Singled Out: Pixels, Identity and the Digital Stack in 2026

Someone looks at running shoes on a retailer's site and leaves without signing in. For a week, the shoes follow them around the internet. Nobody involved knows their name. This panel follows this customer through the systems behind retail media, personalization and retargeting. Most of the players in the chain described above would say nothing identifying was collected. This became harder to argue in 2026. In May, the OAIC's updated collection guidance said inferring something about a person can count as collecting it. In June, the first pixel determinations found a person can be reasonably identifiable when a business can pick them out and reach them again, whatever the sector. The OAIC is already investigating tracking pixels under current law. The draft privacy bill would write singling out into the definition. It would also make passing data on for direct marketing a consented trade, with limited exceptions, even for data you already hold. None of this bans the tools. But you do need to know what you are collecting, whether it is used the way you think it is, and whether your notice and consent cover it. Attendees will leave this session with a seven-question check to run before the regulator asks, and one question for your vendors: when a customer opts out, what actually changes?

What you will learn:

• Whether and how this applies to your entity, where being singled out can make someone identifiable in any sector, and where the sensitive-information rules apply.

• The three kinds of consent that matter now: what you already hold, what today's law requires, what the draft bill would add, and the records that prove each.

• How more strict identity and consent rules could impact competition between walled gardens, retail media networks and the open web.

• Where the automated-decision disclosure rules that start on 10 December may reach the tools that choose who sees which offer.