The decision in Privacy Commissioner v Telstra has important implications for metadata regulation in Australia, and for judicial oversight of the Australian Privacy Commissioner’s functions. This article examines the decision and discusses the key takeaways for businesses that are based in, or doing business with, Australia.