Who Owns Your Business Social Media Accounts?

Who owns your business social media accounts when a contractor or staff member leaves?

Usually, your business should be able to control accounts that were created for your business, using your branding, to speak to your customers. The tricky part is proving that control if the account was set up in someone else's name, with their email address, or without a clear written agreement.

This can feel stressful because social media is often where your customers find you, message you and trust your brand. The good news is that a few practical legal and admin steps can make the position much clearer.

Who Owns A Business Social Media Account In Australia?

It depends on the platform rules, the written agreements you have, and how the account was created and used.

Social media account ownership in Australia isn't always as simple as owning a laptop or a domain name. An account usually sits inside a platform's terms, such as Instagram, Facebook, TikTok, LinkedIn or X. Those terms often say the platform controls the account environment and can suspend, restrict or remove access in certain situations.

From your business perspective, there are a few different pieces to separate:

• Control of the account: Who has the login, admin access, recovery email and two-factor authentication.
• The handle or username: For example, a name that matches your business name or trade mark.
• The content: Photos, videos, captions, graphics, templates, reels, posts and ads.
• The audience: Followers, likes, comments, messages and customer relationships.
• The data: Customer enquiries, message history, insights, ad audiences and analytics.

The law doesn't usually treat all of these as one single item called the social media account. Your contract, IP ownership position, brand rights and practical access settings all matter.

If you have a company, the account should ideally be registered using your business email address and controlled through your company's systems. Your ABN or ACN doesn't automatically prove ownership of an Instagram account, but keeping the account tied to your business details helps show it belongs to your business, not a person who happened to set it up.

Does It Matter If A Contractor Created The Instagram Account?

Yes, it matters because contractors usually keep ownership of the intellectual property they create unless your contract says otherwise.

This surprises a lot of businesses. If you pay a contractor to create posts, take photos, design templates or write captions, payment alone doesn't always transfer copyright to your business. Under the Copyright Act 1968, copyright can automatically belong to the creator unless there's a written assignment or another exception applies.

That means a contractor who created your Instagram content may own some or all of the copyright in that content if your agreement didn't transfer it to you. You may still have an implied licence to use the content for the purpose you paid for, but an implied licence can be uncertain and may not cover everything you need, such as editing, reusing, advertising, sublicensing or moving the content to another platform.

For the account itself, the answer often comes down to evidence. If the contractor created the account:

• using your business name, logo and branding
• to promote your products or services
• with content approved by you
• as part of paid work for your business
• with customers believing they were dealing with your business

then you may have a strong argument that the account was created for your business and should be handed over. But without a written contractor agreement, you may still face delays, platform issues and disagreement about what exactly must be returned.

Say you run a cafe in Brisbane and you hire a freelance social media manager to launch your Instagram page. They create @yourcafename, post your menu, reply to customer DMs and run paid ads. Six months later, the relationship ends and they refuse to hand over the password unless you pay extra. If your contractor agreement says the account, handle, content, data and login details belong to your business, you have a much clearer path to resolve it. If the agreement is silent, you may need to piece together invoices, messages, briefs and approvals to show the account was created for you.

What If An Employee Or Staff Member Set It Up?

Usually, your business is in a stronger position if an employee created or managed the account as part of their job.

In many cases, copyright in work created by an employee in the course of their employment belongs to the employer. So if your marketing employee creates social media graphics, writes captions and manages your business pages as part of their role, your business will often own that work.

That said, there are still practical risks. If the employee set up the account using their personal email address, personal mobile number or personal two-factor authentication app, you can end up with an access problem even if your legal position is strong.

You should also deal with staff access carefully. If someone leaves your business, don't withhold wages or entitlements because they haven't returned a password. Employee pay and final entitlements are regulated under the Fair Work Act 2009 and any applicable modern award or enterprise agreement. Keep the employment issue separate from the account handover issue, and use your employment contract, workplace policies and exit process to require return of company property, confidential information and system access.

A good employment contract or social media policy should make it clear that:

• business accounts belong to your business
• staff must use approved business emails and tools
• passwords and admin access must be returned when requested
• staff can't change handles, remove admins or delete content without approval
• confidential information, customer data and marketing assets must stay with your business

Who Owns The Handle, Followers, Content And Logins?

They aren't all treated the same, so you should deal with each item separately.

The Handle Or Username

A social media handle is usually controlled by the platform, not owned in the same way as registered property. But if the handle includes your business name, trading name or trade mark, you may have rights that help you challenge misuse.

If your business name is distinctive, it may be worth registering it as a trade mark with IP Australia. A registered trade mark can make it easier to show that a confusingly similar handle is trading off your brand. It can also help with platform takedown or impersonation processes.

The Australian Consumer Law can also be relevant if someone uses a page in a way that misleads customers into thinking they're dealing with your business. For example, if a former contractor keeps using a branded account to take bookings or promote a competing service, that can create misleading conduct concerns as well as contractual and IP issues.

The Followers

You don't really own followers. Followers are individual users who choose to follow an account under the platform's rules.

What your business can protect is control of the account that has built that audience, plus the customer data and communications connected to your business. If someone takes the account, they may also take valuable goodwill, message history and leads.

The Content

Content ownership depends on who created it, whether they were an employee or contractor, and what your agreement says.

You should check your contracts for words such as assignment, copyright, moral rights, licence, deliverables and portfolio use. A tailored clause can give your business ownership of final materials, a broad licence to use drafts or raw files where needed, and consent to adapt content for ads, email marketing, your website and other platforms.

The Logins And Admin Access

Logins are about control rather than copyright. Even if your business owns the content, you can still be locked out if one person holds the recovery email, phone number or authenticator app.

