Privacy complaints rose 60 per cent in a year. The regulator links the rise to concern about AI companies, among others, but its annual report gives no count of complaints about them

The OAIC is the national privacy regulator, and its annual report is where it accounts for what came in and what it did about it. The headline number for 2025–26 is the complaint count. Explaining it, the report says the rise appears to be attributable to Australians’ increased concern about privacy, especially in relation to digital and data-driven sectors such as social media, and AI companies and data brokers.

The evidence it gives for that is a footnote to the Australian Community Attitudes to Privacy Survey 2026, the triennial survey the OAIC published in May. That survey is a good instrument, and we read it in full in July: it put AI companies equal-last on trust with personal information, on 4 per cent, level with data brokers. But it measures what Australians think. It does not count what they complain about.

What the complaint figures show

The report breaks complaints down by sector. The ten largest:

Social media moved from 7 per cent of complaints to 10 per cent and passed the Australian Government sector for third place. Online services rose 88 per cent. The report does not say which of its sectors a complaint about an AI company is counted under, and nowhere in the volume we read gives a number of complaints about AI or automated decisions. The most common issues raised were the same as the year before: security of personal information (29 per cent), use or disclosure (28 per cent) and access to it (27 per cent).

What the report says the OAIC did on AI

• Determinations. The Privacy Commissioner’s overview lists major determinations on tracking pixels, rent tech apps and facial recognition technology, and new guidance on facial recognition in retail settings.
• AI training data. The overview says the OAIC’s investigation into I-MED Radiology Network showed that better-practice de-identification in training AI models is possible.
• Guidance. A blog post on generative AI tools in the workplace, with a case study on privacy governance.
• Internationally. A resolution the OAIC put to the 47th Global Privacy Assembly, on principles for using personal data to pretrain, train and fine-tune AI models, was adopted and co-sponsored by 15 other privacy and data protection authorities.
• In house. Work began on an OAIC AI subcommittee, to meet its obligations under the APS AI Plan 2025.

Two dates in December matter more than any of that. The automated decision-making transparency obligation commences on 10 December 2026, and the Children’s Online Privacy Code must be registered by the same day. The Privacy Commissioner, Carly Kind, ends her overview looking further out: As new technologies such as AI agents and surveillance wearables become more commonplace, Australians expect their privacy regulator to continue to advocate for and take action to protect their privacy. The report covers the year to 30 June, so it predates the investigation the OAIC announced on 7 October into the maker of the app behind Kmart’s smart glasses.

Our view

This is opinion, built on the report and the survey above. The OAIC’s reading is plausible: Australians distrust AI companies more than almost anyone else holding their data, and complaints rose sharply in the same year. But a plausible reading drawn from an attitudes survey is not a finding drawn from complaints, and the report presents it in the same breath as the counts. The report already breaks complaints down by sector and by the privacy principle they raise. Adding a marker for complaints that involve AI or automated decisions would let next year’s report say whether AI companies are in fact driving the workload, and would give the ADM obligation, which starts on 10 December, a baseline to be measured against. A regulator that names AI as a priority should be able to count it.

Sources

Method note. Written substantially by AI and run by people, working from the primary sources below. 3 quotes here were verified by script against copies of the sources we archived. How AI Geek works.

1. OAIC, Annual Report 2025–26, Volume 1 (PDF, 48 pages, read 29 October 2026): the complaint figures and their attribution, Table 3 (complaints by sector), the issue breakdown, the Privacy Commissioner’s overview, the ADM and Children’s Online Privacy Code dates, the Global Privacy Assembly resolution and the AI subcommittee.
2. OAIC, OAIC annual report shows growing demand as Australians engage privacy and information access rights, published 22 October 2026 (read 29 October 2026): the publication date and the key statistics, including 5,268 complaints received.
3. OAIC, Australian Community Attitudes to Privacy Survey 2026 (PDF): the trust figures for AI companies and data brokers, as reported in our 28 July story.
4. OAIC, OAIC opens investigation into maker of HeyCyan smart glasses phone app: the 7 October investigation, as reported in our 18 October story.

Methodology. We read Volume 1 of the annual report and the media release on 29 October 2026, a week after publication, and searched the full text of Volume 1 for artificial intelligence, AI, automated decision-making, facial recognition and generative AI. We did not read Volume 2, which covers freedom of information. The sector table reproduces the OAIC’s figures, shares and changes as published; we have not recalculated them. We did not ask the OAIC how complaints about AI companies are classified. The paragraph under “Our view” is our analysis, honestly held, built on the sourced facts above and labelled as opinion.