How to Keep Your Information Private on Social Media

Most of us share more on social media than we realize. Your hometown, your birthday, your daily commute, photos from your kid’s school play — individually these details seem harmless.

But together, they paint a detailed picture of your life that you probably wouldn’t hand to a stranger. And that’s exactly who ends up with it.

Across seven major incidents since 2021, social media platforms have exposed 9.4 billion records — averaging one major breach every nine months.

Even without a breach, the information you voluntarily post is often more than enough for a scammer, identity thief, or stalker to work with.

The good news is that a few straightforward changes can significantly reduce your exposure. This guide walks you through the most effective ones.

What Are the Real Risks?

Before getting into the fixes, it’s worth understanding what’s actually at stake — because the threats go beyond someone reading your posts.

Identity theft. Your full name, date of birth, hometown, and phone number are often enough for someone to open credit in your name. Cybercriminals can use the information you share — such as your full name, date of birth, and location — to impersonate you or launch targeted attacks.

Phishing. Around 22.5% of all phishing attacks now occur through social media platforms, making it the fastest-growing phishing vector. Attackers use what they learn from your profile to craft convincing fake messages that are far more likely to fool you.

Physical risk. If a criminal is monitoring your account and knows where you are, they know where to find you in person — or know that your home is empty, making it a prime target.

Financial fraud. The FTC reported $2.1 billion in social media-originated scam losses in 2025, a dramatic rise from $261 million in 2020.

None of this means you need to delete your accounts. But it does mean it’s worth taking a few minutes to think about what you’re sharing and who can see it.

Think Carefully About What You Post

Privacy settings can only do so much. The bigger factor is what you choose to put out there in the first place.

Your location, in real time. Posting a vacation photo with the caption “off to Florida for two weeks!” tells anyone watching that your house is unoccupied. A better habit: save vacation photos and share them when you’re back home.

Your daily routine. A story about your “daily 6 a.m. workout” tells stalkers where they can find you every morning. Think about how much of your schedule is visible to people you don’t actually know.

Personal details that answer security questions. Your mother’s maiden name, the street you grew up on, your first pet — these are common account recovery questions. If the answers live on your profile, they’re available to anyone who wants them.

Your phone number and email address. These don’t need to be on your public profile. Once they’re out there, they’re hard to take back.

Lock Down Your Privacy Settings

The default settings on most social media platforms are not set up with your privacy in mind. They’re set up to make your content as visible as possible. Spending a few minutes adjusting them makes a real difference.

Here’s what to look at on the major platforms:

Facebook

Facebook has one of the more thorough sets of privacy controls, but they’re buried in menus most people never open.

• Control who sees your posts. Go to Settings & Privacy > Posts and set the default audience for future posts to Friends rather than Public.
• Run the Privacy Checkup. Go to Settings & Privacy > Privacy Checkup. This walks you through the most important settings in one place.
• Limit how people find you. Under How People Find and Contact You, consider restricting who can search for you by phone number or email address.
• Lock down your profile info. Go through your About section and make sure details like your phone number, hometown, and workplace aren’t set to Public.
• Review connected apps. Old apps you authorized to access your Facebook account can still pull your data. Remove anything you no longer use under Settings > Apps and Websites.

Fig 1. Controlling who sees your posts on Facebook

Instagram

• Switch to a Private Account if you don’t want your posts visible to everyone (Settings and activity > Account Privacy).
• Under Privacy, review who can send you message requests and who can mention or tag you.
• Turn off Location Services for the Instagram app in your phone’s settings if you don’t want location data attached to posts.

Fig 2. Enabling a Private Account on Instagram.

TikTok

• You can manage whether your account is public or private, decide whether to synchronize your contacts, and choose personalized or randomized advertisements.
• In Private Account Under Visibility, set your account to private and restrict who can duet, comment, or message you.

Fig 3. Enabling a Private Account on TikTok

X (formerly Twitter)

• Switch to a Protected account to require approval before new followers can see your tweets (Settings > Privacy and Safety > Audience and Tagging).
• Turn off Precise Location sharing in phone Settings (iOS only).
• Under Discoverability and contacts, disable the option to let people find you by your email or phone number.

