Why banning targeted advertising will not stop data collection

Targeted advertising is the most visible expression of the commercial internet’s appetite for personal information. It is also an appealing political target: restrict behavioural ads, weaken the incentive to track people, and perhaps the endless collection of location histories, browsing records and inferred preferences will slow down. That outcome is possible at the margins, but it does not follow automatically.

Data has value beyond the advertisements shown on a screen. Companies use it to measure products, prevent fraud, personalise services, train models, assess risk, negotiate with partners and decide what deserves attention. A ban on targeted advertising could remove one important revenue stream while leaving the broader infrastructure of observation intact.

Advertising is only one use for personal information

The advertising system turns data into audience segments. A person may be placed into categories such as “new parent”, “frequent traveller” or “likely to move house”, then made available to an advertiser through an auction. This process can involve websites, apps, data brokers, identity-matching services and advertising exchanges. It is a significant privacy problem, but it is not the same thing as data collection itself.

A company may still record clicks, searches, purchases, device identifiers and approximate location after behavioural advertising is prohibited. Those records can support internal analytics, recommendation systems, customer service, security checks and product development. A retailer could stop allowing an external advertiser to target a customer while continuing to maintain a detailed customer profile for its own purposes.

This is why the surveillance business model is broader than the advertisements that happen to appear on a news site. The commercial logic begins with observation and ends in many different decisions. Advertising is one destination for the data, not the only destination.

First-party tracking can survive an advertising ban

A ban aimed at third-party cookies or cross-site tracking would leave first-party data largely untouched. Supermarkets, banks, streaming services and large online retailers can collect information directly from logged-in users. The data may be gathered under terms of service that describe personalisation, service improvement, security or research rather than advertising.

Australian consumers encounter this model in ordinary routines. Someone using a Flybuys or Everyday Rewards card receives discounts and points while generating a purchase history. A person tapping an Opal card in Sydney or using a Myki card in Melbourne creates a record of travel activity, even though the transport authority is not selling that journey as a banner-ad audience. A customer’s interaction with a telco, delivery service or banking app produces further records that can remain valuable without targeted advertising.

The distinction between “advertising data” and “business data” is often artificial. A supermarket may use shopping history to personalise offers, forecast demand and evaluate suppliers. A bank may use transaction information to detect fraud and estimate financial risk. Removing personalised ads does not compel either organisation to delete information that it considers necessary for its own operations.

Data brokers operate outside the visible ad

The information economy also includes companies that people rarely recognise as part of an advertising transaction. Data brokers combine public records, loyalty programmes, app activity, surveys, purchase histories and commercially available databases. They may sell marketing lists, identity verification, fraud signals, audience insights or risk scores. A consumer can be profiled without ever seeing an advertisement based on the profile.

Some of these firms would lose revenue if advertising demand weakened, but others could redirect their services. The same data might be sold to insurers, lenders, employers, landlords, political consultants or security vendors. A person’s inferred income, health interest, household composition or movements can influence a decision without any promotional message being delivered.

An advertising ban could even encourage companies to describe collection in less recognisable terms. “Personalisation” may become “service optimisation”; “audience profiling” may become “business intelligence”; “tracking” may be framed as “fraud prevention”. Those activities can be legitimate in particular circumstances, yet vague labels make it difficult for people to know what is happening or challenge an unfair inference.

The deeper issue is power over information. An independent privacy perspective can help separate the question of what a company displays from the more important question of what it knows, how long it keeps that knowledge and who can obtain it.

Australian privacy rules leave important gaps

Australia’s Privacy Act 1988 and the Australian Privacy Principles provide a framework for handling personal information, but they do not create a simple right to live unobserved. Coverage depends on whether an organisation is covered by the Act, whether information is reasonably identifiable and whether a collection is reasonably necessary for an organisation’s functions or activities. Small businesses have historically been a major exception, although reform proposals and recent legislative changes have put pressure on that boundary.

The 2024 privacy amendments strengthened protections in areas such as doxxing and introduced a statutory tort for serious invasions of privacy, while broader reform remains an evolving policy issue. The result is a system in transition rather than a complete answer to online profiling. Consent notices can still be lengthy, bundled or difficult to refuse, and many people have little practical bargaining power when a service is essential.

Australia’s Consumer Data Right offers another useful example. It is designed to give consumers greater control over certain data held by banks, energy companies and other participating sectors, including the ability to direct information to an accredited recipient. That can improve portability and competition, but moving data more easily is not the same as collecting less data. More transfers can create more points of exposure unless retention, access and deletion are tightly controlled.

