How to protect your privacy on social media

Privacy settings mean little until you know the audience you're worried about. There are usually three, and they need different fixes.

• Strangers — people who could piece together where you live, study or hang out. Fix: profile details, location habits, who can message you.
• People you know — an ex, a future employer, relatives, coworkers. Fix: what you post publicly, old posts, who sees stories.
• Companies — the platform, advertisers and third-party apps. Fix: connected apps, permissions, and choosing services whose business model you're comfortable with.

1. 1

   Search yourself, logged out

   Use a private window and search your full name, plus your name with your city or workplace. Note which profiles, posts and photos show up. That is your public footprint.

2. 2

   Strip the bio

   School, workplace, city, birthday and a link to every other account together make a very complete picture. Keep what you actually need people to know.

3. 3

   Check your profile photo

   A photo in school uniform, in front of your building or with a car number plate visible tells more than you think. Choose one that shows you, not where you are.

4. 4

   Review old posts

   Scroll back a year or two. Delete or hide posts that give away your address, routine, phone number or other people's private details.

5. 5

   Look at your connections

   Your social graph — who you follow and who follows you — reveals your workplace, friends and family even if you post nothing. Some platforms let you hide these lists; many don't.

Location is the most common way online privacy becomes a physical safety problem, and it rarely leaks through a location tag. It leaks through details.

• Backgrounds. House numbers, street signs, the view from your window, a distinctive café, the name of a gym on a towel.
• Real-time posting. Posting “at the gym” while you're at the gym tells people where to find you now. Post after you leave.
• Routine. The same run every Tuesday morning, photographed from the same bridge, is a schedule.
• Photo metadata. Photos can carry GPS coordinates inside the file. Many social platforms remove this on upload, but not every app does, and files sent “as a document” often keep it. Turn off location for your camera app if you don't need it.
• Friends' posts. A friend tagging you at a party reveals the same thing you avoided posting yourself.

1. Restrict messages. Check who can send you a direct message. Options range from anyone, to people you follow, to mutual connections only.
2. Turn off contact syncing unless you want the app to suggest you to everyone who has your number, and them to you.
3. Limit tags and mentions where the app allows it, so other people can't attach your name to posts without your say.
4. Hide your online status if people use it to check whether you're ignoring them.
5. Decide on search engines. Many platforms let public profiles and posts appear on Google. If you want to be findable only inside the app, look for a setting that turns this off.
6. Use block and mute without guilt. Blocking cuts contact; muting quietly hides someone without a confrontation.

Most account takeovers aren't clever hacks. They are reused passwords and phishing messages like “your account will be suspended, verify here.”

• Use a unique password for every account, stored in a password manager.
• Turn on two-step verification wherever an app offers it.
• Check your active sessions or login history. Anything you don't recognize: change your password and sign out of all other sessions.
• Keep your recovery email current and secure, because it is the key to everything else.
• Never enter your password from a link in a message. Open the app directly instead.

Messages deserve their own thought. Know whether your chats are end-to-end encrypted or only encrypted on the server — our explainer on end-to-end encryption vs encryption at rest covers what each protects.

Every “sign in with” button and “which character are you?” quiz is an app that may have read access to your profile. Open your account's connected apps list and remove anything you don't use. On your phone, review which apps have access to your contacts, photos, location and microphone. Then download a copy of your data from the platform; seeing what it holds is the fastest way to decide what to delete.

If you use Asyncbit, here is where each step lives. Most of these are covered on the safety and privacy features page, and the privacy policy explains what is stored.

Asyncbit has no usernames — people find each other by name — so the name on your profile is what makes you searchable. For posts you don't want tied to your name at all, some post types can be anonymous; read how anonymous posting works first, because it has limits.

• Setting everything to private once and never checking again after an app update changes the defaults.
• Posting boarding passes, event tickets or ID cards — barcodes and numbers on them can be read from a photo.
• Accepting every follow request to grow a count, then posting as if only friends are watching.
• Sharing screenshots of group chats with other people's names and numbers visible.
• Using the same profile photo everywhere, which makes a reverse image search link all your accounts.

1. 1

   Capture evidence

   Take screenshots with the date, the account name and the URL before anything is removed.

2. 2

   Report it

   Report the post or account to the platform, choosing the closest category (harassment, impersonation, private information).

3. 3

   Delete and lock down

   Remove your own posts that made it possible, change passwords, and tighten the settings above.

4. 4

   Escalate if you feel unsafe

   For threats, stalking or blackmail, contact local police or a trusted adult or organization. You don't have to handle it alone.