The Privacy Settings I Actually Lock Down on Every Social Platform
The Privacy Settings I Actually Lock Down on Every Social Platform
I used to treat social media privacy settings the way most people do, as something I'd get around to eventually. Then I helped a friend deal with a stranger who'd pieced together her daily routine, her kids' school run, and the fact she was away on holiday, all from public posts she never realised were visible to anyone. Nothing had been hacked. She'd simply never gone in and changed what the platform showed by default. That was the moment I stopped leaving those settings alone. Every platform I use now gets the same run through before I post anything on it, and I go back and check again every few months, because platforms quietly change what's shared by default more often than people expect.
Why I Stopped Trusting the Default Privacy Settings
Every social platform is built to encourage sharing, and the settings you get on day one reflect that. A new account usually starts with your profile, your friend or follower list, and often your posts themselves visible to anyone, not just the people you actually know. That's not an accident. Visibility drives engagement, and engagement is the business model, so the defaults lean toward open rather than closed. It's on you to go in and narrow that down, and most people simply never do, because nothing prompts them to and the settings menus aren't exactly front and centre. I've stopped assuming a platform has my best interests in mind when it decides what to show and to whom. I check the settings myself, on every account, and I don't assume last year's choices still apply after an update, because a redesign or a new feature rollout can quietly reset something I'd already switched off, or introduce a new sharing option that defaults to on.
Locking My Profile Down to People I Actually Know
The first thing I check on any platform is who can actually see my profile and my posts. I restrict that to people I'm connected with, not "friends of friends" or the wider public, and I turn off whatever setting lets my profile show up in outside search engines. I also look at who can tag me in a post or a photo without my approval first, because a public tag from someone else's account can expose exactly the information I've locked down on my own. Most platforms let you require approval before a tag becomes visible on your profile, and I turn that on everywhere it exists. It's a small setting that closes a fairly obvious gap.
Turning Off Location Tagging Before I Ever Post
Location is the one I see people get wrong most often, because it feels harmless in the moment. A geotagged photo or a "checked in here" post tells anyone watching exactly where you are right now, and posting from a family holiday can just as easily tell someone exactly where you aren't, which is its own problem. I keep precise location sharing switched off at the app level, not just on individual posts, since a setting left on can quietly reattach itself to your next upload. When I do want to share where I've been, I post after I've left rather than while I'm still there, and I check that the photo itself isn't carrying embedded location data before it goes anywhere.
Reviewing Which Apps Still Have Access to My Accounts
The setting people skip most is the list of third-party apps and services still connected to their social accounts, sometimes for years after they stopped using them. An old quiz app, a games platform I haven't opened since a phone I no longer own, a scheduling tool from a job I left. All of those can still read profile data or post on my behalf unless I've gone in and revoked access, and I've genuinely been surprised by what turns up when I look. This is part of a wider habit I've written about separately: reviewing which apps still have access to my accounts sits alongside checking for known data breaches and cleaning up recovery details as one of the periodic account check-ins I run every few months, and I'd recommend treating it the same way on your social accounts specifically, not just email and banking. While I'm in there, I also make sure two-factor is switched on for every account that offers it, since a password alone isn't enough to stop someone getting in even if my other settings are locked down properly, and a password manager makes it far easier to keep each account's login genuinely unique instead of reusing one across platforms.
What I Still Share, and Why the Rest Stays Private
None of this has made me post less, and it hasn't made me paranoid about being online either. I still share plenty, I just decide who gets to see it rather than letting the platform decide for me by default. The NCSC has straightforward guidance on securing your social accounts if you want a second source to check your own settings against, and my free Safety Toolkit covers the account-level basics I'd recommend having in place before you even get to individual privacy settings. Going through each platform properly took me less than an hour in total, and it's the kind of hour that quietly closes off a lot of the ways a stranger could otherwise build a picture of your life without you ever knowing they'd looked. I'd rather spend that hour once, and again briefly every few months, than find out the hard way what someone else pieced together from posts I'd forgotten were even public.