Social media privacy settings and account security

Social media privacy settings decide who can see what you post, who can contact you and what the platform shares about you. This guide explains the main settings found on most platforms (account security, audience and privacy controls, location sharing), what ASD’s ACSC, the OAIC and Scamwatch say about what to share, and how to recognise fake profiles and impersonation. Each platform’s own help centre has its current steps, and links are listed below.

Settings differ from one platform to the next, and they move around after updates. The ideas behind them are much the same everywhere.

Why it matters

Social media accounts hold a lot: photos, friends lists, messages, and often the email address and phone number linked to other accounts. That makes them useful to scammers in two ways.

• Your account itself. A taken-over account can be used to message your contacts with scams, which they’re more likely to trust because it looks like you.
• What you share. Scamwatch says scammers may use information from your posts to “guess your passwords or target you with other scams.” Details such as your birthday, pet’s name or home suburb can also help with identity theft. See identity theft explained.

The OAIC puts the privacy side simply: “If the information you post to the online social network you’re using is publicly available, then anyone can look at it.”

How to secure your social media account

Turn on multi-factor authentication

Multi-factor authentication (MFA), often called two-factor authentication or two-step verification, means a password alone isn’t enough to sign in. ASD’s ACSC calls MFA “one of the best ways to protect against someone breaking into your account”, and lists social media accounts among the important accounts to protect first, alongside email, banking and shopping.

On most platforms, the general path is:

1. Open the app or website and go to Settings (often under your profile picture or a menu icon).
2. Look for a section called Security, Password and security, or Accounts Centre.
3. Choose Two-factor authentication or 2-Step Verification and follow the prompts.
4. Save any backup or recovery codes the platform shows, somewhere safe.

Common methods include a code sent by text, a code from an authenticator app, or a physical security key. X’s help centre, for example, describes all three, and says text message codes are only supported for its Premium subscribers.

As a specific example, based on Google’s instructions (checked October 2026), 2-Step Verification for a Google Account, which is also used for YouTube, works like this: go to myaccount.google.com, select Security & sign-in, and under How you sign in to Google choose to turn on 2-Step Verification, then follow the prompts.

For a step-by-step look at securing important accounts generally, see how to secure your online accounts.

Other account security settings

ASD’s ACSC social media guidance also describes:

• using a unique password for each account, or biometric sign-in in mobile apps where available
• never sharing passwords or codes, “especially with other accounts claiming to belong to vendor support staff”
• not using security-question answers that “could easily be obtained from public sources of information”
• signing out after using a shared device, and avoiding untrusted devices such as internet café computers
• closing old accounts that are no longer needed.

How to choose who sees your posts

Most platforms let you control your audience at two levels: the whole account (public or private) and individual posts. ASD’s ACSC says privacy settings should be “understood and applied”, and mentions private profiles and disappearing messages where appropriate.

Settings to look for in a platform’s Privacy section usually include:

• Account privacy: whether your profile is public or private. TikTok’s help centre, for example, explains public and private accounts.
• Default audience for new posts: for example everyone, friends or followers only, or a custom list.
• Who can contact you: who can send messages, comment, tag or mention you.
• Who can find you: whether people can look you up by email address or phone number, and whether you’re suggested to others.
• Profile details: who can see your birthday, phone number, email address, workplace and friends list.

The OAIC notes that privacy settings help but aren’t complete protection: “your friends may republish your information to a wider audience than you did”, and “Even when you deactivate your account, your information may remain in archived or old versions of websites.” The OAIC’s privacy tips describe reading platforms’ privacy policies and adjusting settings to suit you.

How to limit location sharing

Location can be shared in more ways than people expect: tags on posts, check-ins, live location features in messaging apps, and location data stored inside photos.

ASD’s ACSC guidance says to be aware of services that automatically post your location, especially where “locations or movements are sensitive”, and to remove location data from photos before posting or sharing them. Location permissions for each app are also controlled in your phone’s settings; see iPhone security basics and Android security basics.

What to share, and what to keep back

ASD’s ACSC says to think carefully before posting, because “it can be very difficult to remove or recall what was previously posted or shared.” The OAIC’s privacy tips make the same point: “Your digital footprint can be forever, so think before you share.”

ASD’s ACSC guidance lists details worth limiting, such as home or work addresses, phone numbers and employer, and describes using a personal email address rather than a work one for social accounts. Scamwatch adds not sharing personal information that could help someone guess your passwords. Our guide to protecting your personal information covers this in more depth.

Fake profiles and impersonation

Scamwatch explains that “scammers set up fake profiles on social media, messaging platforms and apps”, and may “pretend to be a friend, family member or interested in a relationship.” They also impersonate government, businesses, employers and investment platforms, sometimes using “other people’s photos and identities”.

