Social Media Privacy Settings Guide: Plain-English Steps to Stay Safe

Most social media accounts share far more with strangers than their owners realise, and that information is used by scammers, stalkers and burglars. This guide shows you, in plain English, how to check and change the privacy settings on Facebook, Instagram, TikTok, Snapchat and X, what to stop sharing, and what to do if an account is misused. It is for anyone who uses social media, including parents setting up a child's first account and people helping an older relative. Settings move around as apps update, so we name each setting as the company's own help pages describe it; if you cannot find it, search the app's help centre for that name. For organisations, see the Social Engineering Guide.

Key takeaways

• Make your account private by default. On most platforms a private account means only people you approve can see your posts.
• Privacy settings are not a safe. Followers can still screenshot, download or share what you post. Only post what you would be happy for anyone to see.
• Stop sharing the details criminals want. Birthday, phone number, address, school or workplace and holiday dates help identity thieves and burglars.
• Location is the setting people forget. Turn off live location sharing and location tags unless you need them.
• Protect the account itself. A strong password and two-step verification stop someone taking over your account and messaging your friends as you.

Why your settings matter

The UK National Cyber Security Centre (NCSC) warns that extra personal details you share can help criminals steal your identity or write more convincing phishing messages. Get Safe Online adds that burglars use social media as a research tool, and that an insurer may reject a burglary claim if you announced you were away. Your "digital footprint", meaning everything about you that can be found online, also includes what other people post about you.

Three groups can usually see your profile:

• Public: anyone, including people who are not logged in and, often, search engines.
• Friends or followers: people you have accepted. This can be hundreds of people you barely know.
• Close friends or custom lists: a smaller group you choose for more personal posts.

Change these settings today

This table lists the main setting to check on each platform, named as the company's help pages name it.

Do a full privacy check in 15 minutes

1. Pick one platform at a time. Start with the one you use most.
2. Run the built-in checkup if there is one. On Facebook, open Privacy Checkup and work through all four topics.
3. Switch to private. Turn on Private account (Instagram, TikTok) or Protect your posts (X).
4. Limit who can find you. In Facebook's "How People Can Find You" topic, stop people looking you up by phone number or email address if you do not want that.
5. Limit who can message and tag you. Set messages, comments and tags to friends or followers only where the app allows it.
6. Turn off location. Turn on Ghost Mode in Snap Map, and remove location access from social apps in your phone's own settings if you do not need it.
7. Remove old connections. Check which outside apps, games and quizzes can access your account and remove any you no longer use. Get Safe Online advises removing app permissions after any scam.
8. Check what others see. Many platforms let you view your profile as the public would. Use it.

Limits worth knowing

• Old followers keep access: X notes that people who followed you before you protected your posts can still see them unless you remove or block them. The same idea applies elsewhere, so tidy up your follower list after going private.
• Media can still travel: X also says followers can still download or share media from protected posts, and anyone with the link can view it.
• Map posts are still public: Snapchat says Snaps you submit to Snap Map can still appear on the map even with Ghost Mode on.
• Connected apps: X warns that apps you have authorised may still see protected posts.

What to stop sharing

Get Safe Online and NCSC agree on a short list of things to keep off your profile and posts:

• Identity details: full date of birth, phone number, home address, and answers to common security questions (first pet, mother's maiden name, first school).
• Where you are and when you are away: post holiday photos after you get home, not during.
• Photos that give away your home or routine: house numbers, car registration plates, school uniforms, your gym at the same time each day.
• Personal information in your username.
• Anything you would regret later: as Get Safe Online puts it, what goes online stays online.

Get Safe Online also suggests registering for social media with a separate email address, so you can stop using it if you close the account. To find and remove what is already out there about you, see the Deleting Your Data From Brokers Guide.

Settings for children and teenagers

NCSC notes that most platforms need users to be at least 13, but it is easy to enter a false date of birth. Using a child's real age matters, because it switches on the platform's teen protections. Instagram, for example, places teens in Teen Accounts:

• Teens under 16 have private accounts by default, and need a parent's permission (through supervision) to loosen protections.
• Teens can only be messaged by people they follow or are already connected to, and only people they follow can tag or mention them.
• Sleep mode mutes notifications from 10pm to 7am, and sensitive content is set to the most restrictive level.

For wider advice on parental controls, warning signs and reporting, see the Protecting Children Online: A Parent's Guide.

