Social Media Privacy Settings Guide for Better Online Security
Quick Answer: Social media privacy settings will govern who is able to see your content, what information these platforms may save, and who your personal information is shared with in terms of advertisers or other third parties. In all cases, default settings on all major platforms prioritise data collection over user privacy. Systematically changing them on Instagram, Facebook, X, LinkedIn and TikTok minimizes exposure. It can also restrict targeted phishing and account takeover attacks.
Default social media settings do not prioritise user protection. They often maximise platform data collection and advertiser access. Changing these settings helps protect personal information.
Most people set up a social account once and never revisit the privacy settings afterward. Default configurations on major platforms are generally built to maximise data collection and advertiser access rather than user protection, and many users remain unaware how much of that data is shared with advertising partners by default. Pairing tighter privacy settings with a temporary email address at signup further limits how much data can be tied back to your identity.
Main Points
- Social media privacy settings on major platforms often allow extensive data sharing by default. Users can change these settings to limit advertiser access and third-party sharing. They can also reduce profile visibility.
- Social account security is more than a strong password. There is an added layer of protection with two-factor authentication. Login activity monitoring and third-party app reviews also help secure accounts.
- A privacy settings guide can reduce the personal data available to data brokers. It can also limit targeted phishing intelligence and cross-platform identity linking.
- Online privacy controls on social platforms are not permanent. Platforms regularly update default settings and add new data collection features. Review these controls periodically to maintain protection.
Why Social Media Privacy Settings Matter Beyond the Platform
Social platforms do not contain data in isolation. Personal information can move into external systems. This includes posted information, registered email addresses, and behavioural patterns from platform use.
Data brokers collect publicly available profile data. This may be by job, location, relationship status, and employer. They bring all this data together and sell profiles to marketers, insurers, and background check services.
Platform-level targeting data is used to create a cross-site ad profile. These profiles can follow users across the web. Phishing attackers also harvest platform information. They use real personal details to make targeted messages appear credible. Understanding how these signals accumulate into a wider online identity is part of managing your digital footprint.
Adjusting social media privacy settings reduces the quality of data available for all of these uses. Combined with using a disposable email address at registration rather than a real one, platform privacy settings form the foundation of a practical online security posture.
Platform-by-Platform Privacy Settings Guide
Facebook and Instagram (Meta)
Facebook and Instagram have a common data infrastructure, with the name Meta. Be sure to check the data-sharing settings on both platforms following changes.
- Profile visibility: Set posts to Friends rather than Public. Restrict searches using your email address and phone number. Open Privacy Settings and Tools, then select Who Can Look You Up. Disable search engine indexing for the profile.
- Data sharing: Open Settings, then Ads, then Ad Preferences. Review and disable interest categories, cross-site tracking, and data sharing with Meta's advertising partners. Meta also collects off-platform browsing data through the Meta Pixel. Disable this feature under Your Off-Meta Activity. Similar methods, including hidden tracking pixels embedded in emails and ads, follow this same activity across other services you use.
- Third-party apps: Open Settings and then click on Apps and Websites. Clear applications that are no longer required to access. Check for each active app what it can see. Restrict permissions to the minimum required.
- Two-factor authentication: Open Settings, Security and Login, then Two-Factor Authentication. Enable authenticator app-based 2FA instead of SMS for stronger protection.
X (formerly Twitter)
X has faced repeated scrutiny over how it uses account data for ad targeting, and its default settings favour broad data sharing. See our guide to creating a disposable email for X if you want to sign up without linking the account to your main inbox.
- Post visibility: Open Settings, Privacy and Safety, then Audience and Tagging. Set Tweets to protected if public visibility is unnecessary. Prevent others from tagging the account in photos without approval.
- Data sharing: Open Settings, Privacy and Safety, then Data Sharing and Personalisation. Disable personalisation based on inferred identity. Also disable cross-context advertising. Turn off data sharing with X's business partners.
- Location data: Disable precise location access both in the app's permission settings and in the device's app permission controls. Remove saved location history under Location Information in Privacy Settings.
- Account security: Open Settings, then Security and Two-Factor Authentication. Use an authenticator app. Review active sessions and revoke access from unrecognised devices.
LinkedIn's data is particularly valuable to data brokers. It combines professional identity with contact information.
- Profile visibility: Settings, Visibility, Visibility of Your Profile and Network. Set profile visibility to Connections Only for maximum protection. Disable profile viewing by people who are not logged in to LinkedIn.
- Data sharing: Settings, Data Privacy. Turn off data sharing with LinkedIn's advertising partners. Disable personalised advertising based on inferred data. Review and turn off third-party use of LinkedIn data for off-platform advertising.
- Who can find you: Open Settings, Visibility, then Visibility of Your LinkedIn Activity. Disable searches using an email address or phone number not already connected to the account.
- Email at registration: LinkedIn ties your profile closely to your real identity and actively screens out disposable domains at signup, so treat any account tied to your career as a permanent one. A temporary email generator is better suited to one-off testing or research accounts you don't intend to keep. For your primary professional profile, use a dedicated permanent email and protect it with strong 2FA.
