Privacy law and online reviews in Australia

Reviews sometimes go beyond opinion and expose personal details — a home address, a phone number, a health condition. Australian privacy law offers some protection, but less than many people expect, and Google's policy is often the more practical tool.

Written by Konrad Weber · Reviewed by Andrew Foster, Review Removal Specialist · Updated 2026-10-11

The Privacy Act 1988 and the APPs

The Privacy Act 1988 (Cth) regulates how "APP entities" — most Australian Government agencies and many private sector organisations — handle personal information. Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. The 13 Australian Privacy Principles (APPs) cover collection, use, disclosure, security, access and correction.

The Act has important gaps for reviews:

• Individuals acting privately are not covered. The APPs do not apply to personal information an individual handles only for their personal, family or household affairs. A customer writing a review is usually in that position.
• Small businesses are generally exempt. Businesses with annual turnover of $3 million or less are generally not APP entities, subject to exceptions (for example, health service providers and businesses that trade in personal information).

So a complaint to the Office of the Australian Information Commissioner (OAIC) about an ordinary reviewer will usually go nowhere. The Privacy Act becomes relevant in the other direction: a business covered by it that responds to a review by disclosing a customer's personal information — for example, posting treatment details in reply to a patient's review — may breach APP 6. Health practices should be especially careful; see dental clinics and medical practices.

The statutory tort for serious invasions of privacy

The Privacy and Other Legislation Amendment Act 2024 inserted Schedule 2 into the Privacy Act, creating a statutory cause of action for serious invasions of privacy. It commenced on 10 June 2025 and, unlike the APPs, it can apply to individuals. A plaintiff must establish that:

1. the defendant invaded their privacy by intruding upon their seclusion or by misusing information relating to them;
2. a person in their position would have had a reasonable expectation of privacy in all the circumstances;
3. the invasion was intentional or reckless (negligence is not enough);
4. the invasion was serious; and
5. the public interest in their privacy outweighs any countervailing public interest, such as freedom of expression.

Actual damage need not be proved. Defences include consent, conduct required or authorised by law, and conduct that would attract certain defamation defences. There are exemptions, including for journalists. Proceedings must generally be brought within one year of the plaintiff becoming aware of the invasion and no later than three years after it, with special rules for people under 18. Damages for non-economic loss and exemplary damages are capped.

For example, imagine a review that discloses a business owner's home address and details of their medical history, posted to intimidate them. That is the type of situation the tort was designed for. A review that names the owner and criticises how they run the business almost certainly is not — the information is not private and the public interest in consumer commentary is strong. The tort is new, and the courts are only beginning to apply it.

Doxxing offences

The same 2024 Act inserted two offences into the Criminal Code, commencing on 11 December 2024. Section 474.17C makes it an offence to use a carriage service to make available, publish or distribute personal data of one or more individuals in a way that reasonable persons would regard as menacing or harassing (maximum 6 years' imprisonment). Section 474.17D is an aggravated form where individuals are targeted because of protected attributes such as race, religion or disability (maximum 7 years). Suspected doxxing should be reported to police; a civil claim and a Google complaint can run alongside.

Google’s personal information policy

Google's Maps user-generated content policy defines personal information as information that applies to a living identifiable person. It prohibits posting another person's personal information without consent, and sharing personally identifiable, financial, medical or identification information about others. It allows names where they are part of a commonly known business or belong to public-facing professionals. A review that publishes someone's private phone number or home address is a strong candidate for a policy complaint, and that route is usually faster and cheaper than any legal claim.

Because the policy allows names of public-facing professionals, a staff member's name mentioned in a review ("Sarah at reception was rude") is not usually a breach on its own. The more sensitive and private the information, and the more clearly it is aimed at harm, the stronger the complaint. The guide to reviews with personal information explains what Google tends to treat as personal information.

Privacy, defamation or policy: choosing the right frame

Privacy and defamation protect different interests. Defamation protects reputation against false statements; privacy protects against the exposure of private information, even when it is true. A review that accurately discloses someone's medical condition is a privacy problem, not a defamation one. A review that falsely accuses someone of a crime is a defamation problem, not a privacy one. Framing a complaint around the wrong interest weakens it, whether it goes to Google or to a court.

Other avenues

Where a review is part of a pattern of serious online abuse targeted at an individual adult, the eSafety Commissioner's adult cyber-abuse scheme under the Online Safety Act 2021 may be relevant. It has a high threshold — the material must be intended to cause serious harm and be menacing, harassing or offensive — and it is aimed at protecting individuals, not business reputations.

If a review exposes your or your staff's personal details, request a free assessment below. We will tell you whether it is a candidate for a complaint to Google under its personal information policy.

Sources

• Privacy Act 1988 (Cth), including Schedule 2 (serious invasions of privacy)
• OAIC — The Privacy Act
• OAIC — Australian Privacy Principles
• OAIC — Small business
• OAIC — What is personal information?
• Criminal Code Act 1995 (Cth) — ss 474.17C and 474.17D
• Google — Maps user-generated content policy (prohibited and restricted content)