Spot fake accounts and hacked friends

Privacy is also about who you let in. NCSC suggests these checks before accepting a request or trusting a message:

• Look at the account: was it created recently, does the name look random, does it have very few posts? Remember that followers can be bought, so a big following proves nothing.
• Check for verification: a verification badge helps, but is not a guarantee.
• Out-of-character messages: if a friend suddenly asks for money, a code or a vote, their account may have been hacked. Contact them another way, such as a phone call, before doing anything.
• Duplicate friend requests: a second request from someone already on your list is often a copy made by a scammer.

Scammers increasingly use AI to fake voices and faces. See the Spotting Deepfake Scams Guide and the Romance and Investment Scam Awareness Guide.

Lock the account itself

• Turn on two-step verification (2SV): NCSC explains that 2SV stops someone getting in even if they know your password. Use an authenticator app or passkey where offered. See the Two-Factor Authentication for Everyone Guide.
• Use a unique password: a password manager makes this easy. See the Password Managers Explained for Everyone Guide.
• Secure the email behind it: whoever controls your email can reset your social media password. See the Securing Your Email Account Guide.
• Watch for fake "security" messages: Get Safe Online warns of phishing emails that pretend to come from social networks. Open the app directly instead of clicking the link. See the How to Spot a Phishing Email Guide.

What to do if something goes wrong

1. Account taken over: use the platform's account recovery page straight away, change your password and turn on 2SV. NCSC publishes step-by-step advice on recovering a hacked account.
2. Warn your contacts: tell friends, by another route, not to trust messages from the account until you have it back.
3. Fake profile pretending to be you: report it using the platform's report option for impersonation. NCSC advises reporting fake profiles and posts directly to the platform.
4. Money lost: contact your bank immediately, then report to Report Fraud (formerly Action Fraud) (England, Wales and Northern Ireland), Police Scotland on 101, or in the US to the FTC at ReportFraud.ftc.gov.
5. Threats, stalking or abuse: keep screenshots with dates, block the account and contact the police. Call 999 (UK) or 911 (US) if you are in danger.

Where to get help

• UK: NCSC guidance on using social media safely; Get Safe Online; Report Fraud (formerly Action Fraud) for fraud and cybercrime; Victim Support, which Get Safe Online recommends for free and confidential help after cybercrime; the Information Commissioner's Office (ICO) if an organisation will not deal with your personal data properly.
• Children: NSPCC, Internet Matters and CEOP (Thinkuknow), all pointed to by NCSC.
• US: FTC (ReportFraud.ftc.gov) and IdentityTheft.gov if your identity has been misused; FBI IC3 for internet crime.

Common failure patterns

• Going private but keeping every old follower: the hundreds of strangers who followed you while you were public can still see everything.
• Forgetting old posts: new settings may not change who can see years of earlier posts. Facebook's Privacy Checkup and similar tools help you review them.
• Location left on: live map sharing or location tags quietly show where you live, work and go to school.
• Treating privacy settings as permanent protection: a follower's screenshot can make a private post public in seconds.
• A weak account behind good settings: perfect privacy settings are useless if someone can log in as you. Turn on 2SV.
• Never checking again: apps add new features, such as maps or AI tools, that are sometimes switched on by default. Recheck after major updates.

Practitioner checklist

• List every social media account you have, including old ones you no longer use, and delete the ones you do not need.
• Run Facebook's Privacy Checkup and set Instagram and TikTok to Private account.
• Turn on Protect your posts on X if you do not need a public profile.
• Turn on Ghost Mode in Snap Map and turn off location for social apps in your phone settings.
• Remove followers and friends you do not know.
• Remove date of birth, phone number and address from your public profile.
• Remove apps and games connected to your accounts that you no longer use.
• Turn on two-step verification on every account.
• Set a reminder to repeat this check every six months.

Standards and references

• National Cyber Security Centre: Social media, how to use it safely
• Get Safe Online: Social networking sites
• Meta: Privacy Checkup
• Instagram: Introducing Instagram Teen Accounts
• Instagram Help Centre: Making your account private
• TikTok Support: Making your account public or private
• Snapchat Support: Ghost Mode on Snap Map
• X Help Center: About public and protected posts

Related NHI Mgmt Group resources: Protecting Children Online: A Parent's Guide · Two-Factor Authentication for Everyone Guide · Deleting Your Data From Brokers Guide · Securing Your Smartphone Guide