AI privacy in Australia means limiting what your phone, photos and accounts hand to AI systems. It does not stop the collection.
AI is already in the phone, the laptop, the shop camera and the search box. It collects, learns, and now sits inside decisions about loans, jobs and insurance. Most Australians do not trust it.
Quick answer:
AI systems collect and learn rapidly from large amounts of data.
Photos are scanned for faces. Conversations are stored. Search history becomes the context for an answer. Files in a cloud drive sit with the company that runs the assistant. Public posts are copied and used to build a profile. A shop camera takes a biometric scan of your face as you walk in.
Once a system has learned from your data, deletion is a weak fix. The company can delete the file, but it cannot reliably remove what it has already learned.
The University of Melbourne and KPMG surveyed 48,340 people in 47 countries in 2025 (Trust in AI, 2025). Australia is the outlier.
People are using AI ahead of trusting it, and ahead of the rules at work.
In October 2024 the Privacy Commissioner found that Bunnings had interfered with people’s privacy by scanning faces in its stores. Shoppers were not properly told, and Bunnings had not done a proper risk assessment. Bunnings challenged the decision.
On 4 February 2026 the Administrative Review Tribunal partly agreed with the Commissioner and partly disagreed. It said Bunnings had failed to give proper notice and had weak privacy practices. It also said Bunnings could still scan faces for the limited purpose of dealing with serious retail crime. The Commissioner did not appeal.
A face held even for a fraction of a second is still a collection of sensitive information. Telling people is still required, even when the purpose is crime prevention. Shoppers, including children, were scanned without a clear explanation.
If a large hardware chain can scan faces and win on a narrow exemption, treat a shopping-centre camera as something that records you, not as part of the building.
New privacy-policy rules start that day. The OAIC published the guidance on 30 September 2026.
An organisation must update its privacy policy if three things are true. It uses AI, or another computer system, to make a decision or to do something closely tied to making one. The decision could significantly affect your rights or interests. Your personal information is used in that system.
The policy must say what personal information is used and which decisions the system makes or heavily informs. Loans, insurance, hiring and health queues can sit in that set.
It will not contain a button that stops it. The phone and the account are the controls you actually have.
There is no single off switch. If a label has moved, search the setting name in the Google account.
That cuts the account. It does not stop the phone operating system collecting underneath.
For Australians, a GrapheneOS Privacy Phone on a Pixel is the strongest everyday option for on-device AI privacy. GrapheneOS does not ship Google apps or Google AI in the OS, and no Google account is required. Optional sandboxed Google Play stays in the app sandbox, so everyday apps can still work without a stock Gemini feed.
On a PrivacyPros phone we use Lumo AI for its privacy benefits – it does not train on your chats, keeps no logs, and uses zero-access encryption so even Proton cannot read them. Other AI’s can also be run safely by following the User Manual instructions on isolating it in profiles, private spaces and through permission management.
Deepfakes are now increasingly convincing, but you can protect yourself with these simple checks:
Tools that can help:
Quick manual checks:
The December rule tells you AI was used in a decision. The Bunnings case tells you a shop must give notice, and that a crime exemption can still allow a face scan. Neither pulls photos out of a system that has already learned from them, or takes the assistant off the phone.
A Privacy Phone on GrapheneOS cuts the operating-system feed: no Google account required, sensor and network scopes per app, sandboxed Play only where a bank needs it. A Privacy Laptop does the same for the computer you work on.
Often, yes. The permission sits in the privacy policy and in settings that arrive turned on. Gemini’s activity setting is on for adults until you turn it off. Public posts can be copied without asking you.
Partly. Turn off Gemini Apps Activity, disconnect Gmail and Drive, and turn off Workspace smart features. The AI answers in Search have no full off switch. Another search engine is the reliable fix.
Notice and transparency were breached. The face scan was allowed on appeal for a limited crime purpose. Your face can be processed without a sign you noticed. That processing is still regulated.
Organisations must say in their privacy policy when AI uses your personal information in a decision that significantly affects you. They do not have to stop.
No. Deletion removes the stored chat. It does not untrain a model already built from it. Gemini can also retain chats for about 72 hours after activity is off.
For Australians, a GrapheneOS Privacy Phone on a Pixel. GrapheneOS does not ship Google AI in the OS; sandboxed Google Play is optional.
The off switches and fewer uploads this week. A de-Googled phone and a private laptop if you want the device itself out of the training feed.
AI brings benefits, but also a collection problem Australia has already decided it does not trust. The December rule will make some decisions visible but will not empty files already uploaded.
The good news is that you still have measures to protect yourself through awareness, smart tool choices, and choosing devices built to protect your personal data.
-> See Privacy Phones
-> Learn How to Delete Your Personal Data
-> Discover free Privacy Tools
