Privacy Act Automated Decision Making in Australia: A Shopify Store Guide
The Privacy Act automated decision making rules for Australian ecommerce start on 10 December 2026. From that date, businesses covered by the Privacy Act must explain in their privacy policy when computer programs use personal information to make, or help make, decisions that could significantly affect people.
That sounds like a concern for banks and insurers, but the Office of the Australian Information Commissioner (OAIC) has made clear the net is wider. Its final guidance, released on 30 September 2026, says personalised pricing, fraud detection tools and even simple rule-based software can be in scope. Many Shopify stores run apps that do exactly these things.
With about eight weeks to go, here is what the rule says, how it may apply to your store, and a practical checklist to get ready.
What changes on 10 December 2026?
The obligation comes from the *Privacy and Other Legislation Amendment Act 2024*. The OAIC's consultation page confirms it applies from 10 December 2026 to APP entities, meaning organisations covered by the Australian Privacy Principles.
Under the new APP 1.7 to 1.9, your privacy policy must describe:
- The kinds of personal information used in operating these computer programs.
- The kinds of decisions made solely by a computer program.
- The kinds of decisions where a computer program does something substantially and directly related to the decision.
The rule applies to Privacy Act-covered businesses. Obsidian Regulatory Intelligence notes the general A$3 million annual turnover threshold for APP entities, so check with your adviser whether your business is covered. Some smaller businesses are caught for other reasons.
When is an automated decision in scope?
As law firm White & Case explains, disclosure is needed when all three of these apply:
- A computer program makes a decision, or does something substantially and directly related to making one.
- The decision could reasonably be expected to significantly affect an individual's rights or interests.
- Personal information about the individual is used in operating the program.
The middle test, "significantly affect", is where most of the judgement sits for retailers.
Which Shopify tools could be caught?
Automation inside online stores is growing quickly. Shopify's Q2 2026 results reported nearly 34 million merchant conversations with its Sidekick AI assistant in the quarter, and more than 36,000 custom apps created. More automation means more decisions to review.
The OAIC guidance does not list Shopify apps, so you have to apply its examples to your own setup. According to Allens' analysis of the final guidance and Maddocks' summary, these are the points most relevant to online stores:
Store function | What the guidance says | Likely risk level |
|---|---|---|
Personalised or postcode-based pricing | Can be captured. The "Daintree" example found postcode pricing of essential goods significant, about $132 more a year on baby formula | Higher |
Automated fraud detection and order holds | Fraud detection tools may be in scope. Specific rule weightings can stay confidential, but the use of personal information cannot | Medium to higher |
Targeted advertising and offers | May be in scope where it affects access to significant goods or services, or results in differential pricing | Depends on use |
Account blocking or refusals | Refusing or failing to make a decision counts as a decision | Depends on impact |
Generative AI chatbots | Can be captured if used in decisions about individuals | Depends on use |
Three further points from the guidance matter for Shopify merchants:
- Simple tools count. Rule-based software, spreadsheets, machine learning and generative AI can all be captured. You do not need to be using "AI" for the rule to apply.
- Human review does not take a tool out of scope. If a program's output is a material input into the decision, it is generally captured.
- Vendor-built features are your responsibility. ADM embedded in a third-party product, such as a Shopify app, is still the using business's disclosure obligation.
What does the rule not require?
This is a transparency measure, not a European-style rights regime. Allens notes there is no new right to contest a decision and no requirement to notify individuals directly. The guidance is not prescriptive about technical detail, and decisions can be grouped by category.
The commercial-in-confidence exclusion is narrow. It covers information whose disclosure would genuinely harm commercial interests, such as trade secrets, not just information that is commercially valuable or might be embarrassing.
What are the risks of getting it wrong?
Maddocks notes that the OAIC can now issue infringement notices for certain privacy policy deficiencies under APP 1. The wider privacy environment has also tightened: the statutory tort for serious invasions of privacy commenced on 10 June 2025, according to Obsidian. The OAIC built its guidance on 90 written submissions, which signals how closely the regulator is watching this area.
For a retailer, the bigger risk is often reputational. A customer who learns that prices or order approvals were shaped by data they did not know was being used is unlikely to come back.
Your 8-week checklist
Step 1: Inventory your apps and rules (weeks 1 to 2)
List every Shopify app and setting that makes or shapes decisions about customers:
- Fraud analysis and automatic order cancellation or holds
- Dynamic pricing, personalised discounts and price tests by location
- BNPL and payment eligibility checks
- Customer tagging and segmentation that changes offers or access
- Account suspension, return abuse or wholesale approval rules
- AI chatbots that handle refunds, returns or claims
Step 2: Assess each one (weeks 3 to 4)
For each item, ask the three questions: Is a program making or shaping the decision? Could it significantly affect the customer? Does it use personal information? Record your reasoning.
Step 3: Update your privacy policy (weeks 5 to 6)
Describe, by category, the personal information used and the kinds of decisions made. Maddocks suggests stating expressly if you do not use relevant systems, and the OAIC encourages a cautious approach when in doubt.
Step 4: Align notices and contracts (weeks 7 to 8)
Check that APP 5 collection notices, checkout wording and app vendor contracts match the updated policy. Ask key app vendors what personal information their tools use.
The bottom line
The Privacy Act automated decision making rules turn the apps behind many Australian Shopify stores into a disclosure question. From 10 December 2026, if a pricing, fraud or personalisation tool uses personal information to make decisions that could significantly affect customers, your privacy policy needs to say so, even if a vendor built the tool.
The work is manageable if you start now: inventory, assess, disclose and align. Because this is a legal obligation, confirm your final approach with a privacy lawyer or adviser. For the technical side, auditing your Shopify apps and data flows, ONEXT's Shopify development team can support you as a trusted implementation partner.