Your social media profile is the most detailed dossier on you that exists — and most people hand it to strangers for free. Every birthday photo, check-in, and tag adds another line to a public record that scammers and impersonators read daily. The good news: locking down your accounts takes under an hour and is completely legal. This guide covers what platforms collect, the privacy settings that matter, the oversharing habits to break, and how to clean up a long-public profile.
What Social Platforms Actually Collect About You
Social networks build their picture of you from several streams:
- What you post directly: photos, videos, captions, check-ins, relationships, workplace and education history.
- Behavioral data: what you like, watch, and click — used to build an advertising profile of your habits and routines.
- Location and contact data: geotagged photos and uploaded address books that reveal where you live and who you know.
You cannot erase everything a platform already knows — but you can shrink what other people can see and exploit, which is where the real danger lies.
Why a Public Profile Is Riskier Than You Think
Most people see a public profile as harmless self-expression. Attackers see it as free reconnaissance:
- Social engineering: a pet's name from a caption, a school from an old post — these are the answers to "security questions" that reset passwords. See our identity theft protection guide for how such fragments combine.
- Impersonation: scammers clone public profiles — copying your photos and name — then message your friends asking for emergency money.
- Targeted phishing: posts about your job, bank, or flight let criminals craft believable fake emails and calls. Our phishing protection guide shows how to spot them.
- Physical safety: live vacation posts and check-ins tell strangers exactly when you are not home.
The Privacy Settings That Actually Matter
Platforms bury privacy controls across a dozen menus, but a handful of settings do most of the work — run through these on every account:
- Set your account to private (or friends-only): the single biggest privacy upgrade — new followers need approval, and posts disappear from public search.
- Fix your default audience: change the default for new posts from "public" to friends/followers.
- Turn on tag review: approve tagged photos before they appear on your profile.
- Turn off location tagging: disable location on posts and stories, and remove location access for social apps in your phone settings.
- Stop contact syncing: uploading contacts "to find friends" hands the platform your entire address book — turn it off and delete previously uploaded contacts.
- Block search-engine indexing and clean "about" fields: stop your profile appearing in web search, and delete your full birth date, phone number, email, and address from public view.
Our privacy settings tool guide gives a step-by-step checklist to follow while you work through these.
Oversharing Rules: What Never to Post
Settings control your audience; judgment controls your content. Some things should never be posted — friends screenshot, accounts get hacked, and "private" posts still live on someone else's servers:
- Identity documents: never post ID cards, passports, licenses, or bank cards — even "celebrating" your first card. These are gold for identity thieves.
- Full birthdays with year: a public birthday plus your name is often enough to start bypassing identity verification.
- Live vacation posts: announcing you are at the airport advertises an empty house. Post the album after you return.
- Boarding passes and tickets: their barcodes contain your full name and booking references — decodable from a photo.
- Home and vehicle details: house numbers, car plates, or window views that identify your street. Blur or crop these before posting.
Quiz Apps, Games, and Third-Party Permissions
"Which historical figure are you?" quizzes feel harmless, but the app behind them often requests your friend list, email, photos, and permission to post for you. Some of history's largest data-harvesting scandals began with quiz apps:
- Audit connected apps: use the "apps and websites" page in settings and remove anything you do not recognize or no longer use.
- Avoid social logins on random sites: "Login with Facebook" shares your profile data with that site; a throwaway email login shares nothing.
- Question permission prompts: a quiz does not need your friend list or location — deny excessive requests or skip the app.
Friend Lists, Followers, and Impersonation
A bloated friend list of strangers and fake accounts makes "friends-only" posts effectively public:
- Audit followers yearly: remove accounts you do not recognize, with no photo, or no interaction — many are bots or sold dormant accounts.
- Hide your friend list: set it to "only me" where possible. Scammers use visible friend lists to pick impersonation targets.
- Search for impersonators: occasionally search your own name. Report duplicates using your photos as impersonation, and warn contacts not to accept requests or send money to them.
What to Do After Oversharing
If your profile has been public for years, cleanup still works. Work through this list in order:
- Switch everything to private/friends-only first, so the bleeding stops while you clean.
- Delete high-risk posts: documents, tickets, house numbers, plates, kids' school details — use the platform's activity log to find old posts fast.
- Strip personal data from "about" sections — full birth date, phone, email, address.
- Revoke third-party app access and delete uploaded contacts.
- Change passwords and enable 2FA on every social account while you are already in the settings.
If scammers already used your public information — fake accounts in your name or phishing messages to your contacts — secure accounts first, warn your circle, and file a report if money or documents are involved. Our identity theft guide covers the full recovery sequence.
Teach Your Family the Same Rules
Teenagers overshare by habit; elderly parents overshare by trust — accepting every request and posting family photos publicly. Share three rules: never post documents, tickets, or full birthdays, never accept requests from strangers, and ask before posting photos of other family members.