Australians aren’t ignoring privacy. They are exhausted by false choices. The ACAPS 2026 survey shows that the ‘I agree’ button is starting to look less like consent, and more like surrender.
Be honest. The last time a privacy policy appeared on your screen, all forty-odd scrolls of it, how long did you spend reading it? For many of us, the answer is: not very long. We scroll, select the ‘I agree’ button and continue with what we were trying to do in the first place. Tick and flick.
You are not alone, and your actions may not reflect how much you actually value privacy.
ACAPS 2026
The Office of the Australian Information Commissioner has released its 2026 Australian Community Attitudes to Privacy Survey (ACAPS), a nationally representative study of 1,504 Australians. There is plenty in it to keep privacy professionals occupied, however the finding that stopped me wasn’t a headline about data breaches or rogue AI, it was a quiet little contradiction buried in the middle of the report. It says something rather unflattering about the entire machinery of how we ‘agree’ to things online. The finding is that Australians routinely agree to privacy policies without reading them, even as they report deep concern about how their information is handled.
The numbers
Around 69% of Australians say they always or often agree to an organisation’s privacy policy without reading most or all of it. Cue the knowing chuckle. Of course we don’t read them. Nobody reads them. There’s a well-worn gag that the only human who has ever read a set of terms and conditions top to tail is the lawyer who drafted them – and even that’s not guaranteed.
The easy conclusion would be that Australians simply do not care enough about privacy. Case closed. Everyone’s apathetic. Except the survey demolishes that theory on the very next page, and the rest of the ACAPS findings point in a very different direction.
The contradiction
The same people selecting ‘I agree’ without reading the privacy policy are more anxious about privacy than ever, not less. Some 93% say protecting their personal information matters to them, and 87% say they are more concerned than they were five years ago. So, if Australians care this much, why does the behaviour appear to say the opposite?
Consent as a turnstile
When ACAPS asked whether consent feels like a genuine choice, 68% said it rarely or never does. It is experienced as something they must click through to continue. Sharing information in everyday life produces a similar result: 65% say it rarely or never feels like a real choice. A substantial 78% report very little or no control over how their information is collected and used, while 52% say they accept sharing because refusing may mean missing out on essential services or opportunities.
The report describes consent as a gateway rather than a decision. In practical terms, the ’I agree’ button can operate less like an informed choice and more like a turnstile. You may read every word attached to it, but access to the service still depends on pushing through.
Not apathy, resignation.
This is where the ACAPS survey gets even more interesting, because it cross-checks its own data. The people who click through without reading aren’t the relaxed ones. They’re more likely to feel that consent is never a real choice (73%, versus 56% of those who at least skim), and more likely to feel they have no control at all (82%, versus 69%). Australians clicking fastest are the ones who feel most like they have no control over their information or are least able to affect the outcome.
The tick-and-flick therefore looks less like indifference and more like resignation. People may ignore the policy not because privacy is unimportant to them, but because they have concluded that reading it will not alter the situation. Why devote time to studying terms you cannot negotiate, and may not realistically be able to refuse?
Only 20% of Australians now feel in control of their privacy, down from 32% three years ago. Meanwhile, 39% say protecting their privacy is too much effort, up from 28%. This is better understood as ‘privacy fatigue’ and diminished agency than apathy.
Privacy and equity
Organisations may show everyone the same privacy policy and the same ‘I agree’ button, but that does not mean everyone has the same ability to understand the consequences of ticking and flicking, or to challenge the terms or even walk away. An individual deciding whether to purchase an optional movie streaming subscription may have alternatives, however someone applying to rent a home, trying to access healthcare, or securing a welfare service may not.
Time, language, literacy, disability, financial pressure and digital confidence can all shape an individual’s ability to engage with privacy information. That makes privacy an equity issue. A system that expects individuals to protect themselves by reading every policy, identifying every risk and refusing every unfair practice will work best for people with the most time, expertise and choice. It will not work for those already in a weaker bargaining position.
Equal notice is not equitable treatment. The better question for organisations to ask is whether their customers have had a realistic opportunity to understand the practice, influence the outcome and say no without suffering an unreasonable disadvantage.
Representation changes design
Representation matters too, when considering whose interests data practices are designed to serve.
Collection processes are usually built around what the organisation wants to know, retain or do next. The individual’s interests may be represented only through a policy written for them and a choice designed for them.
Genuine representation requires organisations to involve affected people in the design of higher-impact data practices, test whether collection notices are understandable and accessible to their actual audience and assess who may be excluded or disadvantaged by the options offered. It also requires organisations to listen to complaints, undertake research and utilise community expectations as evidence.
Rebalancing responsibility
The deeper problem with the ‘tick and flick’ model is that it asks individuals to carry the responsibility for deciding whether an organisation’s proposed data practices are acceptable.
