Research · Retail data and consumer autonomy
You can like the shop and still say no to the profile. Buying paint, getting a receipt and joining a loyalty program should not become one inseparable decision about how your life is recorded.
Trusting a shop is not consenting to everything behind it
A familiar retailer can earn trust through useful staff, fair returns and products that do the job. That does not answer a different question: what happens when information from separate shopping trips, websites and brands is brought together?
The issue is not whether technology can make shopping easier. It is whether convenience comes with a clear choice about the data used to provide it.
The receipt is not the whole story
Wesfarmers describes OneData as a group-wide shared asset with approximately 12 million customer records, used for customer insights and personalisation. That is the company’s reported scale, not a count of every Bunnings shopper. Wesfarmers disclosure.
OnePass discloses matching information across participating businesses, including shopping activity and identifiers. Its policy also allows information from before membership and the creation of inferred characteristics. These are disclosed permissions, not proof that every possible match happens to every member. OnePass privacy policy.
That combination is the join. A record that is ordinary on its own can say much more when linked to other records. The question is whether a customer can understand and refuse the optional joining while remaining a customer.
Unsubscribing is not the same decision
The policy describes marketing and browser controls, but they are not presented as one universal switch stopping all optional cross-business matching. That does not prove no other control exists. It is the practical control this proposal asks retailers to make explicit. Published controls.
The existing privacy framework already contains protections. The proposal is to make the choices easier to exercise at the point they matter, rather than treat every privacy policy as a substitute for a usable control.
Helpful AI should still explain its boundaries
Bunnings Buddy’s terms describe stored interactions and retention periods, and say inputs are not used to train its underlying large language models. Those terms do not establish that Buddy draws on OneData or adjusts prices to an individual profile. Buddy terms.
A general reform should require a clear notice when stored personal information shapes a recommendation, plus a way to use the service without optional personalisation. Useful assistance and silent profiling are different things.
Did you know? Did you choose? Can you say no?
These are the tests behind the proposed reform: an ordinary purchase without compulsory profiling; information used for the purpose you provided it for; a real refusal control; a readable account of what was joined; limits on unnecessary retention; and a non-personalised shopping option.
They are proposed rights, not a claim that those rights already apply in this form.
What this article does not claim
It does not allege unlawful conduct, universal inclusion in a shared database, sale of raw customer records, direct government access, or personalised pricing through Buddy. Corporate disclosures describe capabilities and permissions; they do not show how a particular person’s records were used.