# The ACCC quietly said yes. Here's what it means for open banking. > The most important open banking update of the year didn't come with a press release. It came in a newsletter. - Category: news - Audience: developers - Updated: 2026-10-20 - Canonical: https://openfeed.au/resources/accc-consumer-consent-update --- _By [Max Diamond](https://www.linkedin.com/in/maxdiamond/), openfeed, powered by Biza._ The ACCC quietly said yes. Here's what it means for open banking. A diagram showing a consumer connecting once to their bank or energy data holder, then sharing with each app in a single toggle. On 27 January 2026, the ACCC updated its guidance on third-party data sharing under the Consumer Data Right. It went largely unnoticed until Banking Day's Jennifer Harrison picked it up last week. Having spent years building CDR infrastructure, we think it deserves more attention than it got. Here's what changed, what didn't, and what I think it means if you build on Australian banking and energy data. ## What changed The ACCC clarified that consumers can use the CDR to pull their own data in a machine-readable format and reshare it with third-party apps. In the regulator's words: "provided a consumer makes a clear and informed choice", the CDR supports use cases that enable a consumer to further share their own CDR data. That one sentence does a lot of work. In practice it greenlights what Treasury calls Third Party Data Sharing, a model Treasury privately consulted on in late 2025. Banking Day's read is that the guidance makes several of the CDR's more complex rules redundant in practice when using Third Party Data Sharing. This includes the restrictions on derived data and commingling, as well as the regulated access pathways (sponsor and affiliate, CDR representative, and trusted adviser) that many teams have spent months working on. ## Why it matters For five years, the CDR has asked the same question of every builder: how much regulatory machinery do you want to own? Accredit yourself and you carry the overhead cost and permanent compliance headcount. Go through an intermediary and your users re-consent for every app. Or skip the CDR, keep scraping, and hope the login page doesn't change. The ACCC's guidance puts the consumer back at the centre of that question. If a person chooses to share their own data with an app, the regulator is comfortable with that, as long as the choice is clear and informed. Independent modelling by Lateral Economics for FinTech Australia found five kinds of benefit from this model: better interest rates and prices, reduced derived-data obligations, time savings, security improvements over screen scraping, and more CDR adoption and competition. None of those are surprising. They are what happens when you stop making people do the hard part twice. ## What it doesn't do It's guidance, not law. However, the Treasury CDR lead has said the department is considering changes that would "reinforce that guidance, and also simplify the operation of it". That's encouraging, but it means the rules will adapt. It also raises the bar on one thing: consent. "Clear and informed" is now the hinge the whole model swings on. If your consent flow is ten screens of legal text, you have neither a clear choice nor an activated user. ## Our view This is the model we built openfeed on, so of course we welcome it. Two interesting things that come from this are: **First, consent design is now the product.** We use a two-consent design: the consumer connects to their bank or energy provider once, under Biza's CDR accreditation, then shares with each app in a single screen. They can turn any app off without breaking the bank or energy provider connection. That is what "clear and informed" looks like when you build it, not just write it into a policy. **Second, compliance should sit in the platform, not in your product.** The guidance is a step in a direction, not the destination. When Treasury formalises it, the details will shift again. Our job is to absorb those changes. We have implemented CDR compliance for more than 30 data holders. You should never have to. ## If you're building Here's the practical detail. One OAuth2 REST API over every banking and energy holder. Balances are live, with transactions batched every 4 hours for banking and every 6 hours for energy. 10c per consumer, per app, per month, first 10 free, no lock-in. The docs are public, and your coding agent can read them itself via [llms.txt](/llms.txt) and our [OpenAPI spec](/openapi.yaml). The rules moved this year, quietly. They'll move again. Build on something that moves with them. [Start with the docs at openfeed.au.](https://openfeed.au) _Source: Jennifer Harrison, "[This quiet ACCC update on 'consumer consent' is generating loud impacts on open banking](https://www.bankingday.com/this-quiet-accc-update-on-consumer-consent-is-generating-loud-impacts-on-open-banking)", Banking Day, 29 September 2026._ ![openfeed, powered by Biza](/blog/openfeed-powered-by-biza.png)