Why privacy settings are more specific than they seem
Privacy settings on social platforms are not a single switch. Each platform breaks privacy into a grid of controls that govern different types of information independently. A setting that locks down your posts does not automatically hide your friends list, your profile picture, or the activity visible to advertisers. Understanding the structure helps you avoid false confidence.
Most platforms organize their privacy controls into at least three distinct areas: what the public can see, what connected contacts can see, and what the platform itself collects. Each layer needs separate attention. The
Audience selector
A control that lets you choose who can see a specific post or piece of profile information. Common options include Public, Friends, Friends of Friends, and Only Me.
Data download
A feature that packages everything a platform has collected about your account into a file you can request and review. Most major platforms offer this under their privacy or account settings.
Two-factor authentication (2FA)
A login security layer that requires a second verification step beyond your password, such as a code sent to your phone. It blocks unauthorized access even if your password is compromised.
Activity log
A record of actions you have taken on a platform, such as posts, likes, searches, and comments. Reviewing it lets you see and delete information that may be more visible than you realized.
Third-party app access
Permission you granted, often during a quiz or sign-in, for an external app to read or write data on your social media account. These permissions often persist long after you stop using the app.
Profile visibility
The setting that controls whether your profile, or parts of it, can be found and viewed by people who are not already connected to you.
For parents managing younger users' accounts, the full guide on protecting kids online covers platform-specific controls for minors in more detail.
Audience controls: who actually sees your content
The audience selector on each post is the most direct privacy control most people ever use. Selecting "Public" means anyone on the internet can see the post, including people who are not logged in. Selecting "Friends" limits it to your confirmed connections. "Only Me" makes the post invisible to everyone except you, which is useful for saving links or drafts.
What many people miss: the audience you set on one post becomes the default for the next post. If you post something publicly once, your next post defaults to public unless you change it back. Check the selector before posting, not just when you first set up your account.
Profile-level audience controls work separately from post-level ones. Your cover photo, profile picture, and bio fields each have their own visibility options on most platforms. Review each field individually rather than assuming one account-level setting covers all of them.
| Where to find privacy settings | Account or profile menu, usually under Settings and Privacy or a shield icon |
| How often to review settings | After any major platform update or at least twice a year |
| Who sees a 'Public' post | Anyone on the internet, including people not logged in to the platform |
| Third-party app access | Revocable any time through connected apps or permissions settings |
| Data download availability | Offered by Facebook, Instagram, X, TikTok, LinkedIn, and most major platforms |
| Location data | Can be embedded in posts if location services are on for the app |
What platforms collect beyond what you post
Social platforms collect information that goes well beyond the text and photos you share intentionally. Most track which posts you linger on, which ads you interact with, your approximate location, your device type, and in some cases, browsing activity on other websites through embedded tracking tools. This data feeds the advertising systems that fund the platforms.
Within your privacy settings, look for sections labeled "Ad preferences," "Data and privacy," or "Your data." These sections let you see what interest categories the platform has assigned you, and in many cases, let you clear or limit those categories. Turning off interest-based ad targeting does not remove all ads, but it reduces how much behavioral data is used to select them.
Requesting your data download gives you a concrete look at what a platform holds. The file typically includes your posts, messages, search history within the platform, and ad interaction data. Reading app changelogs can also signal when a platform has adjusted its data practices, since updates sometimes quietly expand data collection.
For a broader picture of how tracking works across the web, cookies, trackers, and browser fingerprinting explains the mechanisms social platforms use alongside advertisers.
Third-party app access and connected accounts
Many people have granted access to external apps through their social accounts, often during a quiz, game, or a "Sign in with Facebook" or "Sign in with Google" flow. Each of those connections can give the third-party app ongoing permission to read profile data, friend lists, or in some cases post on your behalf.
To see which apps have access, go to your platform's Settings and look for a section called "Apps and Websites," "Connected Apps," or "Third-party Apps." Most platforms list each connected app alongside the specific permissions it holds. Revoking access for apps you no longer use is a simple step that cuts off a data pathway you may have forgotten about entirely.
If you use app permissions on your phone rather than just in-browser, understanding what the permissions screen is really asking for helps you evaluate those requests at the device level as well.
Account security settings that belong in the same review
Privacy and security settings live in overlapping menus, and it is worth checking both in the same session. Two-factor authentication (2FA) belongs on every account. Without it, a leaked or guessed password is all someone needs to access your profile and everything it contains.
Look for a "Security" or "Login" section in your settings. Enable 2FA using an authenticator app if the platform supports it, since authenticator apps are more resistant to SIM-swap attacks than SMS codes. Review the list of active sessions to see which devices are currently logged in to your account, and log out any device you do not recognize.
Your activity log is also worth a periodic review. Search history, liked posts, and comments remain stored and may be more visible to others than you expect. Most platforms let you bulk-delete old activity within the log itself.
For more on online privacy habits beyond social media, incognito mode and what it actually hides is a useful companion read.
