Reviews
Part of Privacy settings: what they can’t protect
Social media privacy audit: a platform-independent framework
A platform-independent social media privacy audit framework for reviewing visibility, discovery, contact, data reuse, history, apps, sign-in and shared access.
Menus move, labels get renamed, and settings pages are reorganized every year. This social media privacy audit is a platform-independent framework for reviewing the decisions behind those controls, not a menu-by-menu guide for a particular network. The underlying questions remain the same: who can see, find, or contact you, and what happens to your information.
Set aside about an hour, do one account at a time, and use a computer if you can: the full settings are often only exposed there. Work through the eight groups below and note what you changed, because it makes the next pass much faster.
What to take away
- Choose the narrowest audience settings you can live with for new posts, and review older posts separately.
- Reduce how easily people can find or contact you by checking search, contact-upload, message-request, tag, and invitation controls.
- Review what the account stores or shares, including activity history, connected apps, active sessions, and delegated access.
1. Who can see what you post
Who can see what you post
- Set new posts to narrowest audience
- Bulk-limit all past posts
- Review profile fields visibility
- Check photo album visibility
- Set stories audience separately
- Hide friend or follower list
- Default audience for new posts.Whatever this is set to is what you will publish under when you are distracted. Set it to the narrowest option you can live with.
- Past posts.Look for the bulk control that limits everything you have already published. Years of posts made under an older, more open default are the largest single exposure on most accounts.
- Profile fields.Birthday, phone number, email, employer, school, relationship status, family links, home town. Each is separately visible and each is a building block for account recovery questions and for a convincing impersonation.
- Your photo albums, including the ones you have forgotten: profile picture history and cover photo history are often public regardless of everything else.
- Stories and short-form posts.These usually have their own audience setting that ignores your main one.
- Who can see your friend or follower list.Hide it. A visible list is the raw material for a cloned account that messages everybody you know.
2. Who can find you
Who can find you
- Restrict phone and email search
- Turn off search engine linking
- Withdraw contact upload
- Exclude yourself from suggestions
- Use a unique handle
- Search by phone number and by email address.These reverse lookups link the identity you use publicly to the number on your bank account. Restrict them.
- Whether search engines may link to your profile.A separate switch on most platforms.
- Contact upload and friend suggestions.Check whether the app has your address book and whether it is using it to suggest you to people. Withdraw the upload if you can; it is what surfaces you to people you deliberately do not talk to.
- Suggested-account visibility.Some platforms let you exclude yourself from being recommended to others.
- The username and handle itself.A handle you reuse everywhere ties your accounts together for anyone looking.
3. Who can reach you
Who can reach you
- Filter message requests
- Restrict group invitations
- Limit who can comment
- Review tags and mentions
- Learn block and restrict
- Find impersonation report route
- Message requests from people you do not follow.Most unwanted first contact (scams, catfishing approaches, extortion openers), arrives here. Filter or close it.
- Group and channel invitations.Restrict who can add you without asking.
- Comments and replies.Choose who may comment, and keep the keyword filter if the platform has one.
- Tags and mentions.Turn on review before a tag appears on your profile, and control who may tag you at all.
- Blocking and restricting.Learn where both live before you need them. Restricting is quieter than blocking and does not tell the other person.
- Reporting routes.Find the impersonation report, which is usually separate from ordinary abuse reporting and usually faster.
4. What is reused
What is reused
- Edit ad topics and interests
- Disconnect off-platform activity
- Opt out of advertiser lists
- Choose model training deliberately
- Accept public content reuse risk
- Ad topics and interest categories.Read the list the platform holds about you. It is longer and more specific than most people expect, and it can be edited.
- Off-platform activity.Data collected about you elsewhere and linked to your account, usually with a control to disconnect or clear it.
- Advertiser and partner data.Where offered, opt out of the lists uploaded by businesses you have interacted with.
- Your content used to train models.Where the platform gives a choice, make it deliberately rather than by default.
