Seven practical tips for keeping personal data safe on social media
Millions of Australians use Facebook, Instagram, TikTok and LinkedIn every day to keep in touch with family in Perth, share weekend brunch photos from Melbourne, or hunt for jobs in Brisbane. Each scroll leaves behind a trail of behavioural data, location pings and personal details that platforms collect, advertisers buy, and occasionally criminals steal. The Optus and Medibank breaches of recent years made that risk feel close to home for many people, and the Office of the Australian Information Commissioner continues to investigate how social platforms handle Australian user data under the Notifiable Data Breaches scheme.
A safer social media presence does not require quitting the platforms or becoming invisible online. It comes down to small, repeatable habits that reduce how much identifiable information leaves your phone in the first place. The seven tips below walk through those habits, from the basics of a strong password to the less obvious work of auditing old apps and connected services.
Lock down the foundations of every account
Start with the entry points. A unique, long passphrase for each social media account is the single most effective step, because credential stuffing attacks rely on people reusing the same email and password across many sites. Australians who travel regularly or split time between Sydney and regional towns often sign in on multiple devices, which makes a password manager even more useful. A good manager generates random passphrases, stores them encrypted, and autofills them only on the genuine site, cutting down on phishing that mimics a familiar login screen.
Multi-factor authentication adds the second layer that turns a stolen password into a useless string. Authenticator apps such as Authy or Microsoft Authenticator generate codes that expire every thirty seconds and do not rely on SMS, which remains vulnerable to SIM-swap fraud documented by the Australian Cyber Security Centre. Where possible, choose an authenticator app or a hardware security key over text message codes. Save the backup codes somewhere offline, such as a locked drawer or a printed sheet, so a lost phone does not lock you out of your own account.
Pause before you post or tag
Almost everything shared on social media can be cross-referenced with other data. A photo taken on a Bondi Beach afternoon quietly embeds GPS coordinates, a birth date in a profile reveals an answer to a common security question, and a check-in at your local cafe tells a thief when your house is empty. Re-read posts with the question, would I be comfortable if a stranger saw this with my full name attached? If the answer is no, leave it in the drafts folder.
Tagging friends and family deserves the same caution. Many Australians share pictures of kids at school events or at the cricket, and metadata in those images can reveal school locations, routines and even home addresses when combined with public records. Ask for permission before tagging, blur or crop school logos, and turn off location services for the camera app entirely. These small edits cost seconds and remove information that you cannot easily retract later.
Tidy up apps, quizzes and third-party connections
Third-party apps and personality quizzes are a quiet backdoor into your profile. Every time you log into a new service with Facebook or Google, you hand over a slice of your data, often including your friend list, email address and birth date. Walk through the connected apps section of each platform once a quarter and revoke anything you no longer use. That habit alone removes dozens of silent data flows from your account.
Old quiz results, harmless-looking games and abandoned sign-ins pile up over years. In Australia, where switching banks or energy providers often triggers requests for identity documents, leaving old accounts alive is more than a tidy-up exercise; it is a defensive move. Delete the apps you do not recognise, change the password on any account that has been part of a known breach, and consider an alias email address for non-essential social sign-ups so a leak there does not expose your primary inbox.
| Setting area | TikTok | X | ||
|---|---|---|---|---|
| Two-factor authentication | Authenticator app, SMS, hardware key | Authenticator app, SMS, WhatsApp | SMS, email | Authenticator app, SMS, hardware key |
| Default post audience | Friends | Followers (public by default) | Public | Public |
| Ad personalisation toggle | Settings > Ads > Ad topics | Settings > Ads > Ad topics | Settings > Ads | Settings > Privacy > Ads |
| Third-party app revoke path | Settings > Apps and websites | Accounts Center > Apps and websites | Settings > Apps and websites | Settings > Security > Apps and sessions |
| Location on posts | Manual check-in only | Manual check-in only | Manual check-in only | Manual check-in only |
Choose devices and networks you can trust
The phone in your pocket is the lock on the front door of your social life. Keep its operating system and apps updated, because those patches close the exact vulnerabilities that data-harvesting malware tries to exploit. Public Wi-Fi at airports, libraries and the ubiquitous café across from Flinders Street Station is convenient, but it is also a common hunting ground for packet sniffers. Use a reputable virtual private network on those networks, and turn off auto-connect so your device does not silently join a fake hotspot called "Free Airport Wi-Fi".
Budget handsets have come a long way in recent years, and many now ship with the same secure enclave chips that flagship models use. If you are weighing options for a new phone, this round-up of affordable handsets sets out which sub-$300 devices still receive regular security updates, which matters more than camera megapixels when privacy is the priority. Avoid sideloading apps from outside the official store, and review the permission list inside Settings each month so a flashlight app cannot quietly read your contacts.
Audit settings, then audit them again
Privacy menus change often, and what was opt-in one year may quietly switch to opt-out after a redesign. Schedule a fifteen-minute review every few months, set a calendar reminder if you have to, and check the audience setting on past posts. Limiting old photos and status updates to friends only is one of the simplest privacy wins, because future friends-of-friends cannot scrape content that was never public.
Search yourself on Google occasionally using a private browser window. Australians sometimes find old forum comments, employer listings or public records they had forgotten about, and these surfaces tell you what a recruiter, lender or curious acquaintance can see without ever sending you a friend request. Where something can be removed, submit the takedown request. Where it cannot, adjust future sharing so the picture keeps improving.
A useful habit, even after every audit, is to keep a simple written list of the three most important accounts and how to recover them if locked out. Store the list somewhere a flatmate or visitor cannot see it, alongside the recovery codes from the authenticator apps. The concrete next step is to spend ten minutes today opening the privacy menu of the platform you use most and switching one default setting from public to friends-only.