Forty-five minutes. That’s roughly how long it takes to work through the privacy settings on the three or four social accounts most Australians actually use, and in our experience almost nobody has done it since they first signed up. We hear from readers constantly who assume their Facebook profile is “private” because they ticked a box back when they joined, sometime around when everyone’s nan got dragged onto the platform by a grandkid. Settings drift. Platforms change their defaults, add new features that quietly reset old choices, and bury the controls that matter under three menus. This is the one we’d actually sit down and do this afternoon, not next weekend.
Our focus keyword for today is social media privacy settings, and we’re treating this as a practical, once-a-year maintenance job rather than a crisis. Nothing here assumes you’ve been hacked or that someone is targeting you specifically. It assumes the opposite: that you’re an ordinary person whose settings have simply been sitting on factory defaults for a decade, which is the much more common and much less dramatic problem.
Why this matters more in 2026
Two things changed the landscape this year that are worth naming upfront. First, the eSafety Commissioner’s social media minimum age of 16 came into force on 10 December 2025, which shifted a lot of platform behaviour around identity verification and account visibility, even for adults who had nothing to do with the policy’s original target. Second, scam tactics have gotten considerably more personal. The Scamwatch advice this year has leaned heavily on the fact that scammers are scraping public profile information, birthdates, workplaces, kids’ names, holiday photos, and using it to build convincing pretexts for the follow-up phone call or text. A scammer who already knows your employer and that you’re currently somewhere overseas doesn’t need to guess anything. That’s the actual risk model behind most of what follows: not some shadowy hacker breaking in, but a stranger doing five minutes of research on a profile you forgot was public.
We’d also point you to the OAIC’s privacy guidance, which covers the data-broker side of this problem well, if you want the longer read. For now, the practical version, platform by platform.
Facebook: the slow creep of defaults
Facebook is the platform where privacy settings decay the most, mostly because Meta periodically introduces new sharing features (think Stories, Reels, “On This Day” resurfacing old posts) that default to a broader audience than whatever you originally chose. Go to Settings, then Privacy Checkup, which Meta has kept as a genuinely useful guided tool for years now. Walk through every section, not just the first one that loads. Pay particular attention to three things.
Who can see your friends list is often public by default on older accounts, and it’s one of the easiest things for a scammer to exploit for impersonation. They clone your profile photo and name, add your actual friends one by one, and start messaging them “from you” asking for a quick favour or a gift card. Whether past posts are visible to “Public” versus “Friends” is the second thing, and you can bulk-change the audience on everything you’ve ever posted using the “Limit Past Posts” tool, rather than going through years of individual posts by hand. Third, whether your profile shows up in search engine results outside Facebook is a separate toggle entirely, buried away from the main privacy menu, and it’s the one most people never knew existed.
Our mildly unpopular opinion here: we don’t think you need to lock your profile down to “Friends only” across the board if you don’t want to. Plenty of advice treats any public visibility as inherently reckless, and we reckon that’s overcorrecting for people who use Facebook Marketplace, local community groups or small business pages where some public presence is the whole point of being there. The setting that actually matters is the friends list and the past-posts audience, not whether your profile photo is technically public to a stranger scrolling past.
Instagram and the tagged-photo problem
Instagram’s main privacy lever is the public/private account toggle, under Settings and privacy, then Account privacy. If you’re not actively building a public following or running a business page, there’s very little reason for a personal account to be public in 2026. The follow-request model costs you almost nothing in day-to-day use, and it closes off the single biggest source of unwanted contact: strangers browsing your holiday photos, your kids’ school uniforms visible in the background, or your home street number clear in a doorway shot.
Beyond the account toggle, check who can tag you and who can see posts you’re tagged in, both sitting under the same menu but easy to skip past. We’d also switch off “Show Activity Status”, the little green dot that tells people exactly when you were last online. It feels harmless, but it’s more useful to a scammer timing a call around when you’re clearly on your phone than it ever is to a genuine friend.
LinkedIn: the one everyone forgets
LinkedIn rarely makes anyone’s privacy checklist, which is odd given it’s the platform where people voluntarily publish their employer, job title, direct manager’s name and full work history in plain public view. That’s precisely the combination a scammer needs for a convincing “your IT department” or “HR payroll update” phishing email, something the Australian Cyber Security Centre has flagged repeatedly in its guidance on business email compromise at cyber.gov.au.
Go into Settings, then Visibility, and look at “Profile viewing options”, which lets you browse anonymously rather than notifying everyone whose profile you look at, and “Who can see your connections”. We’d leave your job title and employer public if you’re actively job hunting or networking, because that’s the entire use case for LinkedIn existing. But your connections list and your personal contact details tab are worth locking down, since they’re rarely needed by anyone outside people you’ve already connected with directly.
The setting everyone skips: old connected apps
This is the one we think does the most good for the least effort, genuinely. Every platform has a menu, usually under Settings, Security, or Apps and Websites, listing every third-party app or site you’ve ever logged into using “Continue with Facebook” or “Sign in with Google”. Most people have fifteen to thirty of these accumulated over a decade: a quiz app from 2016, a food delivery trial, a game you played twice and forgot existed. Each one is a live connection with some level of ongoing access to your profile data, and each one is a company you’ve never audited that’s sitting on your information indefinitely, long after you stopped using whatever it was.
Go through the list and revoke anything you don’t recognise or haven’t used in years. It takes roughly ten minutes across Facebook, Google and LinkedIn combined, and it’s the single most effective step in this whole checklist for actually shrinking how far your data has already spread, rather than just changing who can see new posts going forward.
Two-factor authentication: the non-negotiable
None of the above matters much if someone can simply guess or steal your password and walk straight in anyway. Two-factor authentication, often shortened to 2FA, adds a second step after your password, usually a short code sent to your phone or generated by a separate authenticator app. If your social accounts don’t have this turned on, that’s genuinely the highest-value five minutes in this whole afternoon, ahead of any individual privacy toggle we’ve mentioned so far.
We’d recommend an authenticator app over plain text-message codes where the platform supports it, since SIM-swap fraud (where a scammer convinces your telco to port your mobile number onto a new SIM card they control) can intercept SMS codes in transit. It’s a less common attack than straightforward phishing, but it’s not rare, and it’s entirely avoidable by using an app-based code instead. If you want the fuller picture on locking down the gear these accounts connect through at home, our home router security checklist covers the network side of this same problem.
The social media privacy settings to fix this afternoon
If you’ve got the full 45 minutes, we’d run it in this order: two-factor authentication first on every account, then the connected-apps audit, then Facebook’s Privacy Checkup, then Instagram’s account toggle and activity status, then LinkedIn’s visibility settings last, since that one typically needs the least adjustment once you’ve done the others. Skip any single item on that list and you’ve still done something genuinely useful. Skip all of them and you’re exactly where you started, which, fair enough, describes most of us until this week.
None of this is about assuming the worst of the internet, or treating every stranger online as a threat. It’s closer to locking the car even though your street’s never had a break-in. The data sitting on an unaudited social profile is genuinely useful to the kind of scam calls we’ve covered before in our piece on the new robocall tactics to watch for, and tightening it up costs you nothing in terms of how you actually use these platforms day to day. If you’re also curious about how much of this kind of data gets hoovered up by the AI features now built into your phone itself, we went through that separately in our look at the privacy cost of on-device AI.
Our take, plainly: do the audit once properly, put a reminder in the calendar for next October, and don’t lose sleep over it in between. Privacy settings are maintenance, not an emergency, and treating them that way is honestly the whole trick.
— Em Castellano, Security Writer, Tech Geek
Featured image: AI-generated illustration.
