The sequence matters, because it explains why guidance is being updated rather than written. The Privacy Commissioner made a determination against Bunnings in November 2024. Bunnings sought review. In February 2026 the Administrative Review Tribunal affirmed aspects of that determination and, in the OAIC’s words, “confirmed that there is a high bar for using facial recognition technology in Australia”. The regulator now says the matter concluded with an ART decision in March 2026.
Those two dates appear in the same release and we have not reconciled them from published material; the likeliest reading is a substantive decision followed by a final one, but that is inference and we are flagging it rather than asserting it.
What actually changed in the guidance
One thing, and it is the thing retailers were arguing about. The update “provides greater clarity on how exceptions to the obligation to obtain consent when collecting sensitive information, including biometric information, should be applied in retail settings”.
Faces are sensitive information under the Privacy Act, and collecting sensitive information generally requires consent. A shopper walking through a door does not give it. So every retail FRT deployment has depended on whether an exception applies, and the exceptions are where the argument has been. The Tribunal ruled on that ground and the guidance now reflects what it said.
What has not changed is the requirement to think for yourself. The Commissioner is explicit: “The guidance remains clear, however, that each proposed deployment of FRT will need to be assessed against the requirements of the Act.” The OAIC frames the update as supporting retailers in making those contextual assessments, not replacing them.
The regulator is citing public opinion as a legal input
The Commissioner links the standard directly to community expectation: “A precautionary approach to the deployment of FRT is required under Australian law. This is consistent with the expectations of the Australian community, a significant and growing proportion of whom think facial recognition technology is one of the biggest privacy risks they face today.”
The number attached to that is 27 per cent in 2023 rising to 45 per cent in 2026, from the Australian Community Attitudes to Privacy Survey, the same survey we read in full three days ago. Nearly half the country now rates facial recognition among the biggest privacy risks it faces, and that figure has risen by two-thirds in three years.
Our view, labelled as such: quoting an attitudes survey inside a statement about what the law requires is worth noticing. Community expectation is not a section of the Privacy Act, and the Commissioner is not claiming it is. But “reasonable” and “proportionate” do a great deal of work in privacy law, and what a reasonable person expects is exactly the kind of thing a survey can evidence. A regulator putting that number in the same paragraph as the legal standard is signalling how it intends to read those words.
The second case is still running
Bunnings is finished. The other one is not. A separate determination issued in August 2025 against Kmart, concerning its use of FRT, remains under review in the Administrative Review Tribunal, with hearings scheduled for early 2027.
So the guidance published this week reflects settled law on one matter while a second is still before the Tribunal. Anyone treating the update as the final word should hold that lightly for another year and a bit.
How we sourced this
The publication of the updated guidance on 29 July 2026, its scope (APP entities considering FRT in high volume and publicly accessible physical spaces such as retail shopfronts), the Bunnings matter covering 62 stores between 2018 and 2021, the November 2024 determination, the February 2026 ART affirmation and the March 2026 conclusion, the specific change regarding exceptions to the consent obligation for sensitive and biometric information, all quotations from the Privacy Commissioner, the ACAPS figures of 27 per cent in 2023 and 45 per cent in 2026, and the status of the August 2025 Kmart determination with hearings in early 2027 are from the OAIC media release “Privacy Commissioner publishes updated guidance on facial recognition in retail spaces”, read on 31 July 2026.
We have not read the updated guidance document itself, only the regulator’s description of what changed in it, nor the Tribunal’s decision. The February and March 2026 dates both appear in the release and we have not reconciled them. Nothing here is a claim about the conduct of any retailer beyond what the regulator and the Tribunal have published; the Kmart matter is under review and no finding about it is final. The paragraph beginning “Our view” is opinion, built on the sourced facts above it.
Sources
- Office of the Australian Information Commissioner, Privacy Commissioner publishes updated guidance on facial recognition in retail spaces (media release, published 29 July 2026, read 31 July 2026): the guidance update and its scope, the Bunnings matter and its 62 stores between 2018 and 2021, the November 2024 determination and the February and March 2026 Tribunal decisions, the clarification on consent exceptions for sensitive and biometric information, the Privacy Commissioner's quotations including the precautionary-approach standard, the ACAPS 27 per cent to 45 per cent figures, and the status of the Kmart determination.
- AI Geek, Four per cent of Australians trust AI companies: our reading of the 2026 Australian Community Attitudes to Privacy Survey the Commissioner cites.
Spotted an error? Tell us and we will check it against the sources and log the outcome here.