TL;DR
AI now shapes most of customer acquisition: ad targeting and bidding, lead scoring, personalised journeys and on-site conversation. The marketers getting results have connected their CRM, commerce and service data so the AI learns from real customer outcomes. In Australia, the Spam Act still applies to every AI-written message, and from 10 December 2026 the Privacy Act requires you to disclose automated decisions that significantly affect people. The OAIC says that can include some targeted advertising and personalised pricing.
AI has moved from experiment to line item. Gartner's 2026 CMO Spend Survey found CMOs now put an average of 15.3% of their marketing budget into AI, yet only 30% say their organisation is ready to scale it. Salesforce's latest State of Marketing research tells the same story: 75% of marketing organisations use AI in some form, but only 26% are fully satisfied with how their data is unified.
That gap between spending and readiness is where acquisition results are won or lost. This guide covers where AI genuinely helps, what has to be in place first, and the Australian rules that apply.
Where AI genuinely helps acquisition
1. Ad targeting and bidding
The biggest shift has happened inside the ad platforms. Google's AI Max for Search expands queries and writes ad copy automatically; Google says advertisers typically see 14% more conversions or conversion value at a similar cost per acquisition. Meta's Advantage+ campaigns now set up sales, app and lead campaigns automation-first by default. Both platforms learn from the conversion signals you send them, so the quality of what you feed back (qualified leads and actual revenue, not just clicks) largely decides the result. Meta says connecting a CRM through its Conversions API lowers the cost per quality lead by 15%; treat that as a vendor claim, but the principle holds.
2. Lead scoring and qualification
CRM platforms now include agents that research and qualify inbound leads before a person picks them up. Microsoft's Dynamics 365 Sales Qualification Agent became generally available in October 2025, and Salesforce offers AI sales development agents through its Agentforce platform. These work well when your CRM holds clean history of which leads became customers. They work poorly when it doesn't, because the agent simply learns your bad data faster.
3. Personalised journeys and content
Marketing automation platforms have added agents that build campaigns and flows from a brief. Klaviyo's Marketing Agent and Customer Agent became generally available in September 2025, and its newer Composer builds campaigns and flows from a prompt, with nothing going live without approval. Adobe made its Experience Platform agents generally available in September 2025, and Microsoft has journey-creation agents in preview for Dynamics 365 Customer Insights. The useful pattern is the same across all of them: the agent drafts, a marketer approves, and the customer data decides who gets what.
4. Conversations on your site
AI agents can answer product questions, recommend products and capture leads around the clock. Two cautions. Customers still hesitate: Klaviyo's 2026 consumer research across eight countries, including Australia, found 41% had bought an AI-recommended product in the past six months, but only 13% fully trust AI. And every connected chat tool is another way into your customer data. In August 2025, stolen credentials from the Drift chat integration were used to access Salesforce data at hundreds of organisations. Review what each tool can read and write.
5. Being found in AI search and shopping
Buyers increasingly start in AI assistants rather than search engines. Adobe measured a 693% year-on-year rise in traffic from generative AI tools to US retail sites over the 2025 holiday season, from a small base. Clear, structured product information and pages that answer real questions are what these tools draw on.
Why connected first-party data comes first
Every one of those tools learns from your data, and most marketing teams can't see all of it. Salesforce's research found Australian marketers have full access to service data only 59% of the time, sales data 60% and commerce data 55%. Gartner found 45% of martech leaders using AI agents say the vendors' agents don't meet expectations.
In our experience the cause is rarely the AI. It is that the CRM, the commerce platform, the email platform and the service desk each hold part of the customer, and nothing joins them. Before buying another AI feature, check that:
- leads and customers are matched across CRM, commerce and marketing platforms
- revenue and qualified-lead events flow back to the ad platforms automatically
- consent and unsubscribe status are the same in every system that sends messages
- you can see which campaign, agent or rule produced each lead
Third-party cookies in 2026
Much advice from 2023 and 2024 assumed third-party cookies were about to disappear from Chrome. They aren't. In April 2025 Google decided to keep them, and in October 2025 it retired most of its Privacy Sandbox replacement technologies. The case for first-party data hasn't weakened, though. Safari and Firefox still block third-party cookies, consent rates limit what you can track, the ad platforms' AI runs best on your own conversion data, and Australian privacy law keeps tightening.
