Australians will have better privacy protections and small businesses will need to invest more in data security under proposed laws flagged by the government.
Concerns over complex and lengthy privacy policies that lead to Australians simply ticking the box to get their product or service without reading disclaimers have prompted Attorney-General Mark Dreyfus to agree in principle to undertake reforms.
They include protecting against "dark patterns" that nudge users to consent to more privacy intrusions than necessary, Mr Dreyfus says in a response to a review of privacy laws.
University of Technology academic Kate Bower said the reforms were a step in the right direction.
"Each day we delay is another day that Australians are vulnerable to privacy harm from high-risk technologies," Dr Bower said.
The government has provided in-principle support to giving Australians a right to have their data erased, although any new laws would not override existing requirements such as the retention of identification records or criminal records.
A ban on targeted marketing that is based on sensitive information, unless it is socially beneficial, is being considered by the government.
Children are to gain more protections, with entities set to be prohibited from directly marketing towards kids and trading their personal information.
A children's online privacy code will ensure their best interests are considered when their personal information is handled.
The government has also given in-principle support to the notion that any targeting of children by an organisation would only be done if it is in the child's best interest.
Small businesses could lose their exemption to obligations on large corporations under the Privacy Act, and would need to invest more in keeping personal information secure and notify consumers in the event of a data breach.
Australian Small Business and Family Enterprise Ombudsman Bruce Billson welcomed the "right-sized" reforms.
But shadow attorney-general Michaelia Cash said the proposals could be "imposing more complexity and costs at a time when (small businesses) are already struggling".
Expanding personal data protections is also being examined, with online identifiers such as IP addresses and cookies providing a reasonable chance of identifying a person as new technologies become more integrated in public life.
It would expand on traditional protections that include keeping names and street addresses private.
There are also considerations for a right to be forgotten, where search engines remove certain results linked to a person's name on limited grounds.
Mr Dreyfus said Australians handing over their data rightly had an expectation that it would be protected.
"The Albanese government is committed to ensuring Australians can benefit from the latest technologies while knowing that their personal information is safe and secure," he said in a statement.
Think tank Reset.Tech said there was more work to be done.
"It's a pity the government are cowering to big business pressure," executive director Alice Dawkins said.
"Participation in the digital world is not optional ... we shouldn't have our rights violated when we go about (our) day-to-day business."
Of the 116 recommendations from the Privacy Act review, the government has agreed to 38, agreed in principle to a further 68 and noted 10.
A proposal to narrow the exemption for politicians was among those noted.
Privacy reforms are set to be introduced into parliament in 2024.
