Australia

A social media platform is collecting excessive data beyond what's needed. Can I complain?

13.1 million
Australian users affected by privacy breaches (2023)
30 days
OAIC response time for complaints
APP 3
Relevant Privacy Principle
$2.3M
Max penalty for serious breaches
The Short Answer

Yes, you can complain to the Office of the Australian Information Commissioner (OAIC) if a social media platform collects more personal information than necessary for its functions.

What the Law Says

Australia’s privacy laws require organisations to collect only the personal information that is reasonably necessary for their functions or activities.

The Privacy Act 1988 (Cth) sets out the Australian Privacy Principles (APPs), which apply to most Australian businesses and government agencies — including social media platforms operating in Australia.

APP 3 specifically limits collection: an organisation must not collect personal information unless it is reasonably necessary for one or more of its functions or activities. This means collecting excessive or irrelevant data — like location history, contact lists, or biometric data without clear justification — may breach the law.

The Act also requires organisations to notify individuals about why information is being collected, who it might be shared with, and how they can access or correct it (APP 5).

Statutory Text

An organisation must not collect personal information unless the information is reasonably necessary for one or more of its functions or activities.

— Privacy Act 1988 (Cth), s. 16A — APP 3.1
Statutory Text

An organisation must take such steps (if any) as are reasonable in the circumstances to ensure that the personal information it collects is relevant to the function or activity for which it is collected.

— Privacy Act 1988 (Cth), s. 16A — APP 3.4

What to Do

1

Check the platform’s privacy policy to identify what data is collected and why.

2

Contact the platform directly to request correction or deletion, citing APP 3 and APP 12.

3

If unresolved within 30 days, lodge a formal complaint with the OAIC at oaic.gov.au/complaints.

4

Include screenshots, dates, and details of the excessive data collection in your complaint.

Sources

statutePrivacy Act 1988 (Cth), s. 16A — Australian Privacy Principle 3guidanceOAIC: How to make a privacy complaint

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.