MapleTree
MapleTree
We provide free privacy and responsible AI audits and advice from New South Wales Australia to those who need it
$0.0000 AI cost this session
We scan your project documents against the frameworks that matter — Privacy Act, AI Ethics Principles, ISO 42001 — and give you a plain-English report in minutes, for free.
Drop in a PDF or paste a description of your AI or data project.
Analysed across privacy, bias risk, transparency, accountability and security.
Scored risk ratings and specific recommendations. No jargon, no fees.
Deeper audit and bespoke governance advice for complex projects.
We’re putting the finishing touches on our explainer animation. In the meantime, try the free audit tools above or get in touch with our team.
Governance frameworks, privacy standards, and privacy-respecting software alternatives for organisations operating in Australia and Aotearoa New Zealand.
The cornerstone of Australian privacy law governing collection, use, and disclosure of personal information. Includes the 13 Australian Privacy Principles (APPs) all APP entities must comply with.
View legislation →Eight voluntary ethical AI principles by DISR covering human-centred values, fairness, privacy, reliability, safety, transparency, contestability, and accountability.
View framework →Ten mandatory guardrails for Australian Government agencies using high-risk AI systems, covering accountability, testing, transparency, and human oversight requirements.
View guardrails →Australia's open data regime giving individuals and businesses the right to share data with accredited third parties. Currently applies to banking, energy, and telecommunications.
View CDR framework →The Australian Cyber Security Centre's eight prioritised mitigation strategies to protect systems from cyber threats. Critical for AI systems handling personal data or critical infrastructure.
View model →Requires Australian Government agencies and businesses to notify affected individuals and the OAIC when a data breach is likely to result in serious harm to those affected.
View NDB scheme →New Zealand's modernised privacy legislation with 13 Information Privacy Principles. Introduces mandatory breach notification, new offences, and expanded powers for the Privacy Commissioner.
View legislation →A voluntary commitment for government agencies to be transparent and accountable about how they use algorithms in decisions affecting people, with public reporting requirements.
View charter →New Zealand's national data strategy for trustworthy and beneficial data use across government and industry, emphasising Māori data sovereignty (Te Mana Raraunga).
View strategy →A voluntary framework from the US National Institute of Standards and Technology to better manage risks to individuals, organisations, and society associated with AI. Adopted globally as best practice.
View framework →The world's first international standard for AI management systems. Specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system.
View standard →The first global normative instrument on AI ethics, adopted by all 193 UNESCO Member States in 2021. Provides values, principles, and recommendations to guide government and industry AI policy.
View recommendation →MapleTree is a not-for-profit initiative founded on the belief that responsible AI should be accessible to every organisation, not just those with deep pockets. We provide free privacy and AI compliance tools, open-source frameworks, and human expertise to organisations across Australia and Aotearoa New Zealand.
Technology should work for people, not the other way around. Our volunteer team of privacy lawyers, AI researchers, and governance specialists give their time so your AI systems can be fair, transparent, and trustworthy.
We are always looking for privacy lawyers, AI researchers, and governance specialists to join our volunteer team.
The OAIC's Australian Community Attitudes to Privacy Survey is the most-cited measure of how Australians feel about privacy and AI. Before its headline numbers harden into policy, MapleTree AI examined the survey's own methodology documents, and the technical paper behind the panel it was run on, to test how far its claim of national representativeness holds up.
ACAPS 2026 is close to the best that Australian survey research can currently deliver: a genuine probability sample, transparently documented, professionally weighted. But "weighted to be nationally representative" is a claim about demographics, not attitudes. A cumulative response rate of roughly 2.6%, an English-only instrument, token coverage of offline Australians, unreported margins of error, and a possible methodological break in its own time series all mean the results should be read as well-grounded estimates with real uncertainty, not as a census of the national mind.
ACAPS 2026 surveyed 1,504 Australian adults between 16 and 30 March 2026, almost entirely online (n=1,490) with a small telephone component (n=14). Respondents were drawn from the Social Research Centre's Life in Australia™ panel, Australia's only probability-based online panel. Its roughly 10,250 members were originally recruited by random digit dialling, SMS push-to-web, and address-based sampling rather than by volunteering. Results were weighted to national benchmarks for age, education, language spoken at home, household size, region, and state.