TikTok
- Account type: Switch from a Public account to Private in Settings, Privacy. A private account requires approval before any user can follow and view content.
- Data collection: Settings, Privacy, Personalisation and Data. Disable off-TikTok activity tracking. Review and limit the data TikTok shares with its advertising partners.
- Sync settings: Disable phone and Facebook contact syncing in Settings, Privacy. These syncs connect the TikTok account to real-world identity networks beyond the platform.
- Comments and interactions: Open Settings, Privacy, then Interactions. Restrict who can comment on videos or send direct messages. Limit who can mention or tag the account.
Social Account Security: Beyond Privacy Settings
Two-Factor Authentication on Every Platform
Two-factor authentication is the single highest-impact social account security action available. It can prevent account access even after a breach compromises login credentials. Authenticator app-based 2FA provides stronger protection than SMS-based codes.
SIM-swapping attacks can let attackers intercept SMS codes. They do this by transferring a phone number to an attacker-controlled SIM. Authenticator apps generate codes locally. Attackers cannot intercept them through SIM swapping.
Add app-based 2FA to every social platform you use. All five covered here support this option: Facebook, Instagram, X, LinkedIn, and TikTok.
Session and Device Review
All major social platforms provide a view of active logged-in sessions. Review these regularly and revoke access from any device or location that is not recognisable.
If an unrecognised session is identified, it is a sign of unauthorised access and the password should be changed and 2FAs reviewed immediately. This is also the moment to check whether your credentials have shown up in a wider breach; see how temporary email protects your identity during a data breach for the fuller picture.
Third-Party App Access Audit
Applications linked to a social account via OAuth access can access profile information, post on behalf of the user, and, in some cases, private messages. Go through all the connected apps and cancel access on all platforms for apps that are not being used. The same caution applies to any third-party site asking for account access; our guide on staying safe on untrusted websites covers how to limit what you expose.
Online Privacy Controls: What to Review Quarterly
Social platform privacy settings are not a one-time configuration. Platforms introduce new features through product updates. They also change default settings and expand data collection capabilities. These changes may occur without direct user notification.
Review online privacy controls every quarter. Check post visibility settings and third-party app access lists. Review advertising data preferences and 2FA status. Check active sessions and any new privacy categories added since the last review. For the fundamentals behind each of these checks, see this full guide to reducing spam and data exposure.
This review takes less than 30 minutes across all active platforms and catches setting changes that have reverted to less private defaults through platform updates.
Security researchers consistently find that two-factor authentication is one of the single most effective defences against account takeover, cutting successful compromise rates dramatically compared with a password alone. The reverse is also true for exposure: the more personal detail a profile leaves publicly visible, the more material phishing attackers have to craft convincing, targeted messages.
Conclusion
Social media privacy settings should all be managed. Some Facebook, Instagram, X, LinkedIn, and TikTok default settings encourage the collection of a lot of data. These settings may provide less protection for users. Apply the platform-specific changes in this guide.
Combine them with authenticator app 2FA and regular session reviews. Third-party app audits can further reduce data available to advertisers, data brokers, and attackers. Quarterly re-review maintains that protection as platforms continue updating their data practices.
Author Expertise
Written by Emma Cole, Privacy and Security Editor at Tempo Mails.
Last Reviewed: September 2, 2026
Emma Cole and the Tempo Mails team cover social media privacy settings, online privacy controls, and social account security strategies across major platforms. Content is reviewed and updated regularly to reflect current platform settings and default configuration changes.
(FAQs)
Do social media platforms notify users when default settings change?
Rarely in a meaningful way. Setting changes are typically disclosed in updated Terms of Service or help centre documentation that most users do not read. Quarterly manual reviews catch changes that notifications miss.
Is two-factor authentication enough to secure a social account?
It is the highest-impact single action but not sufficient alone. Active session monitoring, third-party app reviews, and visibility setting audits are all necessary components of complete social account security.
Can making a profile private prevent all data broker scraping?
Private profiles prevent unauthenticated scraping. Data brokers with authenticated accounts, or those that scraped data before the profile was set to private, may retain previously collected information.
Does using a disposable email at social platform signup improve privacy?
Yes for the email data point. One of the key pieces of information data brokers rely on for identifying social with real-world identities is the registered email address. A disposable email address that expires removes this link.
How often should I review connected third-party apps?
Quarterly, aligned with the general privacy settings review. Apps accumulate over time, and many users forget which services were granted access. Each connected app represents an independent access point that should be audited regularly.
Are TikTok privacy settings more important than other platforms?
TikTok gathers very extensive device and behavioral information. Its privacy settings should be reviewed with the same thoroughness as Meta platforms, with particular attention to contact syncing and off-platform data collection settings.
Can I completely opt out of social media advertising data use?
On most platforms, you can limit but not eliminate advertising data use. The platform's own first-party data collection continues for personalised content delivery. Of course, users can usually stop or limit the sharing of data for ad purposes with third parties using advertising preference settings.
Does disabling personalised ads reduce how much data a platform collects?
This reduces how companies use data for external advertising. It does not stop platform-side data collection. Platforms can still build internal behavioural profiles. Disabling personalised ads mainly restricts third-party sharing, not internal data accumulation.
