Protect your privacy online

Many of us share information about our lives online without a second thought.

We share life updates on social media, enter personal details into online shopping websites, and more.

But once your information is online, you’re no longer in control of where it goes and who can access it.

Cybercriminals can commit online scams, fraud and other types of cybercrimes using the information they find online about you.

For example, you’re more likely to be tricked into believing a cybercriminal is from a legitimate organisation if they know your full name and email address.

If cybercriminals have your personal information, you’re also more likely to have your identity stolen. A common example of identity theft is a cybercriminal setting up a social media account pretending to be you and then messaging your friends for money.

You can gain more control over who can access your personal information by taking proactive steps to protect your privacy online. Learn how to get started below.

It's important to be aware of how much of your online self you’re sharing and who you’re sharing it with.

This includes:

what you choose to share yourself

what you’re asked to share by the organisations you have online accounts with

what you’re sharing due to the settings of the apps on your phone.

Is a free service really free?

‘Free’ services, such as some social media websites and apps, aren’t entirely free. These companies often make money by selling customer data to third parties, such as marketers. So limiting what you share will help to protect your privacy.

Tips to protect your privacy online

Organisations often ask us to share our personal information when we sign up for a new service, update our details or make a payment online.
Before providing your personal details to an organisation:
- Check that the request is legitimate. Always double-check where requests for personal or financial information are coming from. Confirm that the organisation is really who they say they are. Doing this helps reduce your risk of getting tricked by scams and phishing.
- Check what’s optional to share. Organisations may ask you to provide them with additional, non-mandatory information. Instead of filling out every section of a form or sign-up page, check which fields you can leave blank. For example, if it’s optional to provide your home address, consider not providing it.
- Check if there’s another option. In some cases, you may be able to avoid providing your actual personal information. For example, if an online retailer asks when your birthday is to send you a ‘birthday reward’, enter a made-up day and month.
Before sharing personal information with an organisation, check their privacy policy.
A privacy policy provides details about how an organisation collects, stores, uses and discloses personal information from website visitors and app users.
Don’t give out your personal information unless you are comfortable with how it’s going to be used or disclosed.
You can usually find an organisation’s privacy policy at the bottom of their website. If you’re signing up for a new service, platform, app or newsletter, you’ll often be asked to read through the organisation’s privacy policy. In most cases, this can be found at the end of the sign-up form.
Keep in mind that by accepting a privacy policy, you’re permitting that organisation to use anything you share – such as your photos, posts, and other details – in the ways outlined in that policy.
Privacy policies are usually quite long, so you may feel like it's not worth the effort to check them. But checking them is the only way to work out if you’re comfortable with how your information is going to be used.
Look out for:
What information is being collected. Understand what information will be collected by the organisation. Pay particular attention to any information which goes beyond what you provide directly (e.g. location data, device identification data and data from third parties).
How your information will be used. Consider what purposes your data will be used for within the organisation, and whether your data will be shared with other organisations for other purposes (e.g. advertising).
How your information is stored. Identify what data security protocols are in place, and whether your data will be stored locally or overseas. Also consider how long your data will be retained for by the organisation.
How to contact the organisation. Understand how to contact the organisation if you wish to access, correct, destroy or de-identify personal information they hold. Where appropriate, it’s also useful to be aware of how you might make a complaint about the use or disclosure of your data.
Most popular websites and apps have had their privacy policies reviewed by privacy experts. You can do a quick search to find out what they have to say about a website or app’s privacy policy to help you decide.
Real-life examples
Many social media companies state in their privacy policies that they may use the content you post on their platforms in some way. They might use your content to train artificial intelligence (AI) or other algorithms, like facial recognition.
Some apps’ privacy policies have even stated that they own anything you post on their app.
So make sure you know what you’re agreeing to before accepting a privacy policy.
Make sure that your apps don’t have access to features that you’re not comfortable with. Remember, not every app on your phone needs access to your messages, photos and contacts.
Top tip
Not using an app anymore? Delete it. This will delete the app data and app settings stored on your device and free up space on your device.

Note, if you have an account associated with the app, you'll need to log in and close your account as an additional step if you want to remove your data from the developer’s servers.
If you receive a request for information that seems unusual or doesn’t feel quite right, it may well not be.
Suspicious requests may be a sign that a cybercriminal is trying to scam you.
For example, your bank would never ask you to update, confirm or disclose your personal or financial details via email. You can check if a request like this is legitimate by logging in using the official website or official app.
Social media is home to scammers who are on the hunt for potential targets and their personal information. The things you post on social media could be used to steal your identity, hack your online accounts or break into your house when you’re away.
Protect yourself by following these tips:
- Think twice before posting personal details online. For example, where you live and work, when you’re going on holiday or where you went to school.
- Check the privacy controls on your social media accounts. Switch your privacy settings to ‘Private’ or ‘Friends only’. That way, you know who you’re sharing your posts and information with.
- Unlike, unfollow and leave any groups you don’t keep up to date with. The same goes for any accounts you no longer use.
- Don’t share more than necessary. For example, certain fields like ‘About me’ are optional.
- Avoid doing online quizzes that ask for your personal information. For example, a quiz called ‘What's my spirit animal?’ might ask you to share your favourite things and other information about yourself to get the result. These quizzes may be used by scammers. They may be able to take the information you give to get into your online accounts.
- Don’t unintentionally tell people what your password may be. For example, if you share a picture of your pet on Facebook and caption it with their name, don’t use their name as your password.
- Be cautious if accepting a friend request from someone you don’t know in real life. Check their profile thoroughly. They may not be who they say they are. Accepting fake friend requests makes your account vulnerable to hackers and scammers. Once they’re your social media friend, they can easily gain access to your personal information. From there, they can try to scam you or steal your identity.
  
  They may also use their connection with you to build credibility. This will make it easier for them to add your other friends, gain access to their personal information and try to scam them.

More privacy tips

Don’t use personal information in your answers to account recovery questions. Account recovery questions help you to get into your accounts if you forget your password. If you use personal information for your answers, it’s easier for cybercriminals to find this information online and gain access to your accounts.

Instead, be creative with your answers. For example, instead of answering which city you were actually born in, write something creative like ‘Neverland’ or ‘Themyscira’.

Create strong passwords. Make your passwords long, unique and random.

Enable multi-factor authentication (MFA). Add an extra layer of protection by turning on MFA for all your online accounts.

Use a password manager. A password manager offers an easy and secure way to manage your passwords and account recovery answers.

Get help

Your privacy rights

The Office of the Australian Information Commissioner promotes and upholds your rights to have your personal information protected. Visit their website for further information on your privacy rights or how to make a complaint if you think an organisation or agency has mishandled your personal information.

Support with online safety

eSafety is Australia's independent regulator for online safety. Visit the website to learn how to prevent and deal with harm caused by serious online abuse or illegal and restricted online content.

Report cybercrime

Report cybercrime securely using ReportCyber. Your report will be referred directly to the relevant law enforcement agency for assessment.

More resources

Visit our Get help page for more resources to help you.

Safety & emergencies

Updated 19 February 2025

Protect your privacy online

On this page

How much are you sharing, and with who?

Is a free service really free?

Tips to protect your privacy online

More privacy tips

Get help