Contemporary issue: technology and consumers: HSC Legal Studies

What this dot point is asking

Technology is one of the four contemporary issues that must be studied in the Consumers option of the Legal Studies Stage 6 Syllabus (2009). You must identify and investigate the issue and evaluate the effectiveness of legal and non-legal responses to it.

The 2009 syllabus was written when "technology" meant mainly online shopping and spam. In 2026 the issue is much broader: scams on an industrial scale, data breaches affecting millions, subscriptions that are easy to start and hard to cancel, and manipulative website design. The 2024 HSC paired technology with credit and asked how effective legal responses are; NESA wanted students to state the issues for consumers clearly and support a judgement with evidence. Marketing techniques that rely on technology, such as influencer marketing and drip pricing, are covered on marketing innovations.

The answer

Identifying the issue

Technology affects consumers in five main ways:

1. Online shopping and digital products. Consumers buy from businesses anywhere in the world, often without seeing the product, and buy digital goods (games, apps, streaming) whose "quality" is hard to define.
2. Scams. Scammers use phone calls, text messages, social media, fake websites and investment platforms to steal money, and technology lets them operate at scale from overseas.
3. Data and privacy. Every online transaction collects personal information. Large data breaches expose consumers to identity theft and further scams.
4. Manipulative design. Websites and apps can use "dark patterns": hidden fees revealed at checkout (drip pricing), pre-ticked boxes, countdown timers, and subscriptions that are easy to start and hard to cancel.
5. New technology in products. AI-enabled services, connected devices and algorithms that personalise prices raise new questions about quality, safety and fairness.

Applying existing consumer law online

The ACL is technology neutral: the consumer guarantees and the prohibitions on misleading and unconscionable conduct apply to online transactions as they do in a shop.

• ACCC v Valve Corporation (No 3) [2016] FCA 196. Valve, the US owner of the Steam gaming platform, told Australian consumers they had no right to refunds. The Federal Court held that the ACL applied to Valve because it carried on business in Australia, that the consumer guarantees applied to games, and ordered a $3 million penalty.
• ACCC v Google (2022). The Federal Court ordered Google to pay $60 million for misleading Android users about the collection of their location data. The case linked consumer law and privacy: misleading consumers about data practices is misleading conduct.
• ACCC v Microsoft (filed 27 October 2025). The ACCC alleges that when Microsoft integrated its Copilot AI assistant into Microsoft 365 Personal and Family plans and raised prices (the Personal plan from $109 to $159 a year), it told about 2.7 million subscribers that they had to accept the higher price or cancel, without disclosing a cheaper "Classic" plan without Copilot. Microsoft apologised and offered refunds to subscribers who moved to the Classic plan by 31 December 2025. These are allegations in a proceeding seeking penalties; check its outcome before treating it as a decided case.

Individual redress online. A consumer can take a claim against an Australian online retailer to NCAT, and against a business that trades in Australia through the ACCC or NSW Fair Trading. Enforcing an order against an overseas seller with no Australian presence is often impossible, so consumers rely on chargebacks through their bank or card provider and on platforms' own dispute processes.

Scams

The scale. The National Anti-Scam Centre's Targeting Scams report (March 2026) found that Australians made 481,523 scam reports in 2025, and that reported losses were $2.18 billion, up 7.8 per cent on 2024. Investment scams caused the largest losses ($837.7 million), followed by payment redirection, romance, phishing and remote access scams. Losses fell substantially from their 2022 peak after new measures were introduced, but rose again in 2025.

Legal responses.

• The National Anti-Scam Centre, established within the ACCC on 1 July 2023, coordinates government, banks, telcos and platforms to share intelligence and disrupt scams (for example, taking down fake investment websites). It runs Scamwatch, which receives reports and publishes alerts.
• Telecommunications rules: an industry code registered and enforced by ACMA requires telcos to identify, trace and block scam calls and texts.
• The Scams Prevention Framework Act 2025 (Cth) inserted a Scams Prevention Framework into the Competition and Consumer Act 2010, commencing on 21 February 2025. It applies to sectors designated by the Minister. Banks, telecommunications providers and certain digital platforms (social media, instant messaging and internet search engine services) were designated in May 2026. Regulated businesses must comply with principles requiring them to govern, prevent, detect, report, disrupt and respond to scams, backed by civil penalties. The obligations are phased in: the SPF Rules commenced on 1 September 2026, when regulated businesses also had to join AFCA, and the main obligations apply from 31 March 2027. Mandatory sector codes, released in draft in May 2026, are to follow. AFCA is the single external dispute resolution scheme: for matters occurring from 31 March 2027, consumers can seek compensation from a business that failed to meet its obligations.

Evaluation. The framework is significant because it shifts responsibility from individual victims, who were usually told they had authorised the payment, to the businesses whose services scammers use. But it is being phased in, its main obligations do not apply until 31 March 2027, its codes were still in draft in mid-2026, and it does not reach scammers themselves, who are mostly offshore. Critics, including consumer groups, have argued that the UK's mandatory reimbursement model protects victims more directly.

