Social Media Privacy Settings Face a Reckoning

Social media platforms are updating privacy settings after criticism, turning data protection from a buried menu option into a visible product feature. The changes respond to complaints about targeted advertising, opaque recommendation systems, location tracking and the reuse of public posts to train generative artificial intelligence.

For users, that shift is welcome, but it exposes a gap between controlling who can see a profile and controlling what happens to the information attached to it. A locked-down account can still sit within an advertising network, and declining one prompt does not necessarily stop related data flows elsewhere.

The pattern can be seen across Meta, Google, TikTok and X, although controls vary by country, device and account type. Some make personalised advertising easier to limit; others clarify AI prompts, change defaults for new accounts or surface connected apps. A cleaner settings page is progress, but not a complete withdrawal from tracking.

Default Settings Now Carry More Weight

The main criticism is not simply that users can change settings. It is that confusing defaults, repeated prompts and dark patterns make the protective choice harder than the advertising choice. Privacy advocates argue that meaningful consent should be clear, reversible and difficult to bypass.

Default settings matter because most people accept the path of least resistance. If personalised ads are preselected, or a new account begins with broad visibility, a nominal opt-out may have little practical effect. Platforms now face pressure to treat privacy-preserving choices as the starting point rather than an advanced preference.

Regulation is also changing the language used by product teams. Data controls and information sharing are becoming familiar labels, alongside warnings about recommendation systems and third-party apps. The interface is only one part of the test; regulators will look at whether a setting changes actual collection, sharing and retention.

Platform Changes Users Can See

The most visible changes concern advertising. More prominent controls for ad topics, personalised ads and data sharing allow people to narrow or refuse categories that influence what they see. In some markets, opting out of personalised advertising is easier; in others, the choice remains tied to login settings or a specific app.

AI features bring another layer. Users may be asked to control whether conversations, images or voice input can be used to improve models, and some platforms are adding limits for sensitive prompts. These controls are useful, but a single toggle cannot cover every way a service might process content.

Account security updates are often bundled into the same conversation. Passkeys, login alerts, session reviews and tighter third-party app permissions can reduce the risk that a data leak is mistaken for a harmless settings change. Australia has seen high public interest in scams, so local users may welcome controls that make suspicious access easier to spot.

Courts and Regulators Raise the Stakes

The legal debate is moving from policy preferences toward enforceable rights. In the United States, a Supreme Court hearing on a landmark digital privacy case could clarify how constitutional protections interact with commercial data practices. Although the ruling concerns a particular legal framework, companies selling services in multiple markets must consider how broad any duty of care becomes.

Regulators are taking a similar interest in design. The European Union’s GDPR already shapes the controls offered to Australian users of global platforms, while Australian regulators are examining whether existing privacy obligations cover data used for targeted advertising, behavioural analytics and automated recommendation. A service cannot offer one weak choice everywhere simply because its headquarters are elsewhere.

Class-action litigation adds financial pressure. Allegations involving misuse of private messages, children’s data and facial recognition have pushed companies to document how information moves. Court filings do not prove every claim, yet even the need to answer can force changes to consent screens, retention periods and data-access logs.

Australia's Distinct Privacy Environment

Australia relies on a mix of federal and state rules. The Privacy Act 1988 and the Australian Privacy Principles cover many organisations handling personal information, while the Office of the Australian Information Commissioner enforces them. State and territory laws can add obligations, particularly for health information and identifiers, so a single Australian setting is rarely the whole legal picture.

The local digital market is heavily influenced by global advertising platforms. Australian retailers, publishers and small businesses use Meta and Google tools to reach customers from Sydney to Perth, often through pixels and tracking embedded on websites. That makes privacy controls commercially sensitive: better defaults can reduce exposure while also affecting campaign measurement and remarketing.

Everyday language can make risk sound casual. When someone says “no worries, the app only asks for a bit”, they may not realise that location history, contact uploads and ad identifiers combine into a detailed profile. Australian campaigns against data brokers and proposed age-assurance rules show that privacy is not merely a technical concern, especially for younger users and people targeted by scams.

Younger Users, Data Brokers and AI

Teen accounts are a major focus for new restrictions. Platforms are adding private-by-default profiles, limits on stranger contact and controls over direct messages and location sharing. These steps reflect evidence that children can face harassment and commercial targeting before they understand the value of the information they are giving away.

Data brokers complicate the picture because a user may have no direct relationship with the company assembling the record. Aggregated location, advertising and purchase data can be used to infer income, interests or family circumstances. A social platform’s privacy menu may govern data held by that platform while leaving a broker’s separately sourced information outside the same control.

The spread of generative AI creates both new benefits and new exposure. People use assistants for work, study and personal advice, sometimes including health or family details. Clearer data-use prompts are welcome, especially when users believe a conversation is merely a search query. Australian privacy law continues to adapt, but that means users should check specific controls rather than assume all AI handling follows one global rule.

A Practical Privacy Audit

A short review can reveal more than an hour of anxious clicking. Start with the accounts that hold messages, photographs and payment details, then work outward to social profiles, connected apps and advertising choices. Keeping a record of the date and purpose of each change makes the exercise easier to repeat.

The following steps cover the highest-value actions for most Australian users without requiring specialist knowledge:

• Open the privacy menu for each major social account and disable location history, public discoverability and unnecessary contact syncing.
• Turn off personalised advertising and unlink advertising identifiers where the operating system or platform provides that option.
• Review connected apps and third-party websites, removing services you no longer use and revoking permissions that exceed their function.
• Use unique passwords with a password manager, enable multi-factor authentication or passkeys, and check recent login alerts.
• Check AI, voice and image features individually, removing any setting that permits personal content to be used for training without a clear choice.
• Revisit permissions after a major phone, browser or social platform update, because new features can restore an earlier sharing choice.

Privacy tools work best when paired with restraint elsewhere: avoid publishing identifying documents, use a separate email address for public forums, and explain to family members why a sudden request for a verification code deserves a second look. These habits reduce exposure even when a service’s controls are imperfect.

Make Privacy a Habit Today

The current wave of platform updates gives users a chance to assess changes rather than accept them on autopilot. Review the newest prompts, compare them with your existing settings and check whether choices carry across devices. What appears in a promotional announcement may differ from what a real account actually offers.

Act now: open the privacy settings of your most-used social platform, remove one unnecessary permission, disable personalised advertising and check that multi-factor authentication is active. Repeat the routine for your other main accounts, then set a recurring reminder to review them every three months. Start with one account today and make one privacy change before closing this page.