Privacy settings scatter across menus and change after app updates. Use this checklist quarterly — or after any account scare — across the networks you actually use. Pair it with our per-platform guides for navigation help.
Account basics
- Unique password stored in a password manager
- Two-factor authentication on (prefer app/security key over SMS when possible)
- Backup codes stored offline
- Recovery email/phone you still control
- Unknown sessions revoked
- Third-party apps audited and trimmed
Audience and visibility
- Default post audience reviewed (public vs friends vs private)
- Past public posts limited or archived if you are tightening privacy
- Story/Status audience limits set intentionally
- Location services off unless needed for a feature you use
- Birthday, phone, and address fields hidden from public profiles
People and messages
- Friend/follower requests require approval if you want a private graph
- Message request filters enabled
- Blocked and muted lists reviewed
- Tagged photo review on where available
- Group add permissions restricted on messengers
Ads and data sharing
- Ad topic preferences trimmed
- Off-platform activity settings reviewed where offered
- Connected contacts syncing disabled if you do not need it
Device hygiene
- OS and apps updated
- Screen lock enabled
- App permissions (mic, camera, contacts) minimized
- Shared family devices use separate profiles when possible
Deeper walkthroughs: platform guides · download your data · parental controls.
Privacy as a practice, not a panic
You do not need to leave every network to improve privacy. Small, repeated reviews outperform one anxious weekend of toggling settings you do not understand. Schedule a recurring calendar event — fifteen minutes per active platform each quarter.
Decide your threat model briefly: casual oversharing to acquaintances, targeted harassment, workplace boundary issues, or child safety. Different models emphasize different checklist rows. A local teacher may prioritize photo tagging and student privacy; a journalist may prioritize 2FA and app revocation.
Cleaning the public past
Old posts resurface in screenshots and job searches. Use activity logs, archive tools, and bulk audience limiters where platforms offer them. You do not have to delete everything — archiving or friends-only limits often balance memory with boundaries.
Before interviews or elections of any kind (even student government), do a search for your username in an logged-out browser. Fix what you find.
Messaging boundaries
Open DMs feel flattering until they become a firehose of spam. Message filters, fees features, and “friends of friends” limits exist because abuse is common. Tightening DMs is not unfriendly; it is sustainable.
For dating and interest communities, keep conversations on-platform longer before sharing a phone number. On-platform report tools stop working once you move to SMS.
Off-platform exposure
Your social profile is only one surface. Data broker opt-outs, people-search sites, and breached password databases also matter. After any breach email, change passwords and enable 2FA; do not reuse the breached password anywhere.
Review which apps can read your contacts. Contact graph uploads can surprise friends who never opted into that network.
Work accounts vs personal accounts
Separate them when possible. Personal political opinions on a brand account create PR risk; work secrets on a personal account create legal risk. Use Page roles and Brand Accounts so personal identity is not the only key to company assets.
When you leave a job, rotate passwords you reused, remove devices, and confirm Page admin handoff. Our business getting-started guide covers role design.
Quarterly review script
- Update phone OS and apps.
- Password manager: change any duplicate or old passwords.
- For each social app: sessions, 2FA, apps, audience defaults.
- Mute or unfollow accounts that reliably worsen your week.
- Export data if you are considering deactivation.
Pair this checklist with data export steps and per-network deep dives under Platforms.
Photos, faces, and metadata
Modern phones attach location metadata to photos. Some platforms strip EXIF; some do not always. When sharing images of your home, children, or travel patterns, consider cropping out street numbers and disabling location before upload. Teaching kids to blur school badges is practical privacy literacy.
Search your own name
Quarterly, search your name and handles in a private browser window. Note what is public on each network. Fix surprises. Set Google alerts for your brand name if impersonation would be costly.
Shared computers and sessions
Log out of social accounts on library or hotel computers. Prefer guest modes. Disable “remember me” on shared devices. Browser password prompts on shared PCs are a common footgun.
Closing the loop
Privacy work is unfinished by design because products ship new features that reset defaults. After major app updates, re-open settings and skim security/privacy sections for new toggles. That habit alone prevents years of silent oversharing.
Use this checklist alongside scam awareness — social engineering defeats even perfect lock screens when people volunteer codes.
Frequently asked questions
How often should I review privacy settings?
Quarterly is a good baseline for active accounts, plus after any major app update, phone change, breakup, job change, or security scare. Life changes alter who should see what.
Is a private account enough?
A private account limits who sees new posts, but approved followers can still screenshot and share. Private accounts also do not protect against phishing or weak passwords. Combine audience controls with strong security.
Should I turn off location entirely?
Turn it off for apps that do not need it, and share live location only temporarily with people you trust. Some features, such as nearby recommendations, stop working without location; decide feature by feature.
Do privacy settings stop platforms collecting data?
Privacy settings mainly control what other people see. Platform data collection is governed by separate ad, activity, and data settings plus each company’s privacy policy. Review both categories.
What about old accounts I no longer use?
Dormant accounts are easy takeover targets. Either secure them with fresh passwords and 2FA or export your data and delete them.
Key takeaways
Privacy on social media rests on three layers: who can get into your account (security), who can see what you share (audience), and what the platform and its partners collect (data settings). Most people focus on the second layer and neglect the first, yet a hijacked account exposes everything regardless of audience settings. Start with passwords and two-factor authentication, then tighten audiences, then trim data sharing.
Keep the checklist realistic. You do not need to finish every row in one sitting. Pick your two most-used platforms, complete the account basics section for each, and schedule the rest. A partially completed checklist done regularly beats a perfect one abandoned after a weekend.
Related articles
- How to Recover a Hacked Social Media Account
- Spotting Scams and Phishing DMs on Social Media
- How to Download and Backup Your Social Media Data
Independent educational content. Not affiliated with any platform. Last reviewed October 2026.