Data breaches and privacy

The issue. In September 2022 a cyberattack on Optus exposed the personal information of millions of customers, and in October 2022 a cyberattack on Medibank exposed health claims data, some of which criminals published online. The Australian Information Commissioner has brought civil penalty proceedings in the Federal Court alleging that Optus seriously interfered with the privacy of about 9.5 million Australians and Medibank with the privacy of about 9.7 million, by failing to take reasonable steps to protect their personal information. These are allegations; the proceedings were continuing in 2026.

Legal responses.

• The Privacy Act 1988 (Cth) and its Australian Privacy Principles require businesses with a turnover above $3 million (and some smaller ones) to protect personal information (APP 11). The notifiable data breaches scheme requires them to notify affected individuals and the OAIC of an eligible data breach.
• Higher penalties. After the 2022 breaches, Parliament raised the maximum penalty for serious or repeated interferences with privacy in late 2022, to the greater of $50 million, three times the benefit, or 30 per cent of adjusted turnover.
• The first penalty. In October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million, the first civil penalties under the Privacy Act, after a February 2022 breach at its Medlab Pathology business exposed the information of more than 223,000 people. The penalty included $4.2 million for failing to take reasonable steps to secure personal information.
• The Privacy and Other Legislation Amendment Act 2024 (Cth) created a statutory tort for serious invasions of privacy, which commenced on 10 June 2025. Individuals can sue for an intrusion into their seclusion or misuse of their information where they had a reasonable expectation of privacy; damages for emotional distress are available without proving other loss. The Act also gave the OAIC new enforcement tools and required it to make a Children's Online Privacy Code by 10 December 2026; the OAIC released an exposure draft of the code for consultation from 31 March to 5 June 2026.

Evaluation. Privacy law has moved from a weakly enforced, complaints-based regime to one with real penalties and a private right of action. But the law still responds after a breach. A second stage of reform, the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 (which would, among other things, replace several obligations with a single "fair and reasonable" test for handling personal information), was released for consultation, with submissions closing on 18 September 2026; it was not law as at September 2026.

Manipulative design, drip pricing and subscription traps

The ACL's ban on misleading conduct struggles with practices that are not false but exploit behaviour: hiding the cancel button, making consumers click through multiple screens, revealing fees late, or using false urgency. In July 2026 Parliament passed the Competition and Consumer Amendment (Unfair Trading Practices) Bill 2026. From 1 July 2027 it will:

• prohibit unfair trading practices that manipulate a consumer, or unreasonably distort the environment in which they make a decision, and cause them detriment;
• require transaction-based fees to be displayed with the base price, to combat drip pricing; and
• require businesses to provide an easy and straightforward way to cancel subscriptions, ending subscription traps.

Penalties will be the same as for other serious ACL breaches, up to $100 million for a corporation. The law responds to years of advocacy by CHOICE and consumer groups, and to evidence from the ACCC's digital platform services inquiries.

Non-legal responses

• Awareness. Scamwatch alerts, bank and telco warnings, and campaigns such as "Stop. Check. Protect." teach consumers to recognise scams.
• Industry action. Banks introduced confirmation of payee checks and delays on unusual payments; telcos block scam calls; platforms remove scam ads (often slowly).
• NGOs. CHOICE investigates online practices and campaigned for the unfair trading practices law; IDCARE helps victims of identity theft; consumer legal centres assist scam victims with bank and AFCA disputes.
• The media. Reporting of the Optus and Medibank breaches and of individual scam losses created pressure for the 2022 penalty increases, the 2024 privacy reforms and the scams framework.

Evaluating the effectiveness of legal and non-legal responses

Judgement. Legal and non-legal responses to technology are effective to a moderate and increasing extent. The law has shifted from applying general rules online to building technology-specific regimes that place obligations on the businesses best placed to prevent harm: banks, telcos, platforms and data holders. But the pattern is reactive: the privacy reforms followed the 2022 breaches, the scams framework followed years of rising losses, and the unfair trading practices ban will not commence until 2027. The global and fast-changing nature of technology means Australian law will always struggle to reach offenders overseas, so prevention through awareness and industry obligations remains essential.

In one sentence

Technology has exposed consumers to overseas sellers, industrial-scale scams, massive data breaches and manipulative design, and although the ACL applies online and new laws on scams, privacy and unfair trading practices place real obligations on businesses, the law remains a step behind technology and struggles to reach offenders overseas.

Try this

Q1. Identify TWO issues for consumers arising from technology. (2 marks)

• What the marker wants. Two clear issues, such as scams and data breaches.

Q2. Explain how the law responds to data breaches. (5 marks)

• What the marker wants. The Privacy Act and notifiable data breaches, higher penalties, the Australian Clinical Labs penalty, the OAIC's Optus and Medibank proceedings, and the statutory tort.

Q3. To what extent do legal responses protect consumers from scams? (8 marks)

• What the marker wants. The scale of losses, the National Anti-Scam Centre, the Scams Prevention Framework Act 2025 and its phasing, AFCA, limits such as offshore offenders, and a judgement.