Keep logins in a business-controlled password manager, use a business email address, and make sure more than one authorised person has admin access. For Meta accounts, this often means using a business manager setup rather than sharing one personal login.

What Should You Do If There Is A Password Or Access Dispute?

Start with calm, practical steps that preserve your evidence and reduce the risk of customer confusion.

If a contractor or staff member has left and you can't access the account, avoid guessing passwords, trying to access their personal email, or using any method that could create a cybersecurity or privacy issue. Focus on proving the account is business-related and recovering access through proper channels.

Step 1: Collect Your Evidence

Gather anything that shows the account was created or managed for your business, such as:

• contracts, proposals, invoices and statements of work
• briefs asking the person to create or manage the account
• messages approving the handle, posts or ad spend
• screenshots of the account using your business name, logo and products
• receipts for paid ads or boosted posts paid by your business
• records showing customer enquiries were handled through the account

Step 2: Send A Clear Handover Request

Ask for the handover in writing and be specific. List the account names, admin roles, recovery email changes, passwords, two-factor authentication transfer, ad accounts, content files, analytics, customer enquiries and any scheduled posts.

If your contract has a handover clause, refer to it. If it does not, keep the tone professional and focus on the fact that the account was created and used for your business.

Step 3: Secure What You Still Control

Change passwords for connected systems, such as your email marketing platform, website, design tools, ad account, shared drives and password manager. Remove access for anyone who no longer needs it.

If the account includes customer DMs or personal information, treat that information carefully. The Privacy Act 1988 applies to many businesses with annual turnover over $3 million, and to some smaller businesses such as health service providers and businesses that trade in personal information. Even if the Act doesn't apply to your business, customers will expect you to handle their data responsibly.

Step 4: Use The Platform's Recovery Process

Most platforms have processes for hacked accounts, impersonation, trade mark complaints, business admin disputes or account recovery. The exact pathway depends on the platform and what evidence you can provide.

If you have a registered trade mark, business name registration records, ad receipts and clear screenshots, you'll usually be in a better position than if the account was run informally through someone's personal profile.

What Social Media Clauses Should Your Contractor Agreement Include?

Your agreement should spell out who controls the accounts, who owns the content, and what must happen when the work ends.

This is where many disputes can be prevented. A one-page template or social media management agreement may say the contractor will provide social media services, but miss the parts that matter when the relationship ends. Documents work best when they're tailored to how your business actually uses social media.

Consider including clauses that cover:

• Account ownership and control: Any account, page, group, ad account or handle created for your business belongs to your business or must be transferred to your business on request.
• Admin access: Your business must always have owner-level or admin-level access, not just viewer access.
• Login details: Accounts must be registered to an approved business email and managed through approved systems.
• Two-factor authentication: The contractor must not be the only person who can approve logins or recovery codes.
• IP assignment: Copyright in deliverables is assigned to your business, usually on payment, with enough detail to cover posts, captions, images, videos, templates and ad creative.
• Licence for third-party materials: Any stock images, fonts, music, templates or creator content must be properly licensed for your intended use.
• Moral rights consents: Where appropriate, the contractor consents to reasonable edits, cropping, reposting and adaptation of the work.
• Confidentiality: The contractor must protect business information, customer information, campaign data and strategy.
• Handover obligations: On request or when the contract ends, the contractor must provide passwords, files, analytics, customer enquiries, drafts and scheduled content.
• No deletion or lockout: The contractor must not delete content, change handles, remove admins, transfer pages or hold access as leverage for a dispute.
• Portfolio use: If the contractor wants to show the work in their portfolio, your agreement should say what they can share and when.

You can also include practical rules in a social media policy or operations checklist. The legal agreement sets the rights, and the policy helps your team follow the process day to day.

How Can You Prevent This From Happening Again?

You can reduce the risk by treating social media accounts like core business assets, not informal side tasks.

Start with the basics. Every business account should be connected to a business email address that your business controls. Avoid creating key accounts with a contractor's personal Gmail, a staff member's mobile number or an agency owner's personal profile where possible.

Set up a simple access system:

• use a password manager controlled by your business
• keep a register of every account, handle, admin and recovery email
• review access whenever someone changes role or leaves
• give people the lowest access level they need to do the job
• keep at least two trusted business admins on key accounts
• back up important content, raw files and analytics regularly

For contractors, include account control and IP clauses before work starts. For employees, update your employment contracts, social media policy and exit checklist. For agencies, make sure your services agreement says who owns accounts, ad accounts, pixels, audiences, creative assets and campaign data.

If your brand is central to your social media presence, consider trade mark protection. A registered trade mark won't automatically recover a password, but it can help show that a handle or account is wrongly using your brand.

Also think about customer communication. If an old account is no longer under your control, you may need to tell customers which account is official and ask them not to send personal information to the old page. Keep the message factual and calm.

Key Takeaways

• Social media account disputes usually involve several separate issues: account control, handles, content, followers, logins and customer data.
• Contractors generally keep copyright in work they create unless your agreement assigns it to your business.
• Your business is often in a stronger position with employee-created content, but access problems can still happen if accounts use personal emails or phone numbers.
• A clear contractor agreement should cover account ownership, admin access, IP assignment, handover, confidentiality and no lockout rules.
• Business-controlled emails, password managers, two-factor authentication planning and access registers make disputes much easier to avoid.
• If a dispute has already started, collect evidence, make a clear handover request, secure connected systems and use the platform's recovery process.

If you'd like help with your contractor agreements, employment documents, social media clauses or IP ownership arrangements, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.