Privacy Ready
← Learn

APP 2: Anonymity and Pseudonymity

Last updated 22 July 2026 · Reviewed by The PrivacyReady compliance team

The short answer

Australian Privacy Principle 2 requires that individuals be given the option of not identifying themselves, or of using a pseudonym, when dealing with your business — unless it is impracticable to deal with them that way, or a law requires you to identify them. It applies most directly to general enquiries, website browsing, and walk-in interactions, and does not require you to offer anonymity where identification is necessary to provide the service (for example, delivering a purchased product to a named address).

Governing provision Privacy Act 1988 (Cth), Schedule 1, APP 2
Applies when Any interaction where identification is not strictly necessary
Default position Offer anonymity/pseudonymity unless impracticable or legally required to identify
Common exception Where identification is required to complete the transaction
Regulator OAIC

What APP 2 actually requires

APP 2.1 states that individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with an APP entity in relation to a particular matter. The obligation is not absolute: APP 2.2 removes it where identification is required or authorised by law, or where it is impracticable for you to deal with an unidentified or pseudonymous individual.

In practice, this principle is most relevant to the early stages of a customer relationship — general enquiries, price checks, browsing a service before committing — rather than to a completed transaction, where identification is usually necessary to deliver goods, process payment, or meet another legal obligation.

Who this applies to

Any business that has enquiry channels — a contact form, a phone line, a live chat widget, a physical counter — needs to consider whether it is genuinely necessary to collect a name and contact details at that stage, or whether the enquiry could reasonably be handled without identifying the person first.

Common SME failure modes

  • Mandatory name/email fields on general enquiry forms where the enquiry itself does not require identification (e.g. "what are your opening hours?").
  • Requiring account creation to view basic information that could reasonably be public.
  • No pseudonym option in support channels for non-transactional questions.

Practical compliance steps

  1. Review your enquiry and contact channels — identify which fields are genuinely required versus merely convenient to collect.
  2. Make optional fields optional in practice, not just in principle.
  3. Where full identification is necessary (payment, delivery, regulated services), be transparent about why via your APP 5 collection notice.
  4. Train front-line staff to accept general enquiries without insisting on a name where it is not needed.

Frequently asked questions

Does APP 2 mean customers can buy from me anonymously?

No. Where identification is reasonably necessary to complete a transaction — processing payment, arranging delivery, meeting a legal record-keeping obligation — APP 2.2's impracticability exception applies and you are not required to offer anonymity for that step.

Do I need to build a formal "anonymous mode" into my website?

No specific technical feature is mandated. The obligation is about not forcing identification where it is not needed — for example, not requiring an account or a name field to submit a general enquiry.

Does this apply to phone calls and in-person interactions, not just online forms?

Yes. APP 2 is channel-neutral — it applies to any way an individual deals with your business, including phone, in-person, and email.

Use the free Anonymous Options Check to see whether your business touchpoints unnecessarily require identification under APP 2.

Check my APP 2 exposure →