A targeted-advertising prohibition would therefore need to fit inside a wider privacy framework. It would have to address data minimisation, sensitive information, retention periods, broker access, automated decisions and meaningful consent. Without those measures, the law could produce a cleaner advertising interface while leaving the underlying surveillance market mostly untouched.

Banning the use of data is different from deleting it

There is a valuable distinction between limiting a company’s use of information and requiring the information not to be collected in the first place. A platform might be forbidden from using browsing behaviour to select an advertisement but still retain the behaviour for security monitoring, recommendation systems or future commercial purposes. If the rule does not specify deletion or strict retention limits, stored data remains available for later uses.

Future uses matter because data can become more revealing as analytical tools improve. A location trail that once seemed too imprecise to identify a person may be combined with other records. A sequence of purchases can reveal religious observance, medical concerns or relationship changes. Machine-learning systems can infer characteristics that a person never deliberately disclosed.

This creates a risk of policy substitution. Companies may stop showing ads based on a named interest but continue to rank users, predict churn, calculate eligibility or adjust prices according to hidden scores. The individual experiences less obvious targeting while automated judgments remain in place.

Effective regulation should therefore ask several separate questions: Was the data collected fairly? Was the purpose specific and expected? Is the information necessary? How long will it be held? Can it be sold or matched with another dataset? Can a person inspect, correct or delete it? These questions remain relevant even when advertising disappears.

Restrictions can shift the internet’s business model

Advertising bans may still be worthwhile. Behavioural advertising can encourage invasive tracking, expose sensitive characteristics and reward interfaces designed to maximise attention. Restricting cross-site surveillance, banning the use of sensitive data for ad targeting and requiring clear refusal mechanisms could reduce harmful practices.

Yet a broad ban can also change who has an advantage. Large platforms with huge logged-in audiences can rely on their own first-party data, while smaller publishers may lose revenue and become more dependent on major technology companies. Free news websites, local media and community services could face pressure to introduce subscriptions, paywalls or more aggressive forms of registration.

The Australian market illustrates the tension. A reader in Brisbane, Perth or Adelaide may move between local news, national media, retail and government services during a single day. If every service responds to advertising restrictions by demanding an account, collecting email addresses and building a direct relationship with the visitor, the visible third-party tracker may vanish while the number of first-party databases grows.

Subscription models are not automatically private either. A paid service still records payment details, login activity, device information and usage patterns. Some organisations may use that data responsibly, while others may retain it indefinitely or share it with contractors. Changing the payment model does not remove the need for limits on collection.

The best policy would combine advertising restrictions with obligations that apply across business models. Publishers should be able to earn revenue without forcing readers into pervasive monitoring, and platforms should not be allowed to treat first-party data as an unrestricted substitute for third-party tracking.

What would actually reduce data collection

The most direct way to reduce surveillance is to regulate the collection itself. Organisations should gather only information needed for a clearly stated purpose, keep it for a defined period and delete it when that purpose ends. A genuine refusal should not require a person to surrender access to an essential service, and consent should not be buried in a maze of settings.

Data brokers require particular attention. A public register of brokers, stronger rights to discover and erase profiles, restrictions on sensitive inferences and independent audits would make the market more visible. Companies should also have to disclose when an automated decision relies on purchased or inferred information, especially in areas such as credit, employment, insurance and housing.

Technical design matters as well. Browsers and mobile operating systems can limit covert identifiers, while websites can avoid collecting precise location when a rough region is sufficient. Privacy-preserving measurement can help publishers understand readership without constructing individual histories. Encryption, local processing and short retention periods reduce the damage when systems are breached.

Consumers can take modest steps, but responsibility cannot rest with individuals navigating hundreds of consent banners. Australians can use loyalty cards selectively, review app permissions, avoid unnecessary account creation and ask organisations what information they hold. Those actions matter, yet meaningful change requires enforceable rules that make restraint the normal business practice rather than a specialist choice.

A ban on targeted advertising can be one part of that change, particularly where it removes incentives for cross-site tracking and sensitive profiling. It becomes misleading when presented as a complete privacy solution. The real test is whether fewer records are created, fewer profiles are traded and fewer decisions are made from information people never expected to disclose.

The same principle applies to wider ideas about personal discipline and modern digital life: attractive outcomes often depend on invisible systems, repeated choices and incentives rather than slogans about individual behaviour. A critical look at successful habits is useful here because privacy also improves through ordinary, repeatable decisions rather than a single dramatic gesture.

The practical next step is to open the privacy settings for one loyalty programme or app you use, list what it collects and switch off every optional permission that is not needed for the service.