March 29, 2023

Not a Fair Trade

Consumer Views on how businesses use their data

This working paper explores consumer sentiment on privacy practices and protections. CPRC conducted a nationally representative survey of 1,000 Australians on their views on how personal information is collected, shared and used by businesses.

Download Full Report

What did we find?

Today, most protections for consumers are based on notification and consent. Practically, this means that people are asked to accept long and unhelpful privacy policies, often as the precursor to accessing a product or service. It’s difficult, if not impossible, to really understand how a business will actually use your data. If you don’t like what a business plans to do with your data, you typically have two choices: accept it or don’t shop with that business. The take-itor-leave-it approach to privacy policies doesn’t give people real choice and doesn’t offer meaningful protection against harmful data practices.

Business accountability



Only 7 % feel companies give them real choices to protect their privacy online



84% agree that a company should be responsible for keeping data safe



Only 15% businesses are doing enough to protect privacy



agree that companies should always act in the best interest of the consumer when it uses data



79% agree that a company should only collect information about them that they need to provide a service or product.

Sharing and Selling Consumer Data



are not comfortable with companies sharing or selling their personal information with other companies.



agree that a company should not sell people’s data under any circumstances



find it unfair that companies require you to supply more personal information than is necessary to deliver the product or service



expect businesses to protect people’s information from being used in ways that leaves them worse-off.

Targeted advertising

Less than 10% are comfortable with the current approach to targeted advertising with tracking of online behaviour or personal characteristics without giving expressed permission.
70% are not comfortable with companies monitoring their online behaviour.

Help and Redress


agree that it’s time-consuming to find actions to protect their privacy online


do not know where to seek help from if they have a problem with how a company collects, shares and uses their personal information


agree that a regulator should have enough staff and resources to investigate how companies collect, share and use personal information.

What does this mean?

The survey results confirm that Australians need and deserve privacy protections that:

  • modernise what it means to be identifiable to cover information obtained from any source and by any means
  • include consumer protections to go beyond notification and consent
  • require all businesses to assess and ensure how they collect and use data leads to fair outcomes for their customers and the community, and
  • empower the regulator to swiftly ban or restrict harmful practices that cause direct and clear consumer harms provide a clear pathway to redress when things go wrong.

Next steps

  • CPRC will be making a submission to the consultation on the
  • CPRC welcomes the opportunity to work further on this issue with government, regulators, policy makers, academia and the community sector.
  • For a one-on-one briefing on the survey results or if you wish to collaborate, book a briefing with Chandni Gupta.

About the author:


Chandni Gupta

Digital Policy Director

Chandni leads CPRC’s research stream on protecting consumers in a digital world. Her work to date includes exploring the consumer shift from the analogue towards the digital economy, the impact of deceptive and manipulative online design on Australian consumers and the key gaps that currently exist in Australia’s consumer protections.


Book a Briefing

Other reports

Newsletter sign-up

This field is for validation purposes and should be left unchanged.
Skip to content