What 33 Australian privacy policies say about automated decisions.

We read the current Australian privacy policies of 33 large consumer brands on 23 September 2026. Three include all three elements our screen looks for, which are wording that decisions are automated, the kinds of decisions and the kinds of personal information used in them. They are ING, Telstra and Virgin Australia. QBE has automated-decision wording and one of the other two elements. Twenty-three describe working something out about a customer from their information, such as an inference, a score, a profile or an automated identity check, without saying that a program makes the decision. Bupa and JB Hi-Fi mention artificial intelligence or machine learning and have none of that other wording. For Medibank, Myer, Qantas and Suncorp the result is “No qualifying wording found under this screen”. These counts describe the published wording on the day we read it.

The December obligation concerns decisions that meet the legal threshold. Saying a business uses AI is not the same as describing those decisions.

Human approval does not automatically put a decision outside the new duty. The computer’s role, the personal information used and the significance of the decision all matter. First establish whether the organisation and activity are covered by the Privacy Act. Turnover is one part of that assessment, and specific small-business exceptions apply. Holding health or credit information alone is not a reliable shortcut for deciding the full scope of your obligations.

The useful next step is to compare the policy with the decisions the business actually makes. That takes input from the people who run customer systems, the suppliers involved and the privacy team. A policy review can identify questions to ask. It cannot establish whether an organisation has completed that work internally.

Our view is that businesses should also keep usable records of important automated decisions and the people responsible for them. That helps with review and correction. It is an operating recommendation, separate from the wording required in the privacy policy.

How we read this. On 23 September 2026 we read the current public Australian privacy policy of 33 large Australian consumer brands, across banking, consumer lending, buy-now-pay-later, insurance, superannuation, telecommunications, energy, retail, wagering and airlines. The brands were chosen in June 2026. They are a convenience set, not a representative sample of Australian businesses. We saved each policy’s text, its address and the time we read it. Where a policy says it must be read with a group privacy policy, or sends readers to one for its core privacy matters, we read that one as well. We screened only the wording that applies to Australian customers and set aside sections written only for people in other jurisdictions. The first element is wording that the business makes automated decisions, or that a computer program makes a decision about a person using their personal information. Wording that analytics or AI help or support a decision does not count. The second and third elements are the kinds of decisions and the kinds of personal information used in them. Partial wording means the policy describes working something out about a person from their information, such as an inference, a score, a profile or an automated identity check, without saying that a program makes the decision. Targeted advertising on its own does not count. Two separate automated classification passes were used, followed by a further automated review of differences and boundary cases. The retained records show agreement on the final category for all 33 brands. A script checked all 232 cited passages against the saved text and the lines cited. We wrote the first version of the rules before reading the policies, then clarified and amended them after examining the initial classifications. The later rules used examples from the policies. This was not a fully blinded review: some passes saw brand-specific notes, and the retained records do not establish complete blinding for every pass.

What we found. Three policies include all three elements, one has automated-decision wording and one of the other two elements, twenty-three use partial wording, two mention AI or machine learning with no other qualifying wording, and four fall under “No qualifying wording found under this screen”. The table names each brand. All 33 policies were read. That last label describes the text we read. It does not show that a business uses no automation, does no profiling or has breached anything. We do not compare these counts with the counts this note reported before.

What the screen does not show. The law is the Privacy and Other Legislation Amendment Act 2024 (new Australian Privacy Principle 1.7), with guidance from the OAIC. The OAIC describes a duty that covers a computer program making a decision, or doing something substantially and directly related to making it, where the decision could reasonably be expected to significantly affect a person’s rights or interests and their personal information is used. Our first element counts that second case only where a policy says so in those terms, not where it says a program helps or supports a decision. So the screen is narrower than the duty, and it does not test whether any decision is significant. A policy review shows published wording on the day it was read. It does not show what a business does internally, whether its policy discloses every use, or whether it will meet the duty when it starts on 10 December 2026. The new duty concerns privacy-policy transparency. Other rights and obligations may apply under existing law, but this reform does not itself establish an individual right to an explanation or review. This is NTWRK’s reading framework, not legal advice or a legal assessment of any business.

Correction history. Published 29 June 2026, reporting that one of the 33 policies read that day contained all three elements of the screen. Re-run 30 July 2026, reporting that 27 of the 33 disclosed nothing about automated decisions. Corrected 16 September 2026, withdrawing the July count and reporting counts from a 9 September screen. That screen reported two policies with all three elements, one narrower, four with partial wording, twelve describing AI or machine learning without naming a decision, and fourteen in a fifth category for policies with none of that wording. Corrected 24 September 2026, withdrawing all of these counts and replacing them with the review of policies read on 23 September 2026. The earlier counts could not be substantiated from the records we retained, and the classification rules have changed since, so they are not compared with the current findings.

Wes Fischer, founder and CEO, NTWRK