- Public content reuse.Anything public can be copied, and profile photos in particular are used to build fake accounts. This is an argument for a narrower default rather than for a warning label.
5. The history you have accumulated
History you have accumulated
- Review and delete location history
- Clear search and watch history
- Remove old check-ins
- Strip photo metadata before sending
- Download your data export
- Empty deleted content trash
The history you have accumulated
- Location history.Whether it is being collected, what is stored, and how to delete what exists.
- Search and watch historyinside the app.
- Old check-ins and tagged locations, especially anything that maps your home, your workplace, or a routine.
- Photo metadata.Most platforms strip location data on upload, but files you send directly (as an email attachment, a chat file, a cloud link), usually keep it.
- Your data export.Download the archive once. Reading what the platform actually holds is the most persuasive part of this whole exercise, and it shows you what would be exposed in a breach.
- Deleted content.Check the trash or recently-deleted area, which often retains items for a while after you thought they were gone.
6. Connected apps and third-party logins
Connected apps and logins
- Remove unused connected apps
- Check each app's permissions
- Review sites using this login
- Move important sites to own credentials
- The list of connected apps.Remove everything you do not currently use. Quizzes, old games, defunct scheduling tools, and abandoned analytics services keep whatever access they were granted.
- What each remaining app can do, not just that it is connected. Read access and post-on-your-behalf access are very different things.
- Sites you signed into using this account.Convenient, and it means a compromise of this one account reaches all of them. Move the important ones to their own credentials.
7. Devices, sessions, and sign-in
Devices, sessions, sign-in
- Sign out unknown active sessions
- Turn on login alerts
- Prefer passkey or authenticator
- Confirm recovery email and phone
- Store backup codes offline
- Active sessions.Sign out anything you do not recognize, and anything on a device you no longer own.
- Login alerts.Turn them on so a new sign-in tells you.
- Two-factor method.Prefer a passkey, a security key, or an authenticator app over text codes.
- Recovery email and phone.Confirm both are current and that you still control them. A stale recovery address is a permanent open door.
- Backup codes.Generate them and store them somewhere that is not the account they protect.
8. Shared and delegated access
Shared and delegated access
- Page, group, and business roles.Remove people who have left, and reduce anyone who has more access than their job needs.
- Shared devices and saved logins.A family tablet with your session still signed in is an access route.
- Family and child accountslinked to yours, and what each can see or do.
- Legacy and inactive-account settings.Decide now what happens to the account if you cannot manage it, rather than leaving it for someone to work out later.
Afterwards
Two things make an audit stick. Put a reminder in the calendar to repeat it: platforms add settings and occasionally reset them. A review after any major app redesign is worth twenty minutes.
What platforms collect underneath these switches is described in FTC's material on how websites and apps use your information, and the sign-in half of the same review is CISA's guidance on multi-factor authentication.
Re-run the discovery and contact sections after any incident, because those settings determine whether the next unwanted approach reaches you at all.
For the underlying principles behind these choices, see privacy settings. Where the audit turns up a sign-in problem rather than a visibility one, the order to work through is account security, and the messages that arrive because you were easy to find are the subject of phishing scams.
Common questions
Does a private account make me safe?
It reduces exposure; it does not make content unrecoverable. Anyone you approve can screenshot and share. Treat privacy settings as narrowing the audience, not as a guarantee about what happens next.
Should I delete old posts or just hide them?
Bulk-limiting the audience is faster and reversible, and it handles the overwhelming majority of the risk. Delete individually where a post contains an address, a document, a ticket, a phone number, or someone else's child.
Is it worth doing this on an account I barely use?
Especially there. Dormant accounts keep old defaults, old passwords, and old connected apps, and they are the ones most often used to clone an identity. Either audit it or close it.
My friend list is how people find me. Do I have to hide it?
Hiding the list does not hide you: people can still find and follow you. It removes the ready-made contact list that makes a cloned account convincing, which is the specific harm.
