Still, the clandestine nature of Web bugs raises issues about whether email, document or Web site authors should have the right to secretly track the activities of individuals.

And it doesn't help that privacy laws are often vague on the subject.

"It's [Privacy is] just such a gray area of the law," said Irene Graham, Executive Director, online civil liberties organization Electronic Frontiers Australia (EFA). "EFA's been complaining about this sort of thing in every submission we've put in on privacy amendments and stuff for years, because we think things like web bugs are a serious concern, and there should be laws surrounding their use, or just make them illegal."

The Australian Privacy Act stipulates that it is illegal for an organization to be collecting personal information that is not necessary for one of its functions or activities. Determining the legitimacy of information collection is a task that lies solely with the Privacy Commissioner, who typically assesses complaints on a case by case basis.

According to the Office of the Privacy Commissioner, organizations that collect personal information must comply with the National Privacy Principles contained in the Privacy Act, which include the responsible use of information, keeping the information secure, and providing individuals access to their personal information.

"The Privacy Act makes provision for the operation of other laws and interests, for example by exceptions that permit the collection, use or disclosure of personal information where this is required or authorized by another law," said a spokesperson for the Office of the Privacy Commissioner.

"However," she added, "in most cases, Privacy Act obligations, for example requiring organizations to make sure people are aware personal information is being collected and for what purpose, still apply."

But the EFA is dissatisfied.

"The problem is that, for example, that a company that uses this information for their marketing or profiling purposes could claim that this is a necessary function," Graham said. "But is it necessary? I would argue no!"

"I fear that depending on the circumstances, under the current law, the privacy commissioner may well find that businesses may have the right to do that [obtain personal information no good reason]."