Fig 4. Switching to a Protected Account on X.

Secure Your Accounts Properly

Locking down your settings is only half the picture. If your account gets compromised, a hacker can change all of it back. Strong account security is what prevents that from happening.

Use a unique password for every account. The most common attack method is credential stuffing (31%), where attackers use passwords from previous data breaches to log into social media accounts — effective because 94% of passwords are reused. If you reuse passwords and one account gets breached, every account with the same password is at risk.

A password manager makes it easy to use strong, unique passwords without having to remember them all.

Turn on two-factor authentication (2FA). This means that even if someone gets your password, they still can’t log in without a second verification step — usually a code sent to your phone or generated by an app. It’s one of the single most effective security improvements you can make.

Check where you’re logged in. Most platforms let you see a list of devices and locations where your account is active. On Facebook, this is under Settings > Accounts Centre Password and Security > Where You’re Logged In. If you see anything unfamiliar, log it out and change your password.

Watch out for phishing messages. Be skeptical of any message — even from a friend — asking you to click a link, log into something, or send money. If it seems off, it probably is. Contact the person directly through another channel before acting.

Fig 5. An example of a phishing message.

Watch Out for Third-Party Apps

One privacy risk many people overlook is the apps and websites they’ve connected to their social media accounts. Over time, these permissions accumulate — a quiz app from three years ago, a contest you entered, a game you tried once.

Over time, we often connect third-party apps and websites to our accounts. Review and remove any that you no longer use, as these can access your data long after you’ve forgotten about them.

To review these on Facebook, go to Settings > Apps and Websites. You’ll likely find a longer list than expected. Anything you don’t recognize or no longer use should be removed.

The same principle applies to your phone itself. Periodically check which apps have access to your camera, microphone, contacts, and location. On iPhone, go to Settings > Privacy & Security to see a breakdown by permission type.

Fig 6. Checking location permissions on iOS.

On Android, go to Settings > Privacy > Permission Manager for a breakdown of permission usage.

Fig 7. Checking location permissions on Android.

A Note on What Platforms Collect

Even with perfect privacy settings, social media platforms still collect a significant amount of data about you for advertising purposes.

In 2025, the average social media user shares 15 to 20 personal details with platforms — two to three times more than five years ago, with 78% of people still unaware that their data is sold to third-party brokers.

This data — browsing behavior, interaction patterns, interests inferred from your activity — isn’t visible to other users, but it does exist. Adjusting your ad preferences (available on Facebook, Instagram, TikTok, and others) limits how some of this data is used, though it doesn’t stop collection entirely.

For people who want to go further, using a separate email address for social media accounts keeps your primary inbox cleaner and adds one more layer of separation between your social media presence and the rest of your digital life.

Wrapping Up

You don’t have to choose between enjoying social media and protecting your privacy. The two are compatible — it just requires being intentional about what you share and spending a little time on your settings.

Start with the basics: tighten your privacy settings on whichever platform you use most, enable two-factor authentication, and think twice before sharing your real-time location. Those three steps alone will put you ahead of most people.

If you’re also concerned about the security of your phone itself — not just your social accounts — Certo’s free apps for iPhone and Android can check your device for vulnerabilities and suspicious activity.

Frequently Asked Questions

Can people find me on social media even if my account is private?

Your profile won’t be visible to the public, but depending on your settings, you may still appear in search results. On most platforms, you can turn off search engine indexing and restrict who can look you up by phone number or email in the privacy settings.

Does deleting a post mean it’s gone for good?

Not necessarily. Anyone who saw the post before you deleted it could have taken a screenshot or saved it. Search engines may also have indexed it temporarily. The safest assumption is that anything you post publicly could persist somewhere.

Is it safe to use “Sign in with Facebook/Google” for other apps?

It’s convenient, but it does link your accounts together. If your social account is compromised, any app you signed into that way is also at risk. It also gives those apps access to some of your social profile data.

How often should I review my privacy settings?

Once every few months is a reasonable habit. Platforms update their apps frequently and sometimes reset or change privacy defaults in the process.