Social Media Privacy Settings Guide: Lock Down Your Accounts

Why Your Default Social Media Privacy Settings Are a Security Risk

Every major social media platform ships with settings that favor maximum visibility over personal privacy. Your posts, photos, employer, hometown, and date of birth may be publicly indexed by search engines and accessible to anyone on the internet — including people who want to exploit that information.

This social media privacy settings guide gives you a platform-by-platform action plan to close those gaps in under an hour. The threat is not abstract. Cybercriminals, scammers, and identity thieves routinely use Open-Source Intelligence (OSINT) techniques to scrape social profiles for data that fuels targeted attacks.

A birthday in your bio, an employer tag, and a childhood hometown visible in your "About" section can be enough to answer security questions, compromise an account recovery flow, or file a fraudulent tax return in your name. The Pew Research Center reports that 72% of U.S. adults actively use at least one social media platform — which means the aggregate exposure is enormous.

If you haven't reviewed your privacy settings since creating your accounts, you are almost certainly sharing far more than you intend. This comprehensive social media privacy settings guide walks you through what to change and why, covering Facebook, Instagram, LinkedIn, TikTok, and X (formerly Twitter).

How Attackers Use Your Public Profile Data Against You

Before adjusting settings, it helps to understand what attackers actually do with overshared information. Threat actors who target individuals — for financial fraud, account takeover, or spear-phishing — follow a consistent playbook that starts with passive reconnaissance. They don't need to hack anything. They read your profile.

A public Facebook profile might reveal your full name, date of birth, hometown, relationship status, employer, and school history. LinkedIn adds your job title, reporting structure, and recent projects. Instagram exposes your daily routines, travel patterns, and social circle. TikTok reveals interests, location check-ins, and even voice patterns through videos.

Individually, each piece seems harmless. Combined, they give attackers enough material to answer knowledge-based security questions, craft targeted spear-phishing emails, bypass account recovery, and build synthetic identity profiles.

Understanding how your data looks from the outside is the first step. For individuals in high-risk professions, consider our personal cybersecurity assessment to identify additional exposure points beyond social media.

Facebook Privacy Settings: The Most Impactful Changes

Facebook offers more granular privacy controls than most platforms, but finding them requires deliberate effort. Start with Settings & Privacy > Privacy Checkup — Facebook's built-in wizard steps you through the highest-priority controls in sequence.

Posts and Profile Visibility

Under Settings > Privacy > Your Activity, set "Who can see your future posts?" to Friends. Then use the "Limit Past Posts" tool to retroactively restrict all previous public posts. This is a one-way change that cannot be reversed globally, so confirm you've saved anything you want to preserve before running it.

In Settings > Profile and Tagging, turn on tag review so every tag from another user goes into an approval queue before appearing on your timeline. This prevents others from publicly linking you to events or locations without your knowledge.

Search Engine Visibility

Under Settings > Privacy > How People Find and Contact You, disable "Do you want search engines outside of Facebook to link to your profile?" This removes your Facebook profile from Google and Bing results over the following weeks. Also change "Who can send you friend requests?" to Friends of friends to reduce exposure to fake and throwaway accounts.

Connected Apps

Go to Settings > Apps and Websites. Most longtime users will find dozens of applications with active read access. Remove anything you don't actively use, and pay particular attention to apps that requested access to your friends list — those frequently harvest social graphs, not just your own data.

Instagram, LinkedIn, TikTok, and X: Platform-Specific Controls

Each platform requires a tailored approach to privacy. This social media privacy settings guide covers the essential controls for each major platform, focusing on the changes that provide the most protection with minimal impact on functionality.

Instagram

The single most impactful Instagram change is switching from a public account to a private account under Settings > Account Privacy. All future follower requests must be approved before they can view your posts or stories. For existing followers, your content remains visible immediately — this setting only gates new requests going forward.

Beyond that, disable your activity status under Settings > Privacy > Activity Status so others can't see when you're online. In Settings > Privacy > Story, restrict who can reshare your stories and turn off the option allowing others to add your posts to their own. Review connected apps under Settings > Apps and Websites and revoke anything inactive.

