← Privacy Guides

Accounts & identity

Privacy check-up for your social media accounts

Review who can see your posts and profile, which apps are connected, how you can be found and what the platform uses for ads, then download a copy of your data and use your GDPR rights.

  • Low threat
  • Time 15 minutes per account
  • Difficulty Easy
  • Last verified

What this protects, and what it doesn't

Protects

  • Against strangers reading posts and profile details you meant only for friends.
  • Against people finding your account through your phone number or email address.
  • Against forgotten third-party apps that still have access to your account.
  • Against photos that reveal where you live or where you are right now.

Does not protect

  • Anything your followers can see, they can screenshot, repost or quote. Private settings limit the audience; they do not stop sharing.
  • Your name, username and profile photo are often public whatever you choose.
  • Posts that were public before you changed the settings may already have been copied or archived.
  • The platform itself still sees everything you post and send.

Prerequisites

  • A list of your social media accounts, including old ones you no longer use.
  • Your passwords in a password manager, and two-step verification ready to turn on.

Step by step

  1. List your accounts and close the ones you do not use

    Old accounts still hold your posts, photos and contacts. Search your email for sign-up messages to find forgotten accounts. For each account you no longer use, download your data (see below) and then delete the account in its settings.

  2. Secure the sign-in first

    An account someone else can sign in to cannot be private. For each account: use a unique password from your password manager, turn on two-step verification, preferably with a passkey or an authenticator app rather than text messages (see passkeys and hardware keys), and review the list of signed-in devices.

  3. Facebook and Instagram: run Privacy Checkup

    Meta's Privacy Checkup walks you through four topics: who can see what you share, how to keep your account secure, how people can find you, and your data settings for apps you have logged in to with Facebook. Open it from your profile picture, then Settings & privacy.

    • Set the default audience of new posts to friends, not public, and limit who can see your phone number and email address.
    • Under how people can find you, limit who can look you up with your phone number or email.
    • Remove apps and websites you no longer use from the list of connected apps.

  4. Google and YouTube: run Privacy Checkup

    Open myaccount.google.com/privacycheckup. From there, and from the linked pages, review:

    • Activity controls: what Google saves, such as Web & App Activity, location history and YouTube history, and for how long.
    • Third-party connections: apps that can access your account. Remove the ones you do not use.
    • Your devices: sign out devices you do not recognise.
    • Ad settings: turn off personalised ads if you prefer.

  5. X: protect your posts

    With protected posts, only followers you approve can see them. In the app, tap your profile photo, then Settings and privacy, Privacy and safety, and under Audience and tagging turn on Protect your posts. On the web the same option is a checkbox.

    In the same section, review who can tag you in photos, and whether people can find you by your email address or phone number.

  6. TikTok: consider a private account

    With a private account, only followers you approve can watch your videos. Look for Private account in the privacy section of TikTok's settings. People who already follow you keep following; remove the ones you do not want from your followers list. Your name, username and profile photo stay visible to everyone.

  7. LinkedIn: review profile visibility and data use

    Click the Me icon, then Settings & Privacy. Review the Visibility and Data privacy sections: who sees your profile and connections, whether your profile appears to people outside LinkedIn, and how LinkedIn uses your data.

  8. Check what your photos give away

    Photos can show your street, your house number, a car number plate, your children's school or the inside of your home. Before posting, look at the background. Some services remove photo metadata on upload and some do not; remove the GPS position and camera details yourself with the metadata cleaner, which runs in your browser. Post holiday photos after you are home, not while the house is empty.

  9. Download a copy of your data

    A copy shows what the platform holds, and keeps your photos and posts if you delete the account.

    • Google: open takeout.google.com, choose the products, then Next step, a delivery method, and Create export. Creating the archive can take from a few minutes to a few days, and the download link expires after about 7 days.
    • LinkedIn (on a computer): Me, Settings & Privacy, Data Privacy, Download your data, then Request archive. The full archive arrives by email within 24 hours, and the link works for 72 hours.
    • Meta, X and TikTok each offer a "download your information" or "download your data" option in their settings.

    Keep the archive somewhere safe: it contains your messages and contacts. Encrypt it or delete it once you have what you need.

  10. EU/EEA: use your GDPR rights

    If the download tool does not give you everything, or you want the platform to stop using your data for marketing, send a formal request with the GDPR request generator:

    • Right of access (Art. 15): a copy of your data, the purposes, the recipients and how long it is kept.
    • Right to data portability (Art. 20): the data you provided, in a machine-readable format.
    • Right to object (Art. 21): stop use of your data for direct marketing.
    • Right to erasure (Art. 17): deletion, for example of an account you can no longer sign in to.

    The platform must answer within one month, extendable by two further months for complex requests (Art. 12(3)).

  11. Repeat the check-up

    Platforms add features and change defaults. Repeat this check-up every six months to a year, and after any major app update that announces new privacy settings.

Common mistakes

  • Changing the audience of new posts but leaving years of old public posts visible.
  • Leaving your phone number on a profile because it was needed once for verification.
  • Keeping quiz games and old sign-in-with apps connected to your account.
  • Posting holiday photos while you are still away.
  • Securing your main accounts but forgetting old ones you stopped using.
  • Leaving a downloaded data archive unencrypted in your Downloads folder.

Going further

Your public profiles are the starting point of most open-source research about a person. To see how that works, read the OSINT glossary entry. To reduce what data brokers already hold about you, continue with Remove yourself from data brokers, and use email aliases for new sign-ups.