That design matters. It puts ACAPS in a different league from the opt-in "river" panels that dominate Australian market research, and the Social Research Centre's own published comparisons show probability panels produce measurably more accurate estimates. The critique that follows is not that ACAPS is a bad survey. It is that even a good survey has load-bearing assumptions, and several of them deserve more scrutiny than the report's two-page methodology section invites.
✓Probability-based recruitment. Panellists were randomly sampled from phone-number and address frames, with no self-selected volunteers, which is the recognised gold standard for population inference.
✓Serious questionnaire development. Six focus groups, eight cognitive testing interviews, an embedded order-effects validation, and joint design between the SRC and OAIC.
✓Documented quality control. ISO 20252 accreditation, checks for speeding, straightlining and nonsense verbatims, and removal of poor-quality completes before analysis.
✓Sophisticated four-stage weighting covering panel selection, survey selection, response propensity, and post-stratification to ABS benchmarks.
The completion rate for a given survey looks healthy (roughly 75–80%), but that is the last link in a long chain: people first had to agree to join the panel (recruitment rate 6.6%), complete a profile survey (96.9%), and still be on the panel when invited (retention 51.9%). Multiplied together, the indicative cumulative response rate is 2.6%.
Weighting can repair this only where the 97% who declined resemble the 3% who responded on unmeasured characteristics once demographics are aligned. That is an assumption, not a finding. Low response rates are precisely the condition under which nonresponse bias, when it exists, goes undetected.
This is the limitation most specific to ACAPS, and the report does not discuss it. Every respondent is, by construction, someone who responded to an unsolicited call, letter or text from an organisation they had never dealt with, handed over their contact details and an extensive personal profile, and agreed to be surveyed fortnightly for modest incentives. The most privacy-protective Australians (those who screen unknown numbers, never click unsolicited links, and refuse to join panels) are systematically the least likely to be in the sample. Notably, recent panel recruitment (2023–25) relied on SMS push-to-web: an unsolicited text with a link, the very contact pattern privacy-cautious people are trained to treat as a scam.
Demographic weighting cannot correct selection that is correlated with the survey's own subject matter. The panel operator openly acknowledges an analogous problem for politics: panellists skew left of the population, so a special voting-adjusted selection method exists for vote-correlated studies. No equivalent adjustment for privacy-disposition is documented for ACAPS. The plausible direction of the bias is worth stating: if the wariest Australians are missing, ACAPS may understate national privacy concern, meaning its already striking findings could be conservative.
ACAPS 2026 devotes a major module to artificial intelligence, and its AI findings are among the most quoted: strong demands for transparency, human oversight and limits on training AI with personal data. But 1,490 of the 1,504 completes (99.1%) were online, and every panellist recruited since 2023 joined by clicking a link in a text message and completing a web survey. Australians without reliable internet access, and those with low digital literacy or confidence, are structurally absent from the very questions that most concern them. A person who has never used a chatbot, cannot complete a 29.5-minute web questionnaire, or lives where connectivity is patchy simply does not appear in the AI chapter, except as a weighted echo of respondents who could.
The gap is largest exactly where AI exposure is most contested. Remote and regional Australians face well-documented connectivity shortfalls, yet remoteness is not a weighting dimension for this survey; the weighting distinguishes only capital city versus rest of state, which folds large regional centres and remote communities into a single stratum. The nominal safety net for the offline, telephone completion, contributed 14 interviews, under 1% of the sample. And the claim that this scarcely matters rests on shaky ground: the panel's methods paper cites a 99% internet coverage estimate that is itself derived from Life in Australia™ data, using the panel to validate the reach of the panel. The last independent official measure (ABS, 2016–17) put adult internet use at 86.1%, and the Census stopped asking in 2021 on the assumption of universality. The net effect is that national statements like "93% say training AI on personal information is not fair" are, more precisely, statements about digitally connected Australia. The views of those most likely to be subject to automated decisions without the means to contest them online remain largely unmeasured.
