Analytics and the Australian Privacy Act

Australian sites still get sold European cookie banners and “GDPR-ready” analytics as if the Privacy Act 1988 were a clone of the EU General Data Protection Regulation. It is not. The Office of the Australian Information Commissioner (OAIC) enforces Australian Privacy Principles (APPs). There is no ePrivacy Directive. There is also no free pass to ignore IP addresses, overseas disclosure, or notice just because you dropped _ga.

SiteLine is cookieless web analytics plus Search Console history, operated by Aglet Technologies. The tracker on your site does not set a first-party analytics cookie. Events still go to SiteLine servers. IPv4 is truncated to /24 and IPv6 to /48, then hashed with the user agent and a daily salt; the raw IP is not stored on the event. Subprocessors include Stripe and Cloudflare. Hosting is not marketed as Australia-only or EU-only.

This is how the product works, not legal advice. If you are an APP entity, your privacy policy and APP 8 assessment are yours. Vendor policy: /privacy. Tracking model: /docs/privacy.

APP entities, small business, and websites that still care

The Privacy Act’s small-business exemption (generally turnover under $3 million, with exceptions — health, credit reporting, trading in personal information, and others) means some Australian operators are not APP entities. Plenty of SaaS companies, agencies, and publishers are. Plenty of non-APP businesses still publish a privacy policy because customers, platforms, and Google Ads expect one.

If you are an APP entity, analytics is usually:

Personal information if a person is reasonably identifiable. The OAIC has treated IP addresses as personal information in some contexts. A daily hash of truncated IP + user agent is designed to make reidentification across days hard. It is not a guarantee that a determined party, combining logs, could never single someone out. Do not write “fully anonymous” in an APP 1 policy.
Notice (APP 5) — tell people you use SiteLine (Aglet Technologies), what is collected (page URL, path, referrer, event name, optional properties, UTMs, coarse device hints, country when available), that no analytics cookie is set, and that events are sent to SiteLine.
Use and disclosure (APP 6 / APP 8) — you use it to see which pages work. You disclose it to Aglet as a contractor. Aglet uses Stripe for billing and Cloudflare for email and often the edge. Those organisations may handle data in Australia, the United States, the European Union, and other countries. That is overseas disclosure. SiteLine does not advertise a single sovereign cloud. Ask [email protected] for the current hosting location if a transfer assessment needs it.
Security and retention (APP 11) — TLS in transit; analytics kept while you subscribe plus 30 days’ grace, then purge; Search Console imports kept while the account exists; account deletion wipes sites, events, GSC data, and Google tokens.

The 2022–2024 Privacy Act review and the government’s response are moving Australia closer to GDPR-style reforms (including a possible small-business rethink). Write policies against the Act as it stands, and expect the floor to rise. We will update /privacy when our practices change; we will not pretend the statute is frozen.

Cookies in Australia

Australia does not copy-paste EU cookie consent. Many sites still show a banner because they run EU traffic, use a global CMS template, or have been told to by an agency that only knows ePrivacy. If your only measurement is SiteLine, you may not need a cookie banner for analytics cookies — there are none. You may still want a privacy notice in the footer. You may still need a banner for advertising cookies if you run Google Ads remarketing or Meta Pixel.

App cookies on siteline.tools (session, CSRF, theme/sidebar) are the SiteLine product UI, not your .com.au visitors. Stripe sets cookies on Stripe Checkout under Stripe’s policy.

See Do I need a cookie banner for analytics? if you also serve the EEA. See Cookieless tracking explained for the hash.

What to tell an Australian client or board

Agencies: do not localise a European DPIA and rename it “APP assessment.” Spell out:

SiteLine does not set an analytics cookie on the client site.
Collect omits credentials.
Visitor ids reset daily; they are not a 13-month GA4 client id.
Events leave Australia (or wherever the visitor is) and are processed by Aglet Technologies, with Stripe and Cloudflare in the chain.
Hostname allowlist and bot filter exist so a public site id is harder to spam.
Price: $4.99 / $19.99 / $99.99 USD per month, 7-day trial — USD, not AUD, billed by Stripe.

If the board wants “data residency in Sydney,” SiteLine is the wrong vendor to oversell. A first-party proxy (nginx, Caddy, Cloudflare, Vercel; no managed CNAME in v1) only changes the browser-visible host. Payloads still reach SiteLine.

Compared with Google Analytics 4, you drop Google LLC as the analytics processor and you drop the analytics cookie. You do not drop all overseas processing. That trade is often enough for Australian privacy reviewers who were really objecting to GA4 + ads identity. It is not “the Privacy Act doesn’t apply.”

Notifiable Data Breaches

The NDB scheme still applies to APP entities. Analytics events are not typically the crown jewels (no passwords, no TFNs), but a backup of URLs and hashes is still in-scope if a breach is likely to cause serious harm. Aglet’s security posture is in /privacy: TLS, hashed passwords, encrypted Google tokens, limited production access. No vendor is unbreachable.

FAQ

The Act is about personal information, not a cookie UI. SiteLine does not set an analytics cookie. Whether you show a banner is driven by other cookies you set and by any EU/UK visitors you have. This is not legal advice.

Is a hashed IP still personal information in Australia?

It can be, depending on identifiability in context. We truncate then hash and do not store the raw IP on the event. Treat it as personal information in your notice unless counsel says otherwise. Mechanics: /docs/privacy.

Who do we list as the overseas recipient?

Aglet Technologies (SiteLine), plus Stripe and Cloudflare as their processors / our subprocessors, in countries that include the US, EU, and Australia. Do not list “the EU only.” Current hosting: ask [email protected]. Policy: /privacy.