The key board
Social media management: letting someone else run your accounts
When a business lets an outside manager into its social media accounts, it hands over a set of keys. This guide, published by Dotto, follows those keys from the day they leave the hook to the day they come back: how a manager gets in, what the agreement should settle, how paid posts are labelled, which reviews a manager must never write, and how the arrangement ends without the business losing its own accounts.
General information. This is general information, not legal or technical advice for your own business. The ACCC, the Australian Cyber Security Centre, IP Australia and business.gov.au are the places to check, and their pages are listed at the foot of each page.
Five hooks on the board
Giving access without giving away the account
Their own login rather than yours, the least access the work needs, and multi-factor authentication on every account.
What the agreement should cover
Who owns the posts and pictures made for you, what stays confidential, and what happens to both when the work stops.
Paid posts, and saying so
When a post is advertising, why the label has to be plain, and why the business answers for it.
The reviews a manager may not write
Fake reviews, reviews by people connected to the business, incentives, and taking bad reviews down.
Ending the arrangement
Changing logins, removing access and connected tools, collecting what you paid for, and watching for trouble afterwards.
A register of who holds which key
The Australian Cyber Security Centre’s small business handbook asks businesses to keep a record of shared accounts and of who has access to them, and to reduce that access where they can. It also says a business should understand what systems, information and accounts its external providers can access, review that access regularly, and remove it when it is no longer needed. An outside social media manager is one of those providers, so the record is where this guide starts.
| Account | Who holds access | Their own login? | Level | Access ends |
|---|---|---|---|---|
| Main business page | Owner | Yes | Administrator | Never: the owner’s key |
| Main business page | Outside manager | Yes | Only what the work needs | The day the agreement ends |
| Video account with one shared login | Owner and outside manager | No, shared | Full | Password changed when the manager leaves |
The third row is the one the handbook warns about. It says shared accounts increase security risks and make activity harder to track, and that where shared access is needed it should be tightly controlled. The first guide on the board covers how to keep that row short.
The keys move; the responsibility stays
The ACCC says social media is covered by the rules that govern all advertising and promotions, and its list includes “a business’s posts on its own social media accounts” and “social media posts that a business pays for”. Nothing in that list depends on whose hands were on the keyboard.
The ACCC’s advertising and selling guide, dated July 2021, gives an example that fits this site closely. A marketing firm, paid to improve businesses’ ratings, posts fake positive reviews on review websites. The ACCC says the firm’s conduct would breach the Australian Consumer Law, and that “the paying business may also have breached the ACL by being involved in the marketing firm’s conduct.”
So the work can be handed over, and the account can be shared, but the business’s name stays on every post. Each guide on this board is written from the business owner’s side of that arrangement: what to set up before the keys go out, and what to check when they come back.