The report presents point estimates and year-on-year comparisons to the whole percentage point, but never quantifies sampling uncertainty. For n=1,504, and allowing for the variance that weighting adds (the panel's typical weighting efficiency of ~84–86% implies an effective sample nearer 1,250–1,300), a headline estimate near 50% carries a margin of error of roughly ±2.7 to ±3 percentage points. Several trend movements highlighted in the report sit near or within that band, and subgroup comparisons (for example, 18–34s versus over-50s) carry substantially wider intervals that readers are given no tools to judge.
The unweighted sample includes 6 respondents from the Northern Territory, 14 who identified as non-binary, 49 from Tasmania, and only 14 telephone completes. Any figure implicitly covering these groups rests on a handful of people. Younger adults are also thin: 18–24 year-olds are 8% of the raw sample against roughly 11–12% of the adult population, so their responses are up-weighted, which further widens the uncertainty around findings about young Australians, a group the report discusses repeatedly.
Interviewing is conducted in English only; the panel's own paper estimates ~3.6% of adults who speak English "not well or not at all" are effectively excluded. Weighting by "language other than English at home" cannot restore voices that were never in the sample; it re-weights the bilingual to stand in for the non-English-speaking. Homeless Australians and those without mobile phones (for recent recruitment cohorts) are outside the frame entirely. These excluded groups (older, remote, lower-income, recently arrived) plausibly hold distinct views on data sharing, government data use, and digital consent.
The report leans heavily on change since 2020 and 2023. But the series has changed vehicle repeatedly: telephone interviewing to 2013, a phone/online hybrid in 2017, online with phone recruitment in 2020, "an online research panel" in 2023, and the Life in Australia™ probability panel in 2026. The report does not state whether the 2023 panel was probability-based; if it was an opt-in panel, part of any 2023→2026 movement may reflect who was asked and how, rather than genuine attitude change. Mode effects are real: self-completion online and interviewer-administered phone surveys elicit systematically different answers on sensitive topics, and the report offers no bridging analysis.
The reported survey length was 29.5 minutes overall (29.3 minutes online, 51.7 by phone), long by contemporary standards, raising fatigue and satisficing risk in later modules (the quality checks catch crude straightlining, not subtle disengagement). And because panellists are surveyed roughly fortnightly, panel conditioning is a live possibility: people repeatedly asked about their data, technology and institutions may develop more crystallised views than the population they represent. Two smaller documentation gaps compound this: the report's stated weighting variables omit gender (which the panel's standard approach normally includes, likely an omission in the write-up, but unverifiable from the report), and income, Indigenous status and remoteness are not weighting dimensions at all.
None of this licenses dismissing the survey; quite the opposite. Against realistic alternatives, ACAPS 2026 is rigorous, and its central findings (high concern, low trust in digital sectors, strong support for AI guardrails) are large enough to survive any plausible correction. Our recommendations for anyone citing it:
Treat headline percentages as ±3-point estimates, not precise values, and treat small year-on-year movements as suggestive rather than established. Be cautious with 2023→2026 trend claims until the comparability of the two panels is clarified. Avoid quoting subgroup figures for the NT, Tasmania, non-binary respondents, or narrow age bands without noting the tiny cell sizes. Read the AI findings as the views of connected Australia, since the digitally excluded are effectively absent from that module. And remember who is missing: the most privacy-guarded, the non-English-speaking, and the offline, with the intriguing implication that true community privacy concern may run even higher than the survey records.
For organisations using ACAPS to calibrate AI governance or privacy programs, the practical takeaway is simple: the direction of community sentiment is unambiguous; the decimal places are not.
Sources. Australian Community Attitudes to Privacy Survey 2026, Office of the Australian Information Commissioner (fieldwork by the Social Research Centre, 16–30 March 2026, n=1,504); Life in Australia™ Methods Documentation, Social Research Centre (August 2025), including Tables 1, 2 and 7. Margin-of-error and effective-sample figures are MapleTree AI estimates derived from the published sample size and the panel's typical weighting efficiency; ACAPS-specific design effects were not published.
