Privacy settings: what they can’t protect

Privacy settings decide who can see something. They do not control what happens after someone sees it.

That single limit is the reason people who have carefully configured every toggle still get an unpleasant surprise. The settings did what they promise. They just do not promise very much, because the moment something reaches a person, it can be copied, screenshotted, forwarded, and stored somewhere no setting reaches.

So settings are worth doing, and they are the last layer rather than the first. The first is deciding what to put in.

What to take away

Three layers, in order of how much they actually protect you

Think of your exposure as three layers rather than one list of switches. They differ in how permanent they are, and effort spent on the wrong one feels productive and achieves little.

What you disclose. The content itself: what you say, what is in the photograph, what the account name reveals, what your profile fills in. This layer is entirely under your control and is the only one that is genuinely permanent, because a thing not published cannot be exposed later.

Who can reach it. Audience settings, follower approval, search visibility, message filtering, tagging permissions. Real protection, but conditional and revocable: it depends on the platform continuing to behave as it does today, on your account not being compromised, and on everyone in the permitted audience behaving well.

What is derived and retained. The record built from your activity: what you looked at, where from, on what device, with whom, for how long. Settings can reduce some of this and rarely eliminate it, and the parts you can turn off going forward often do not remove what was already collected.

Most people spend all their effort on the middle layer. The first layer is where the decisions that matter are made, and it costs nothing.

The four audiences you are actually setting for

Every choice you make is a decision about four different readers, and a setting that is right for one can be wrong for another.

The fourth row is the one people never think about and the one that argues most strongly for restraint at the first layer. Data outlives the company that collected it and the reasons it was collected. The only reliable protection against a future holder of a record is that the record does not exist.

Defaults move, and your settings do not move with them

Products get rebuilt. Features get added. Settings get renamed, split into two, merged into one, or moved to a screen you do not visit. When that happens, your previous choice is sometimes carried across, sometimes reset to a new default, and occasionally rendered meaningless because the thing it governed no longer exists in the same form.

Nobody tells you which of those happened. The result is that a profile you locked down once drifts open over a period of years without anyone doing anything.

The practical response is a recurring check rather than a one-time configuration, plus an immediate check after any of these:

Two useful settings to review are the default audience for new posts and approval for tags and mentions. Revisit them after a redesign or other changes that may affect who can reach you; the point is to make the check recurring, not one-time.

For example, on Facebook, “Who can see your future posts?” sets the default audience, while review of tagged posts can keep them off your profile until you approve them. On Instagram, “Private account” limits posts to approved followers, and “Manually approve tags” controls whether tagged posts appear on your profile. Labels and paths can change; these settings do not stop an approved follower from copying content or another person from posting about you elsewhere.

What links your accounts to each other

Most unwanted identification happens by joining accounts together rather than by breaking into any of them. The joins are mundane and almost all of them are things you did for convenience.

If separation between two identities matters to you, it has to be designed at the beginning: different handles, different photographs, different contact details, and no cross-posting. Retrofitting separation onto accounts that have already been linked is difficult and never fully succeeds, because copies of the earlier state persist elsewhere.

What a post carries besides its content

The visible content is not the whole disclosure.

Photographs carry technical data about when and where they were taken. Even when stripped, the picture carries the rest.

A street sign, a window view, a reflection, a delivery label, a screen. Also a document on a table, a distinctive interior.

Screenshots carry whatever else was on the screen, including notifications, tab titles, and other people's names.

Timing is information too. Regular posting from the same place at the same time describes a routine, and a routine is exactly what someone who means you harm wants to know.

None of this argues for paranoia. It argues for a habit: before posting a picture, look at the parts of it you were not thinking about. It takes two seconds and it catches almost everything.

Other people publish you

Your settings govern what you post. A significant part of your public footprint is posted by other people, and you have limited influence over it.

Common sources:

All of it accumulates, and services that compile personal records draw on exactly this kind of scattered public material.

What actually helps:

If your personal information appears on a site that compiles records, look for that site's own removal or opt-out process; not every site is covered by the same law or has the same removal route. For California residents, the California Consumer Privacy Act (CCPA) provides a way to request deletion from covered businesses, subject to exceptions. The California Privacy Protection Agency says businesses must confirm receipt within 10 business days and substantively respond within 45 calendar days to a delete, correct, or know request; those response timelines do not guarantee that every copy disappears. California request timelines

Expect it to be slow and to need repeating. Never pay a service on the strength of a warning email you did not ask for.

