each hash is associated with a login identity - is more likely to cross the serious-harm threshold than an anonymised analytics dataset. Organisations running fingerprinting infrastructure should include fingerprint databases in their data-breach response plan and assess NDB obligations before a breach occurs.
How Benny the Doorman fits into an Australia-aware deployment
Benny is a fingerprinting SDK and hosted API, not a consent management platform. Under the Australian Privacy Principles, the controller - the organisation deploying Benny - is responsible for satisfying APP 3 (necessity), APP 5 (notification), APP 6 (purpose limitation), APP 11 (security), and, where APP 7 applies, providing an opt-out for direct marketing. Benny's role is to supply the technical fingerprint signal; the controller's role is to build the governance layer around it.
Three integration steps for an Australia-aware deployment. First, review APP 3 necessity for each signal category Benny collects in your configuration: only enable signal collectors that are required for the specific purpose - fraud detection, bot mitigation, or session continuity - and document why less privacy-invasive alternatives are insufficient. Second, update your privacy policy to disclose fingerprinting as a collection activity, name the purposes, and disclose cross-border processing if Benny's processing infrastructure is outside Australia. Third, if your fingerprinting deployment supports direct marketing, implement an APP 7-compliant opt-out mechanism that gates Benny's marketing-purpose data flows.
For clients subject to APP 8 (cross-border disclosure), Benny provides a data processing agreement that describes the infrastructure location, data-retention periods, and security controls. This documentation populates the due-diligence record that an APP 8 assessment requires.
Frequently asked questions
Is browser fingerprinting illegal under the Australian Privacy Act?
No. Fingerprinting is not banned under the Privacy Act 1988. It is regulated as a form of personal information collection when the fingerprint can be used to identify or reasonably identify an individual. Lawful use requires satisfying APP 3 (collection necessity), APP 5 (notification), APP 6 (purpose limitation), and the direct-marketing opt-out under APP 7 where applicable. Doing it without those safeguards is what creates OAIC enforcement exposure and, since June 2025, private litigation risk under the statutory tort.
Does the Privacy Act apply to my company? What is the small-business exemption?
Section 6D of the Privacy Act currently exempts businesses with an annual turnover of A$3 million or less from the Act's requirements, including all 13 Australian Privacy Principles. The OAIC estimates this covers roughly 94% of Australian businesses by number. However, some small businesses are still covered regardless of turnover - those that trade in personal information, businesses that are related bodies corporate to a large organisation, and businesses providing health services. The exemption is under active legislative review following the 2024 amendments, and removal or significant narrowing is the likely direction of reform.
What is the new statutory tort and how does it affect fingerprinting?
The Privacy and Other Legislation Amendment Act 2024 introduced a statutory tort of serious invasions of privacy, effective June 2025. For the first time, an individual can sue a private organisation directly in court - without going through the OAIC complaint process - if the organisation seriously intruded on their seclusion or misused their private information in circumstances where a reasonable expectation of privacy existed. For fingerprinting, the clearest risk scenario is a covert, undisclosed deployment that tracks users across unrelated websites or builds persistent profiles without any reasonable expectation on the user's part. The tort is new and untested in the fingerprinting context; legal advice is essential for any deployment that could be characterised as surveillance.
Does fingerprinting count as biometric information under the Privacy Act?
Biometric information is defined in section 6 of the Privacy Act as information about an individual's biological characteristics that can be used to verify or authenticate their identity. A standard device fingerprint based on browser and hardware signals is not biometric in the traditional sense. The question becomes more complex when a fingerprint hash is used as the primary mechanism for re-identifying a returning user across sessions - a function that resembles identity verification. The OAIC has not drawn a clear line. If your deployment uses fingerprinting specifically to verify or authenticate user identity, seek legal advice on whether the biometric classification and its opt-in consent requirement applies.
Do I need a consent banner for fingerprinting in Australia?
There is no ePrivacy Directive equivalent in Australian law requiring prior consent before reading device signals. Australia does not have a cookie-consent-banner requirement comparable to the EU framework. Instead, the Privacy Act requires notification under APP 5 (disclosed in a privacy policy or collection notice) and necessity under APP 3. Explicit consent is only required when collecting sensitive information - which includes biometric information used for identification. For most fingerprinting use cases, a clearly written privacy policy that discloses the collection, purposes, and any overseas processing is sufficient, though consent is best practice for non-essential tracking.
What are the penalties for Privacy Act breaches involving fingerprinting?
Since the 2022 enforcement amendments, the maximum civil penalty for serious or repeated interferences with privacy is the greater of A$50 million, three times the benefit obtained from the conduct, or 30% of the organisation's adjusted turnover in the relevant period. The OAIC can also seek injunctions, require an audit, and accept enforceable undertakings. The Medibank and Optus investigations, both resulting in determinations of interference with privacy, demonstrate that the OAIC is prepared to use its expanded powers for systemic failures, not only single incidents.
What does APP 7 require for fingerprinting used in direct marketing?
APP 7 prohibits using or disclosing personal information for direct marketing unless the individual reasonably expects it, or has consented, or the direct marketing is by the organisation that collected the information from the individual and certain conditions apply. Importantly, APP 7(3) gives individuals an absolute right to opt out of receiving direct marketing communications, and APP 7(7) requires the opt-out mechanism to be simple and effective. A fingerprinting deployment used to target direct-marketing messages must honour opt-out requests, keep an opt-out register, and not use the fingerprint for marketing after an opt-out has been exercised.
How does the Australian Privacy Act compare to GDPR for fingerprinting?
The most significant structural differences are: first, Australia has no ePrivacy-style prior-consent requirement for accessing device signals, whereas EU law requires prior consent under Article 5(3) of the ePrivacy Directive; second, the Australian small-business exemption currently removes most businesses from the Act's scope, while GDPR has no such threshold; third, Australia's 2024 statutory tort creates a new private right of action with no GDPR equivalent (GDPR relies on data-subject rights and DPA enforcement); fourth, GDPR's penalty ceiling of 4% of global turnover can exceed Australia's A$50M cap for large multinationals, but the 30%-of-adjusted-turnover limb in Australian law can exceed GDPR for high-margin businesses.
Tooling
Benny the Doorman is built for this compliance posture.
Free, cookieless fingerprinting that defers to your consent management platform, runs on Indian infrastructure, and ships with a DPA addendum sized for the jurisdiction above.
Last reviewed 2026-06-06