The Transparency Standards Tracker already asks whether the Australian Government's 114 AI transparency statements comply with the DTA Standard, whether they genuinely inform, and how their language distances the reader. Its new Accessibility lens asks a more basic question: can a person using a screen reader, a keyboard, or low-vision settings read the statement at all? Here is exactly how we test that — and, just as importantly, what our method cannot see.
The Accessibility lens reports the share of automated WCAG 2.2 AA checks a statement page passes. Automated engines can only evaluate a subset of the WCAG success criteria, so 100% means "no machine-detectable failures", not "accessible" — while anything below 100% is a genuine, reproducible defect an agency can fix today. Read low scores as firm findings and high scores as necessary-but-not-sufficient.
A transparency statement exists for exactly one audience: the public. If the page it lives on can't be navigated by keyboard, read aloud in a sensible order, or distinguished by someone with low colour vision, then for that reader the agency has published nothing. Roughly one in five Australians live with disability, and they are disproportionately likely to be subject to the very automated decision-making these statements describe.
The legal footing is not exotic. The Disability Discrimination Act 1992 has applied to government web content since the SOCOG case in 2000, and the Australian Government's own Digital Experience Policy and Digital Access Standard, in effect since 1 January 2025, direct agencies to WCAG 2.2 AA — the same bar this audit tests against. So, as with our DTA Standard lens, we are not inventing a benchmark; we are measuring agencies against one they are already expected to meet.
The pipeline mirrors our findability audit. For every agency whose statement URL the findability audit located, a script (wcag_audit.js, open source like the rest of this site) loads the live page in headless Chromium and runs axe-core — the open-source accessibility engine built by Deque that also powers Google Lighthouse — restricted to the rules tagged for WCAG 2.0/2.1/2.2 at levels A and AA. WCAG 2.2 is cumulative, so this is the full WCAG 2.2 AA automated rule set.
For each page we record every failing rule with its success criterion number, axe's impact rating (critical, serious, moderate, minor) and the number of offending elements, plus the count of checks that passed. The published score is simply checks passed ÷ checks applicable. The per-agency breakdown in the Tracker shows the raw failing rules, so nothing is hidden behind the percentage. Results are merged into the Tracker's dataset with merge_wcag.py, and each record carries its audit date and engine version.
Typical machine-detectable failures are unglamorous and consequential: images without text alternatives (SC 1.1.1), text that fails minimum contrast (SC 1.4.3), links announced to screen readers as "link" with no name (SC 2.4.4), form fields without labels (SC 4.1.2), heading structures that skip levels, and — new in WCAG 2.2 — touch targets smaller than 24×24 pixels (SC 2.5.8).
✓We ran it on ourselves first. Before pointing this tool at anyone else, we pointed it at mapletreeai.com — and it failed us. Our teal palette's muted text, amber score colours and orange badges all fell below the 4.5:1 contrast minimum.
✓Then we fixed what it found. Site-wide contrast corrections, proper tab semantics with arrow-key support, focus-trapped dialogs that return focus on close, keyboard-operable list rows, and screen-reader text for every ✓/✕ mark in the Tracker.
✓All five sections of this site now pass every automated WCAG 2.2 AA check. By our own rule that is a floor, not a certificate — but we hold ourselves to the same floor we measure others against.
Automated accessibility testing has hard limits, and an audit that doesn't state them invites exactly the box-ticking our Informativeness lens criticises. Seven limitations shape how the scores should be read.
Depending on how you count, automated engines can evaluate somewhere between a third and a half of the WCAG success criteria; Deque's own research puts the share of issue volume detectable by automation at around 57%. Whether the focus order makes sense, whether alt text is accurate rather than merely present, whether error messages actually help — no scanner can judge these. Human review of a sample is planned as a follow-up, mirroring how our findability audit works.
This is the corollary of limitation 1 and the reason the Tracker's badge says A11y clean, never "WCAG compliant". A page can pass every axe check and still be unusable with a screen reader. The asymmetry matters: a failing check is a firm, reproducible finding; a passing run is only the absence of machine-detectable evidence.