Treat an unsolicited Facebook or Instagram notice claiming a privacy violation, account suspension, or urgent verification requirement as possible phishing. Do not use its link or send a password, sign-in code, or identity document in response; open the service's app or website yourself to check for notices and report the message.

Private is not gone

Three distinctions worth holding on to.

Private is not deleted. Restricting the audience on old material stops new people finding it. It does not remove copies already taken, and it does not remove it from the service.

Deleted is not necessarily gone. Deletion removes something from view immediately and from systems on the provider's own timetable, and it does nothing at all about copies held by other people.

Disappearing is not disappearing. Content set to expire can be captured by anyone it reached, using nothing more sophisticated than another device.

The collection side of this is described in the FTC's material on how websites and apps collect and use your information. The industry that assembles those records is summarized in the Wikipedia article on data brokers.

Assume anything you send to another person may exist indefinitely. That is no reason to withdraw from ordinary life. Be deliberate about a narrow set: where you live or sleep, children, finances.

Add anything you would be harmed to see again in a context you did not choose.

Set for the worst plausible reader

The instinct is to configure for the average person who might see something. Configure instead for the least sympathetic one you can realistically imagine.

That is not usually a criminal. More often, it is someone with an ordinary motive and a personal connection: a former partner, a difficult colleague, a landlord, a counterparty in a dispute, or someone who has become fixated.

These readers know enough context to make small details meaningful. That is why information harmless to a stranger is not harmless to you.

Applied practically, a few defaults change: home and workplace stay off public profiles, and travel is posted afterward, not during.

Children appear with the agreement of everyone responsible for them, and without anything that identifies a school or routine. Anything about a live dispute stays off entirely, because the person you least want will read it closely.

If something is already out

Working from the assumption that everything is fine except this one thing is the wrong starting point, but so is panic.

Deal with it in order. Establish what is out and where, without spreading it further. Use the reporting route the service provides for the category involved, since content that breaks a specific rule is handled far faster than a general complaint.

Choose the specific category, such as sharing private information or impersonation, rather than a general abuse report.

Where the material relates to an account of yours, secure that account before anything else, because an ongoing compromise makes everything else pointless. Keep dated records of what you found and what you reported, and tell someone, because handling this alone is where people make decisions they regret.

If your identity is involved rather than only your content, IdentityTheft.gov is the FTC's reporting route in the United States, and the Canadian Anti-Fraud Centre takes the equivalent reports in Canada.

If the material involves a minor, threats, or extortion, that is a matter for law enforcement, immediately and before anything else.

In the United States the Internet Crime Complaint Center takes reports of online threats and extortion, and the National Center for Missing and Exploited Children runs the CyberTipline for reports involving minors.

What to hold on to

Settings are worth an afternoon and a calendar reminder, but they are the smaller half of the job.

The bigger half is what you decide not to publish. You choose what to keep separated from what, and how much you let others put on the record for you. Those choices keep working when a product changes, an account is lost, or a company you never dealt with holds your data.

Common questions

Is a private account enough?

It is a real improvement and it is not a boundary. Everyone you approve can copy anything you post, and approval lists grow over time in ways nobody audits. Treat a private account as reducing the audience, not as making something unpublished.

Should I delete old accounts?

Usually yes, and delete rather than abandon. An abandoned account still holds whatever you put in it, still appears in search, and is a route into other services if it was used for sign-in. Before deleting, retrieve anything you want and check what else uses that account to log in.

Does turning off location protect me?

It removes one strong signal and not the others. A photograph, a routine, a tagged venue, a visible landmark, or someone else's post can place you just as effectively. Location settings are worth using and are not sufficient by themselves.

How often should I review all of this?

A full pass once or twice a year is reasonable for most people, plus an immediate check after any redesign, any new device, and any change in your circumstances. Frequency matters less than actually doing it after the triggers.

Someone has published my personal details. What now?

Report it to the service under the specific category it falls into rather than as a general complaint, keep dated copies of what was posted, and consider whether it crosses into threats or harassment, which changes who should be involved. Do not engage with whoever posted it.