Signs Scamwatch describes:

• a profile with little activity, few friends or followers, and not much detail. Scamwatch says: “Lack of history, detail and followers can be a sign of a fake profile.”
• unexpected contact, especially from someone you don’t know
• a request for money or personal pictures from someone you’ve only met online. Scamwatch says never to send either.

ASD’s ACSC guidance says to be cautious of unsolicited contact and to avoid accepting requests from unknown people. Our guides to impersonation scams and romance scams explain how these approaches usually develop.

If someone has created a fake account pretending to be you, platforms have reporting tools for impersonation, explained in their help centres. If the account is being used to scam people, Scamwatch takes reports at scamwatch.gov.au/report-a-scam.

A fictional example

Jordan gets a message from what looks like her cousin’s account: “Is this your photo? Log in to see it”, with a link to “photo-share.example”. The account has the cousin’s name and picture, but Jordan notices she’s already friends with her cousin, and this profile was created recently with few friends.

These are the signs Scamwatch describes. Rather than clicking, Jordan messages her cousin through the account she already knows, and her cousin confirms someone copied her profile.

If your account is taken over

If you can’t sign in, or your account is posting things you didn’t write, the platform’s help centre has an account-recovery process. Scamwatch’s steps if you’ve been scammed include changing passwords on accounts, especially banking, email, government and shopping ones, contacting your bank if money is involved, and contacting IDCARE on 1800 595 160. See what to do if your account has been hacked.

Platform help centres

Each platform explains its own settings. These pages were checked in October 2026:

• Meta (Facebook and Instagram): securing a Meta account with two-factor authentication
• X: how to use two-factor authentication
• TikTok: account privacy settings
• YouTube and other Google services: turn on 2-Step Verification

Things to watch for

• Settings change after updates. ASD’s ACSC describes checking permissions and security settings after app updates, since these can change.
• “Support staff” in your messages. ASD’s ACSC warns about people “masquerading as support staff” to get account access.
• Third-party apps and quizzes. ASD’s ACSC says to be wary of apps requesting excessive permissions.
• Friends re-sharing. The OAIC notes friends may republish your content more widely than you intended, whatever your own settings.
• Group memberships. ASD’s ACSC describes keeping track of the groups you’re in.

Common questions

How do I make my social media account private?

Through the platform’s Privacy settings, which on most platforms let you set the whole account to public or private and choose a default audience for new posts. Other settings there control who can message, tag or find you, and who sees details such as your birthday and phone number. ASD’s ACSC says privacy settings should be “understood and applied”. Each platform’s help centre has its own steps. See how to choose who sees your posts.

How do I secure my social media account?

Turning on multi-factor authentication is the main step ASD’s ACSC describes. It calls MFA “one of the best ways to protect against someone breaking into your account”, and lists social media among the important accounts to protect first. On most platforms, it’s under Settings, in a section such as Security or Accounts Centre. The ACSC also describes unique passwords, never sharing codes and closing old accounts. See how to secure your social media account.

How can I tell if a social media profile is fake?

Scamwatch says: “Lack of history, detail and followers can be a sign of a fake profile.” It also describes unexpected contact, especially from someone you don’t know, and requests for money or personal pictures from someone met only online, which Scamwatch says never to send. A second profile for someone you’re already friends with is another sign. See fake profiles and impersonation and a fictional example.

What do I do if my social media account has been hacked?

The platform’s help centre has an account-recovery process for when you can’t sign in or the account is posting things you didn’t write. Scamwatch’s steps if you’ve been scammed include changing passwords, especially on banking, email, government and shopping accounts, contacting your bank if money is involved, and contacting IDCARE on 1800 595 160. The guide to what to do if your account has been hacked explains what official sources say to do.

What do I do if someone made a fake account pretending to be me?

Platforms have reporting tools for impersonation, explained in their help centres. If the fake account is being used to scam people, Scamwatch takes reports at scamwatch.gov.au/report-a-scam. Scamwatch notes that scammers sometimes use “other people’s photos and identities” in fake profiles. Our guide to impersonation scams explains how these approaches usually develop.

Can I delete everything I’ve posted on social media?

Not always completely. ASD’s ACSC says “it can be very difficult to remove or recall what was previously posted or shared.” The OAIC notes that friends may republish information to a wider audience, and that “Even when you deactivate your account, your information may remain in archived or old versions of websites.” Its tip is: “Your digital footprint can be forever, so think before you share.” See what to share, and what to keep back.

Where to get official help

• ASD’s ACSC for MFA guidance, help with hacked accounts, ReportCyber and the 24/7 hotline: 1300 CYBER1 (1300 292 371), listed on its where to get help page
• Scamwatch to report scams: scamwatch.gov.au/report-a-scam
• IDCARE for free identity and cyber support: 1800 595 160 (individuals), listed on its contact page
• The OAIC for privacy rights and complaints: oaic.gov.au