LinkedIn

LinkedIn requires a different balance — you want to be discoverable by legitimate professional contacts, but not expose personal data to bad actors. Go to Settings > Visibility > Profile Viewing Options and set yourself to appear as "LinkedIn member" when browsing other profiles anonymously. This prevents competitors or social engineers from seeing who's researching them.

Under Settings > Visibility > Connections, hide your connections list. A visible network is a ready-made targeting list for anyone impersonating a colleague. Also turn off data sharing with third-party applications under Settings > Data Privacy, and disable the "People also viewed" widget on your profile page.

TikTok

TikTok's algorithm relies heavily on personal data, making privacy settings essential. Switch to a private account under Settings > Privacy > Privacy and safety. Turn off "Suggest your account to others" features that use your phone contacts, Facebook friends, or browsing patterns. Disable location services completely and review which personal information appears in your bio.

X (formerly Twitter)

In Settings > Privacy and Safety > Audience and Tagging, enable "Protect your posts" to make your account private. Under Settings > Privacy and Safety > Location Information, turn off precise location access and remove stored location data from past posts. X collects granular location data by default — disabling it going forward does not delete historical records, so submit a data deletion request through the platform's privacy settings if past location exposure is a concern.

Third-Party Apps Are a Silent Privacy Drain

Connected applications represent one of the largest blind spots in social media privacy. When you sign up for a service using "Login with Facebook" or grant an app permission to post on your behalf, that application receives an access token with specific permissions that typically don't expire automatically.

Popular fitness apps, gaming platforms, and productivity tools accumulate these permissions over years. Even if you stop using the service, the app retains the ability to read your profile data, friend lists, and in some cases post content. Data brokers specifically target these dormant connections because users forget they exist.

The most dangerous permissions involve friend list access. Apps that can read your social graph often mine that data to build targeting profiles for advertising or sell contact lists to third parties. Games that request friend list access to enable social features frequently retain and monetize that data long after you've deleted the game.

For organizations handling sensitive client information, our cybersecurity for accounting and CPA firms covers additional data protection requirements beyond personal social media hygiene.

Privacy Mistakes That Leave You Exposed After Updating Settings

Reviewing settings once and considering the job done is the most common error users make. Social media companies routinely introduce new features with permissive defaults — sometimes tucked behind a notification you dismissed. Schedule a semi-annual settings review, ideally timed around major platform updates, to verify nothing has changed without your knowledge.

Commenting on Public Posts

Your account's privacy settings protect your own posts, not your replies on other people's public content. A comment on a news outlet's post or a public figure's update is visible to anyone, regardless of your account's privacy level. Your comment history is accessible to anyone who views that public thread — be deliberate about what you engage with publicly.

Federating Your Identity Through Social Login

"Sign in with Facebook" and "Sign in with Google" are convenient, but they create a single point of failure. If your social account is compromised, every service linked through that login is also at risk. Where possible, create standalone account credentials and store them properly. Learn about how to set up two-factor authentication for better account security.

For the authentication standard that governs how secure identity flows should work, see NIST SP 800-63B Digital Identity Guidelines.

Neglecting Account Recovery Options

Users who enable strong passwords and 2FA sometimes leave account recovery pointing to an email address they no longer control or a disconnected phone number. Attackers regularly exploit stale recovery options as the path of least resistance. Verify your recovery contacts on every social platform at least once per year.

Advanced Privacy Considerations for High-Risk Individuals

Certain professions and personal circumstances require additional privacy measures beyond standard social media controls. Healthcare workers, legal professionals, financial advisors, and public figures face elevated targeting from social engineers and cybercriminals.

If you fall into a high-risk category, consider these additional steps: use different names or initials on professional versus personal social platforms, separate work and personal networks, audit tagged photos regularly, and monitor your online presence with alerts for your name, employer, and professional credentials appearing in unexpected places.

For professionals handling sensitive client data, additional compliance requirements may apply. Our guide on written information security plans covers data protection requirements for financial and healthcare professionals.

Understanding the value of a thorough social media privacy settings guide becomes clear when you realize that privacy requires ongoing attention as platforms evolve and your digital footprint changes. The time invested in proper privacy controls pays dividends in reduced identity theft risk, fewer targeted attacks, and greater control over your personal information.