A social media privacy review that takes twenty minutes

CISA’s privacy module for people at elevated risk reduces the whole subject to three actions: disable the device advertising identifier, manage the settings on your social media accounts, and reduce the chance that someone can install tracking software on your device. The middle one is the one people put off, because the settings pages are long and badly organised. It does not have to take an afternoon. Here is a pass that gets the important parts done in about twenty minutes per account.

What you are actually reviewing for

Not "is my account private", which is too coarse a question to act on. Three specific things.

First, what is visible to everyone rather than to people you know. That is the category the FTC identifies as an input to data brokers, which collect from profiles that are public or viewable by everyone.

Second, what the platform infers and shares for advertising, which is usually a separate menu from the visibility settings and is usually more permissive.

Third, what other applications you have connected over the years can still read. That list is nearly always longer than expected.

Do this on a laptop, not the phone

• Do this on a laptop rather than a phone. The mobile apps hide options the web settings expose.
• Do one account at a time and finish it. A half-done pass across four platforms is worse than a finished pass on one.
• Decide your default first: who should be able to see a new post by you, before you look at any individual setting.
• Have twenty minutes without interruption. These interfaces reset when you navigate away.

The pass, in order

1. Audience for new posts. Set the default first, because every later decision depends on it.
2. Past posts. Most platforms offer a bulk change for historic content. This is the single highest-value click in the whole exercise.
3. Profile fields. Birth date, employer, school, home town, phone number, email. Each one is a matching key for someone assembling a profile from other sources. Remove what you do not need to be there.
4. Discoverability. Whether people can find you by phone number or email address, and whether search engines may index your profile.
5. Advertising and data settings. Look for interest categories, activity from partners, and inferred attributes. Turn off what you can.
6. Connected apps and sites. Revoke everything you do not currently use. Anything you cannot identify goes.
7. Active sessions and logged-in devices. Sign out anything you do not recognise, then change the password if you found one.

The setting people miss

Tagging and mentions. You can lock your own posts down completely and still be visible in other people’s, at their audience setting rather than yours. Most platforms let you review tags before they appear on your profile; that control is usually off by default.

The same applies to friend and follower lists. A profile that reveals nothing else may still reveal your entire social graph, which is exactly the material the FTC describes brokers using to build reports that reference relatives, neighbours and associates.

How to check it took, and when to do it again

Sign out entirely and view your own profile from a browser where you are not logged in. Whatever you can see there is what everyone can see. This is a better test than any settings summary the platform shows you, because it tests the result rather than the intention.

Then search for your own name in a search engine and see what surfaces. If old public posts still appear, the bulk change may not have covered everything.

Repeat after any major platform redesign, and once a year otherwise. Settings are routinely reorganised, and new features arrive with permissive defaults.

What tightening settings cannot undo

Anything already collected while your profile was public is gone into other people’s systems. The FTC’s honesty about people-search removal applies here too: information "could re-appear for sale" when public records change, it may persist in the reports of relatives and associates, and opting out "doesn’t delete your information from public records."

Tightening the settings stops the flow. It does not recall what has already flowed. That is a reason to do it sooner rather than a reason not to bother.

Sources: CISA Project Upskill, Module 6 · FTC — What to know about people search sites · FTC — How to protect your privacy online · CISA — Best practices against tracking technologies and spyware

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from CISA and the FTC. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.