The Australian rules that apply
Automated decisions and the Privacy Act
From 10 December 2026, organisations covered by the Privacy Act must say in their privacy policy when they use computer programs to make, or substantially help make, decisions that could significantly affect people's rights or interests. The OAIC's final guidance (30 September 2026) is relevant to marketers in four ways:
- It lists programmatic advertising relating to the sale of significant goods or services, and personalised pricing by online retailers, as decisions that can be in scope.
- Its examples include an algorithm that targeted job ads in a way that excluded an older woman.
- Machine-learning and generative AI outputs that feed significant decisions are generally in scope unless there is extensive human oversight; a person simply reviewing the output isn't enough.
- Using a vendor's tool doesn't move the obligation to the vendor.
Where the line falls for ordinary advertising is still unclear, and the OAIC recommends a cautious approach. Our guide to the automated-decision rules covers this in detail, including a checklist.
Direct marketing, spam and telemarketing
- Spam Act 2003: every commercial email or SMS needs consent, clear sender identification and a working unsubscribe, which must take effect within five business days. That applies whether a person or an AI agent wrote and sent the message.
- Enforcement is active: ACMA penalised Latitude Finance $3.96 million in April 2026, Lululemon $702,900 in March 2026 for marketing emails with no unsubscribe option, and TAB more than $2.7 million in July 2026, partly for messages sent after people withdrew consent.
- APP 7: the Privacy Act's direct-marketing rules cover marketing the Spam Act doesn't, and sensitive information always needs consent.
- Do Not Call Register: AI-driven outbound calling is still telemarketing, and registered numbers are off limits without consent.
- Statutory privacy tort: since 10 June 2025, individuals can sue for serious invasions of privacy, including misuse of their information.
Further privacy reform is coming. The government released an exposure draft of the next tranche of Privacy Act changes in August 2026, including new direct-marketing and targeted-advertising rules. It isn't law yet, but systems you build now should be able to adapt.
A practical way to start
- Audit your customer data and consent across CRM, commerce, email and service. Fix matching and unsubscribe sync first.
- Send real outcomes back to the ad platforms: qualified leads and revenue, server-side, not just clicks.
- Score leads on your own history before switching on qualification agents.
- Let agents draft, keep people approving, and record which journeys and offers each agent controls.
- Register automated decisions that could significantly affect people, for your privacy policy before 10 December 2026.
- Measure incrementality, not just platform-reported conversions.
How Great Minds helps
We connect the platforms acquisition depends on, including Salesforce, Klaviyo, Microsoft Dynamics 365 and Adobe, so customer data, consent and conversions flow between them and the AI has something real to learn from. Great Minds is a Klaviyo Gold Advisor. When Meriton Suites moved more than a million contacts from Salesforce Marketing Cloud to Klaviyo with us, campaign execution became four times faster.
Frequently asked questions
Is AI-targeted advertising caught by the Privacy Act's automated-decision rule?
It can be. The OAIC says programmatic advertising relating to the sale of significant goods or services, and personalised pricing, can be in scope from 10 December 2026. Ordinary ad targeting is less clear, so the OAIC recommends a cautious approach and disclosure where in doubt.
Do we still need first-party data if Chrome keeps third-party cookies?
Yes. Safari and Firefox block them, consent limits tracking, and the ad platforms' AI performs best on your own conversion data.
What should we automate first?
Usually feeding qualified-lead and revenue data back to your ad platforms, and lead scoring on your CRM history. Both improve results quickly and build the data foundation that agents need later.
Can AI write and send our marketing emails?
Yes, with approval steps. The Spam Act applies in full regardless of who or what wrote the message: consent, identification and a working unsubscribe.
Where to start
Pick one acquisition channel, trace a lead from first click to revenue, and note every system it passes through and every place the data breaks. That map shows where AI will help and what has to be connected first. We're happy to walk through it with you.