The organisation knows what it collects, how its systems operate, which third parties receive the information and what commercial or operational benefits may follow. The individual generally sees only what is presented at the point of collection. Treating the resulting click as evidence of an equal bargain ignores that information and power imbalance.
Rebalancing does not mean removing choice or making privacy policies less important. It means ensuring that an organisation cannot transfer responsibility for an unfair practice to an individual merely by describing the practice and obtaining a tick box consent.
The law is changing practices
Australian privacy regulation is increasingly contemplating notions of fairness, power, reasonableness, and the practical quality of choice, and Western Australia now provides a clear example. From 1 July 2026, the substantive privacy framework under the Privacy and Responsible Information Sharing Act 2024 (WA) applies to the Western Australian public sector and, in some circumstances, contracted service providers. Its Information Privacy Principles require the collection, use and disclosure of personal information to be ‘fair and reasonable’ in the circumstances.
The legislation requires entities to consider matters such as whether the individual would reasonably expect the handling, the type and amount of information involved, whether the information is sensitive, whether the handling is necessary and the likely consequences for the individual. Consent does not displace that obligation. The entity must still be able to justify the underlying practice as fair and reasonable.
This is a meaningful rebalancing. It recognises that an individual’s agreement cannot be expected to legitimise every practice, particularly where there is limited choice or a significant power imbalance.
At Commonwealth level, a broader fair and reasonable test remains central to the Privacy Act reform agenda. The direction of the proposal is important: organisations should bear greater responsibility for demonstrating that their collection, use and disclosure of personal information is objectively fair and reasonable, regardless of what a consent interface may record.
The OAIC’s 2026 determination concerning the 2Apply rental platform is instructive. It considered the design and structure of an online form, the limited choices available to renters and the significant power imbalance in the rental market. The finding was not only about what the platform said in its privacy policy or collection notice. It was also about how the choice was presented and the circumstances in which people were expected to make it.
The emerging message is clear. The legal question will not always be answered by proving that the individual was told, or that a box was selected, as organisations must demonstrate that the practice was fair and reasonable in the circumstances.
Consent vs trust
Consent and trust are not interchangeable. Consent is usually captured at a particular moment, and trust is an ongoing judgement formed through the organisation’s conduct before, during and after that moment. It depends on whether the organisation collects proportionately, honours the purpose for which information was provided, gives people access rights and responds fairly when something goes wrong.
A tick may establish that an individual proceeded, however it does not establish that the individual understood the practice, considered it fair, felt able to refuse, trusted the organisation or would have made the same decision if a genuine alternative had been available.
ACAPS found that 68% of Australians would be more likely to use digital services requiring personal information if they believed their information would be handled fairly and responsibly.
Privacy is therefore not necessarily the barrier to participation it is sometimes assumed to be. Poor privacy practices, weak organisational choices and low trust are the barriers.
The takeaway
This does not mean privacy policies are pointless. A privacy policy remains an important transparency and accountability document. It explains how an organisation generally manages personal information and how people may exercise their rights. But a policy is not blanket consent, and cannot make an excessive, unexpected or unfair practice acceptable.
Privacy policies and consent forms matter. But notice and consent cannot carry the whole burden of fair personal information handling. Organisations should ask:
- Is this collection necessary and proportionate? Collect what is genuinely required for the service, not everything that may one day be useful.
- Is this practice fair to the individual? Consider the sensitivity and amount of information, the individual’s reasonable expectations, the potential consequences, and who receives the benefit.
- Can the individual make a genuine choice? Individuals should be able to refuse non-essential practices without persuasion, unnecessary exclusion or disproportionate disadvantage.
- Are affected individuals represented in the design? Test notices with the people who will use them, including people with differing literacy, accessibility and digital needs.
- Does the privacy policy reflect reality? The published privacy policy, collection notice, internal system configuration and downstream data flows should all tell the same story.
- Would this data handling practice still be reasonable without the tick? Consent should support a fair practice. It should not be used to rescue an unfair one.
Privacy policies support transparency, explain how personal information is managed and provide pathways for people to exercise their privacy rights. But they cannot make an excessive collection necessary, an unfair secondary use reasonable or a false choice voluntary.
The 2026 ACAPS survey is, in one sense, a snapshot of a community that has lost confidence in the ’I agree’ button, but it is also an invitation to organisations to rebuild that trust by collecting less information, explaining clearly, designing for genuine choice, involving impacted individuals and taking responsibility for fairness.
The organisations that do this will be better prepared for the direction of Australian privacy law reform and they will begin to change resignation to agency, and formal agreement to meaningful participation, and tick and flick to community trust.
Please reach out to our team if we can be of assistance in reviewing your Privacy Policy or Collection Notice.
