Five ways a platform redesign affects your privacy settings and how to check

Nobody wakes up and opens their privacy settings. Settings get opened once, usually after something unpleasant, and then left alone for years while the product underneath them is rebuilt three times.

That gap is where exposure grows. Not through a decision you made, but through a decision that stopped applying.

What to take away

The five things a redesign does to your setting

When a feature is rebuilt, your existing choice meets the new version in one of five ways.

Only the first is harmless, and it is the one you will assume happened. The middle three are common and produce no visible signal at all. That is the whole case for a recurring check rather than a one-time configuration.

Reading a settings prompt without losing

Products periodically interrupt you with a screen asking you to confirm or update something. Three habits make those screens safe.

Read the button, not the heading. The heading describes a benefit. The button commits you. A screen offering to improve your experience often has one prominent button that enables something and one small link that declines.

Assume the pre-ticked box is the answer that suits the company. Sometimes that also suits you. Deciding which is the point of the screen.

Do not accept in a hurry. These prompts appear when you are trying to do something else, which is not an accident. Dismissing and returning through the settings menu later gets you the same choices without the pressure.

There is a security edge to this too. A message telling you to review your privacy settings is a good pretext, because it is plausible and it leads to a login page. Reach the settings through the app or through a bookmark, never through a link in a message. The wider version of that rule is on phishing scams.

The changes that are not redesigns

Settings drift for reasons that have nothing to do with the product.

The last one matters most and is the one people delay. A settings pass is cheap and fast. Doing it the week the circumstances change rather than the month after is most of its value. The general habit of keeping devices and apps current, which is what causes several of these resets, is covered in CISA's advice on updating software.

Test the result, do not trust the label

A setting describes an intention. What you want to know is the outcome.

The test is simple and takes two minutes per account: open a private browser window, signed out of everything, and look at your own profile. Then, where you can, look at it from a second account that does not follow you.

Those two views show what a stranger and an acquaintance actually get, whatever the settings screen claims.

Do this specifically after any change, because that is when a label and its effect are most likely to have come apart. The full account-by-account version is in the social media privacy audit; this is the quick confirmation that the audit stuck.

Keeping a record that is worth keeping

You do not need a spreadsheet. You need enough to spot a difference.

For each account that matters, note the date, the audience you set for new posts, whether discovery by phone number and email is off, which permissions you granted, and anything you could not find. Keep it in plain text somewhere you will still have it in two years, and not inside the account it describes.

The value shows up on the second pass. A setting you know you turned off, now on, is a fact worth acting on. A setting you merely believe you turned off is an argument with yourself.

When the policy changes rather than the setting

Sometimes the switch stays exactly where it was and the meaning underneath it moves: a new use for data already collected, a new category of partner, a new feature that reuses your content. The consumer view of what that collection covers is set out by the FTC.

You usually learn from a notification you weren't reading, so when one arrives, do two things.

Check if the change is opt-in or opt-out; that tells you whether to act. Also look for a new control, since a new use often ships with a switch nobody seeks out.

Where you decide the change is not acceptable, the honest options are to use the service differently or to leave it. There is rarely a setting that undoes a business model. Deciding that early is better than discovering it slowly.

Common questions

How often is often enough?

Twice a year for a full pass, plus an immediate check after a redesign, a new device, and any change in your circumstances. The triggers matter more than the calendar.

A setting I turned off is on again. Was I hacked?

Usually not. Resets during redesigns and reinstalls are ordinary. Treat it as a prompt to check the rest of that account rather than as proof of anything, and if sessions or recovery details also look wrong, then treat it seriously.

Should I use the recommended settings the platform offers?

Read what they contain rather than accepting or rejecting on principle. Recommended bundles usually include several sensible security choices alongside one or two sharing choices that suit the platform. Take the first, decline the second.

What should I check first after a redesign?

Discovery and messaging: whether people can find you by phone number or email, and who can send you a message request. Those two decide whether the next unwanted approach reaches you at all. Then confirm your recovery contacts, which is the check described in privacy settings and worth repeating here.

Is it worth doing this on an account I no longer use?

Yes, and consider closing it instead. A dormant account keeps whatever defaults it had at its last redesign, and a tool from your privacy checkup pass will usually surface it.