Several agencies publish their statement only as a PDF. WCAG 2.2 applies to PDFs just as it does to web pages, but axe-core cannot read them, so these agencies appear as PDF-only — not machine-checkable with no score. That is not a pass. If anything, PDF-only publication is itself an accessibility and findability barrier, and it already attracts a flag in our findability data. PDF/UA checking (e.g. veraPDF) is on the roadmap.
Each result is a snapshot of one URL on one date with one viewport. Agencies redesign sites, statements move (our findability audit shows how often), and cookie banners, embedded widgets or logged-in states can change what the scanner sees. Every record carries its audit date, and stale results will be re-run rather than silently trusted.
Of the success criteria WCAG 2.2 added, only Target Size (Minimum) is meaningfully machine-checkable today. Consistent Help, Redundant Entry and Accessible Authentication require understanding a whole journey, not one page. So while we run the full WCAG 2.2 AA rule set, the "2.2" in the headline is honest about the rules, not a claim that the new criteria are fully covered.
Nothing in this pipeline involves an actual screen reader, magnifier, switch device — or a person with disability. Automated checks approximate the mechanical preconditions of accessibility, not the experience. Findings here should be treated the way our readability metrics are: automated and indicative, a reason to look closer, never a substitute for user testing.
Many .gov.au sites block requests from datacentre IPs, so the audit runs from a residential connection, politely and rate-limited — the same constraint our findability audit documents. Agencies marked not yet audited are a coverage gap, not a clean bill or a criticism. The Tracker's stat cards always show how many of the 114 have been audited so the denominator is never hidden.
A failing check is a fact. A passing run is only the absence of machine-visible evidence. The lens is built so that difference is impossible to miss.
For readers: open the Tracker, switch to the Accessibility lens, and sort by lens score. The Visualisations tab shows the score distribution, failures by impact, the most common failing rules, and a scatter of DTA Standard compliance against accessibility — watch the lower-right quadrant, where statements comply on content while excluding readers.
For agencies: every failing rule shown in a statement's detail view names the WCAG success criterion, the axe rule and the number of affected elements. These are precisely the defects a web team can reproduce with free tools (axe DevTools, Lighthouse) and usually fix in hours. If your statement is listed as PDF-only or not yet audited and you'd like it re-checked, contact us.
Method & sources. axe-core (Deque Systems, open source) run in headless Chromium via Playwright, restricted to rules tagged wcag2a, wcag2aa, wcag21a, wcag21aa, wcag22aa; statement URLs from the MapleTree findability audit; W3C Web Content Accessibility Guidelines 2.2 (Recommendation, October 2023, updated December 2024); DTA Digital Experience Policy and Digital Access Standard (from 1 January 2025); Disability Discrimination Act 1992 (Cth); Deque Systems, automated-coverage research (2021). Audit scripts (wcag_audit.js, merge_wcag.py) are in this site's public repository.
Paste text or upload a PDF and receive a de-identified version with all personal information replaced by consistent, numbered tags. Nothing is stored. Processing happens in your session only.
Select a friend to get started. Each analyses your project documentation and generates a risk report.
Drop your project document here
or click to browse. PDF or TXT accepted
Completeness scored 0–5 based on available project information
How do Australia and New Zealand's top 50 companies handle your personal data? Each policy is automatically scraped and analysed by AI. Click any card to see full details.
Thematic analysis of Australian government AI and automated decision-making consultations. Graph shows submitters connected to themes. Click any node or row to read the full submission.
Natural-language analysis of 114 Australian Government AI transparency statements through four lenses — Compliance with the DTA Standard for AI transparency statements 2.0, Informativeness (operationalising Weatherall, Bello y Villarino & Sinclair, AI Transparency in Practice, ADM+S 2026), Discourse Analysis (nominalisation, hedging, we:you framing, plain-language), and Accessibility (automated WCAG 2.2 AA checks on each live statement page). Search the full text, filter, and open any statement for its full breakdown. A Findability check (Weatherall et al. Q1) is included for an audited sample — where each statement lives, how deep, and whether it's buried in news/PDF rather than a global menu. Text was de-noised of website furniture; readability excludes PDF-only statements. Metric scores are automated and indicative.