MyRecon OSINTHow to Lock Down Your Social Media Privacy
Most privacy advice is a list of switches, and switches move. What does not move is the set of things a stranger can learn from an account, and several of the most revealing are not covered by the privacy settings at all, they are in the profile photo, the handle, and the follower list of an account you believed was private.
Start by looking at yourself the way a stranger does
No settings screen tells you what is actually visible. The only reliable test is to go and look.
- Open a private browsing window, signed out of everything.
- Visit your own profile on each platform. Note what loads: the photo, the bio, the follower counts and lists, recent posts, tagged photos, the join date.
- Search your name, your handle and your usual email address in a search engine. Then search them with your city added.
- Do the same for old handles you have retired, which frequently still resolve.
Twenty minutes of this tells you more than any checklist, because it shows your actual exposure rather than the exposure the settings imply. Repeat it after any change you make, settings routinely do not do what their labels suggest.
The four things that leak most, and are rarely covered by privacy settings
The profile photo
Profile pictures are usually public even on locked accounts, and the same image reused across platforms is the simplest way to connect a professional identity to an anonymous one. It is reverse-searchable, and the background is searchable independently of the face, see the reverse image search guide for how that is done.
If you maintain accounts you would rather were not linked, they need different photographs, not cropped versions of the same one, which is what perceptual matching is built to defeat.
The username
A distinctive handle reused across services is the single strongest link between accounts, and enumerating it across platforms takes seconds. This is the technique our username OSINT guide describes, and the defence is the obvious one: distinctive handles are for identities you are happy to have connected.
The follower and following lists
A private account whose follower list is public is not private in the way its owner believes. Social graphs identify people: your employer, your school, your family and your town are all inferable from who follows you, without a single post being visible. Where a platform allows the connection list to be hidden, hiding it is often a larger change than making posts private.
Everything around a post rather than in it
Posting times describe a schedule and a time zone. Location tags describe a routine, and it is the repetition that matters, one tagged café is nothing, the same café every weekday morning is a place you can be found. The contents of photographs give away more than the subject: a street sign, a school uniform, a delivery label, a view from a window, a vehicle number plate. Photographs of keys can be enough to have them cut.
The setting almost nobody changes, and the one that mattered most. Platforms let people find your account by uploading a phone number or an email address. In 2021 a dataset covering more than 500 million Facebook users appeared publicly, assembled not by breaching anything, but by abusing a contact-import feature at scale to match phone numbers to profiles. If a platform offers "who can look you up by phone number or email", setting it to the narrowest option is the highest-value privacy change on this page. The case file explains how it was done.
The settings worth finding, described by what they do
Menu names change constantly; functions do not. Look for these:
- Discoverability by phone and email. As above. Narrow it everywhere.
- Search engine indexing. Most platforms offer a toggle controlling whether your profile appears in external search results. It does not remove what is already indexed, but it stops the accumulation.
- Retroactive audience change for old posts. Several platforms can restrict every past post in one action. This matters because your old posts were made under the defaults of the time, which were far more open, and because nobody edits a decade of history by hand.
- Connection list visibility. Followers, following, friends, and mutual connections.
- Tag review. Approval before a tag of you appears on your profile. This is control over what other people attach to your name.
- Location. Turn off precise location for social apps at the operating-system level rather than inside the app, disable any live-location or nearby feature, and remove location tags from past posts where the platform allows bulk editing.
- Connected applications. Every third-party app you ever signed into with a social account still holds an authorisation. Review the list and revoke everything you do not currently use, this is the route by which data leaves a well-configured account entirely legitimately.
- Off-platform activity. The record of your behaviour on other websites, collected through embedded buttons and advertising pixels and attached to your account. Clearing and disabling it is usually available and rarely found.
- Story and default audience. Whatever the default audience is for a new post, set it to the narrowest option you would accept, because the default is what you will use when you are in a hurry.
Security is half of privacy
A meticulously configured private account that gets taken over exposes everything at once, including the private messages that were never public in the first place. The account-security half is not optional:
- A unique password, because these accounts are prime credential-stuffing targets.
- Two-factor authentication, ideally not SMS, see the two-factor guide.
- A recovery email you still control, and that is itself secured. Abandoned recovery addresses are a standard route in.
- A periodic look at active sessions and logged-in devices, and sign out anything you do not recognise.
- Login alerts enabled, so a takeover is something you learn about rather than discover.
What the settings cannot fix
Being honest about the limits is what makes the rest worth doing.
- What other people post. Group photos, tagged locations, a colleague's public celebration of your new job. You can ask; you cannot configure it.
- What has already been collected. Anything public has been scraped and archived, repeatedly. Making a profile private from today does not retrieve it.
- The platform itself. Private means restricted from other users. The company holds it all, and so does anyone who breaches the company.
- Data brokers, which merge social data with public records and purchased datasets, covered in how data brokers work.
If you post about children
A specific case that deserves its own line, because the accumulation is invisible. School uniforms identify an institution. A first-day-of-term photo dates it. A geotagged garden identifies a home. Repeated over years, an ordinary parent assembles a comprehensive public record about a person who never agreed to it and will inherit it at thirteen. Restricting the audience for those posts to people you actually know is the least effortful protective decision available to anyone.
A quarterly twenty minutes, not a one-off afternoon. Platforms add features, reset defaults during migrations, and occasionally change what a setting means. Put a recurring reminder in a calendar: view your profiles signed out, review connected apps, review active sessions, and search your own name. The exposure that hurts is the kind that accumulates while nobody is looking.
Before you delete anything
If you decide to leave a platform, download your data export first, it is the only copy you will get, and deletion is often irreversible after a grace period. Deactivation hides a profile while the company retains everything; deletion is the meaningful action, and it does not affect the copies already scraped, archived or sold.
See what is publicly attached to a handle you use, across platforms, with the MyRecon username tool, or work through the full digital footprint routine.