How Websites Use Your Data, and What It Means for Your Business
Every time you visit a website, fill in a form or click “Accept” on a cookie banner, information about you is collected. Most of it is used for ordinary reasons, such as remembering what is in your cart or counting visitors. Some of it is shared with advertising and analytics companies you may never have heard of.
For a small business, this question has two sides. You are a website visitor, but you probably also run a website that collects data from your own customers. This guide covers both: how websites use data, and what that means for your business website.
What websites collect
Website data generally falls into two groups.
Information you give
- Names, emails and phone numbers entered into contact or quote forms.
- Account details when you register or buy something.
- Payment details, usually handled by a payment provider rather than the website itself.
Information collected automatically
- Your IP address, browser and device type.
- Pages you view, how long you stay and what you click.
- Cookies that remember you between visits.
- Tracking pixels: tiny pieces of code from platforms such as social media and advertising networks that report your activity back to them.
How that data is used and shared
Most websites use data for a mix of reasons:
- Making the site work, such as keeping you logged in or holding items in a cart.
- Measuring traffic to see which pages are popular.
- Advertising, such as showing you ads for a product after you looked at it.
- Following up enquiries by email or phone.
The part many people do not realise is how much is shared. A typical small business website may send data to an analytics service, one or more advertising platforms, a form plugin, an email marketing tool and a chat widget. Each of those is a separate company with its own policies.
If you run a business website: your obligations
Whether the Privacy Act applies to you depends on your business. Most organisations with annual turnover above $3 million are covered. Smaller businesses are generally exempt, but not if, for example, they provide a health service or trade in personal information. Even if you are exempt, customers expect their data to be handled carefully, and many larger clients now ask suppliers about it.
Be careful with tracking pixels
In November 2024 the OAIC published guidance on tracking pixels. It makes clear that businesses using them are responsible for making sure they are configured and used in line with the Privacy Act, and that this is not a “set and forget” task. The OAIC’s research found 69% of adults did not think it fair and reasonable for their personal information to be used for online tracking, profiling and targeted advertising.
A common problem is a pixel added for marketing that quietly sends details from enquiry or booking forms to an advertising platform. If you are not sure what your website sends and where, it is worth checking.
Watch for automated decisions
From 10 December 2026, organisations covered by the Privacy Act that use personal information in automated decisions that could significantly affect someone’s rights or interests will need to explain this in their privacy policy. If your website or systems approve, decline or price things automatically, ask your adviser whether this applies.
Good practice for any business website
- List every third-party tool on your website and what data it receives.
- Remove what you do not use, such as old pixels and plugins from past campaigns.
- Collect less. If a quote form does not need a date of birth, do not ask for it.
- Publish a clear privacy policy that matches what the site really does.
- Secure the site: HTTPS everywhere, plugins and themes kept up to date, strong admin passwords with MFA.
- Control where form entries go. Enquiries sitting in a shared inbox or an old plugin database can be exposed in a breach.
- Delete old data you no longer need.
Our website design team builds sites with this in mind, and can review an existing site’s plugins, forms and tracking.
Protecting yourself as a visitor
- Use the “reject” or “manage” option on cookie banners when you do not want advertising cookies.
- Check your browser’s privacy settings and consider blocking third-party cookies.
- Give only the information a form really needs.
- Use a unique password for each site, so one breach does not unlock others.
- Be cautious with free quizzes, competitions and apps that ask for lots of personal detail.
If a website you used has been breached, our guide to what to do when your data reaches the dark web covers the next steps.
Key takeaways
- Websites collect both what you type and what you do.
- Much of that data is shared with third-party tools.
- Businesses are responsible for the trackers on their own sites.
- Collect less, secure what you keep, and be open about it.
Website security is part of your wider IT security. Our managed IT security service helps businesses look after both.
Do you know what your website is collecting?
Our free IT Health Check reviews how your business collects, stores and protects customer data, and gives you a clear list of what to fix.
Or call 1300 133 770.
