The internet and social media have been with us for so long, it can be hard to recall the first flush of shock when one became aware they were watching us – not just the other way around. One stray reference in an email to getting out in the garden or hiking at the weekend and the sidebar of ads immediately reflects what it deduces must be your heart’s desires.

Having come out on Facebook at the end of year 12, I haven’t exactly been living a digitally clean lifestyle or making it particularly difficult to be targeted by ads. As I entered my late 20s it was still curious to see some of my friends’ social media feeds graduate to being littered with ads for wedding planning while mine remained stubbornly stuck on gay raves.

In advertisers’ reductive view of modern masculinity, my male friends – of whatever sexuality – would all be needing to buy protein powder.

But while consumer awareness grew that this is the way the internet works, Australia’s privacy laws, now more than three decades old, did not change to demand anything different or better.

A long-overdue review into the Privacy Act could have changed that. It all started so promisingly, with proposals to allow users to opt out of targeted ads and erase their data. But these were recommendations from the Attorney General’s Department, not the policy of government.

In September 2023 Labor merely “noted” the call for “an unqualified opt-out of receiving targeted advertising” and many other reforms, including ending small businesses’ exemption to the Privacy Act, were only agreed in principle.

The Albanese government has decided to do privacy reform in two tranches. The first bill, likely to go to caucus on Tuesday and be introduced to parliament on Thursday, would create a right to sue for serious breaches of privacy and implement Labor’s promise to crack down on doxing.

But stakeholders involved in confidential consultations believe that more consumer-friendly measures will be delayed until a second tranche, which is unlikely to be introduced before the next election, due by May 2025.

A children’s online privacy code that recognises the best interests of the child when handling their personal information is believed to be in the first tranche, which would help the attorney general, Mark Dreyfus, defend against the charge of a do-nothing bill. But advocates fear ending the small business exemption has been pushed on to the backburner of the second tranche after an avalanche of industry lobbying about how expensive and difficult this would be.

The government has already bent to media companies and sports codes by proposing a partial, rather than total, gambling ad ban and this is another instance where bolder action to help the consumer would harm financially struggling media companies.

Chandni Gupta, the digital policy director of the Consumer Policy Research Centre, said: “Businesses of all sizes need to be held accountable for the data they collect about us, share about us, and are using.

“The situation at the moment is you could be using the same service, from the same business on the same platform and someone in Munich has better privacy protections than someone in Melbourne,” she said.

Gupta noted that real estate agents – who lobbied against the change – “collect a lot of sensitive data about us” but many are exempt from the Privacy Act because they are small businesses.

John Pane, the chair of Electronic Frontiers Australia, said it was “great to see” the tort of serious invasion of privacy will be introduced, but advocates are otherwise “very disappointed” and believe the government has “dropped the ball”.

“Historically, organisations that have made representations that oppose introduction of privacy law reforms often provide spurious modelled data to support claims that have never panned out in practice,” he said.

In previous roles, Pane said he had “made those representations to government”, accusing corporate lobbying of “confection” and “hysteria”.

“In my 30 years of experience … business has responded to every minute change proposed like a crucifix has been presented to a vampire.”

Advocates say another key reform they fear has gone missing is a change to the definition of personal information to include data that could identify users, such as cookie identifiers and IP addresses. Without that, the surveillance apparatus which allows advertisers to know everything about you – except, possibly, your name – remains intact.

The backburner of tranche two may become the too-hard basket. It depends on whether the government makes a detailed commitment, including a timeframe, and sticks to it.

In the meantime, get a VPN and delete your cookies. Which reminds me, I need to stock up on protein powder.