Do a full social media privacy audit once a year, and a 10-minute check every three months. In each account, look at who can see your profile and posts, whether location is being shared, who can tag you, which outside apps are connected, and how you sign in. Platforms move settings around and change defaults, so last year's choices may not still hold.
CISA's advice on staying safe on social networking sites is blunt about why: "Sites may change their options periodically, so review your security and privacy settings regularly." Audit again sooner after a big redesign, a privacy-policy email, a public-facing change in your life (a new job, a breakup, a move), or any sign someone else got into the account.
Quarterly check vs. yearly audit#
| Every 3 months (10 minutes) |
Once a year (about an hour) |
| View your profile as a stranger |
List every account you have, including abandoned ones |
| Sign out devices and sessions you don't recognize |
Go through old posts and tagged photos |
| Remove newly connected apps you don't use |
Review discoverability by phone number and email |
| Check that two-step sign-in is still on |
Review ad and data settings |
|
Decide which accounts to keep, deactivate, or delete |
Start by listing every account#
You can't secure an account you forgot you had. Write down every platform you use, then search your email for "welcome to", "confirm your account", and "reset your password" to find the ones you've forgotten. Include old forums, dating apps, and anything you signed into with "Continue with Google" or "Continue with Facebook."
Abandoned accounts are the risky ones. They often still show old personal details, and if the password was reused somewhere that got breached, or the recovery email no longer works, they're easy to take over and hard for you to get back.
For each account, decide: keep it, deactivate it, or delete it. Deactivating usually hides the profile but keeps your data so you can come back. Deleting is permanent but often has a waiting period, and it can't remove copies other people already saved. Download your data first if you want it.
See what a stranger sees#
Open your profile in a private or incognito browser window while logged out, or use the platform's "view as" option if it has one. Look at it the way a scammer or a nosy stranger would:
- Your full name, profile photo, and bio
- Birthday, hometown, and employer
- Phone number and email address
- Friend or follower lists
- Recent posts and photos you've been tagged in
Your birthday, hometown, pet's name, and first school are classic security-question answers. A full birthday plus your name is also a good head start on stealing your identity. Hide the year at least.
Then go into the privacy settings and set an audience for each kind of information on purpose. "Friends only" can still be hundreds of people, some of whom you barely know. Many platforms let you make smaller lists for family photos, children, and anything that reveals your routine.
Check location sharing#
Location leaks out in more places than people expect: check-ins, tagged places on photos, fitness apps that post your running route (which usually starts at your front door), live location in messaging apps, and location data embedded in photos you upload.
- In each app, turn off location tagging on posts unless you actually use it.
- On your phone, set each social app's location permission to "never" or "while using," and turn off precise location where you can.
- In fitness apps, set a privacy zone around your home or make activities visible only to followers.
- Post holiday photos after you're home, not while the house is empty. Our home security audit covers the offline side of that.
CISA's guidance also says plainly not to post information that would make you vulnerable, such as your address.
Go through old posts and tags#
Don't scroll your feed back ten years. Use the platform's activity log or archive tool, which lets you filter by year and audience. Facebook, for example, has a "limit past posts" option that switches all your old public posts to friends-only in one go.
Look for old public posts with your phone number, home address, workplace, children's school, photos of documents or boarding passes, or anything you'd now rather not have attached to your name.
Then turn on tag review if the platform has it, so photos other people tag you in don't appear on your profile until you approve them. You can usually remove a tag yourself. Removing the photo itself means asking the person who posted it or reporting it to the platform.
Turn off discoverability you don't need#
Most platforms let people find you by your phone number or email address, and some let search engines show your profile. If you don't need strangers to find you, turn these off. Also check whether the platform is using your uploaded phone contacts to suggest you to others, and delete the uploaded contacts if you never meant to share them.
Remove connected apps#
Find the list of apps and websites connected to the account (often under "Apps and websites," "Security," or "Connected apps"). Remove anything you don't recognize or no longer use: old quiz apps, games, photo printers, scheduling tools. CISA advises avoiding apps that seem suspicious and limiting how much information third-party apps can access.
Removing an app stops future access but doesn't delete what it already collected. If that bothers you, use the app's own deletion request.
Then check your phone's permissions for each social app: contacts, microphone, camera, photos, Bluetooth, and location. Give each app the least it needs to work.
Ad settings live in a separate menu from privacy settings. You can often limit ad personalization or see the interests a platform has guessed for you, but switching off personalized ads doesn't stop the platform collecting data.
Lock down the login#
Privacy settings mean nothing if someone else can log in. For every account you keep:
- Use a unique password stored in a password manager. If it's reused anywhere, change it now (our guide on when to change passwords explains when else you should).
- Turn on two-step verification. The FTC's guide to protecting your accounts recommends an authenticator app or security key over text-message codes where they're offered.
- Save the backup codes somewhere that isn't your phone.
- Review logged-in devices and sign out anything unfamiliar.
- Make sure the recovery email and phone number are current, and remove old page admins or shared access.
Secure the email address behind each account too. Whoever controls that inbox can reset the social media password. Our email inbox cleanup guide includes a quick security check for it. Keeping the app and your phone on a regular software update schedule closes the gaps no setting can.
If you're dealing with harassment or stalking#
The steps above reduce everyday exposure. If someone is targeting you, slow down before making big changes: screenshot and save evidence first, because deleting posts or blocking can remove it. Use the platform's reporting tools, and contact local police or a victim support service, which can help you make a safety plan that covers more than your accounts.
For everyone else, the yearly audit takes about an hour and the quarterly check about ten minutes. A recurring reminder in ChoreLists.com is enough to keep it from drifting, as long as you keep passwords out of the task.