How to Protect Your Privacy on Social Media: 10 Easy Steps

Last spring, a recruiter messaged my wife on LinkedIn about a job. She hadn't applied anywhere. He'd found her profile, pieced together her employer from a tagged photo, and guessed her role from a caption her sister wrote in 2019. Nothing was "public" in the way she thought. It was just connected.

That's the part most advice skips. Privacy on social media isn't a switch you flip in settings. It's a chain of small decisions, and the weakest link is almost never the one you're staring at. When people ask me how to protect your privacy on social media, I usually start by asking what they think is actually private right now. The answer is uncomfortable.

Key takeaways

Your profile settings matter, but they're a floor, not a ceiling. Metadata and cross-platform matching leak more than most people realize.
The 5-5-5 rule is a useful mental filter, not an official standard. Fifteen seconds of hesitation has saved me real trouble.
Most account compromises come from reused passwords and phishing, not from platform bugs.
You have deletion and access rights in many jurisdictions, but you have to ask. Silence is not consent to keep your data.
Auditing takes about 40 minutes once. Then 10 minutes a month.

The honest answer is that you can't make a platform truly private. You can make it harder to abuse. That's the goal. I learned this the slow way when a client's employee got doxxed after a Twitter argument. Nothing she posted was sensitive on its own. The attacker collected her city from one post, her gym from another, and her commute from a story screenshot with a visible location tag. Three pieces, one address.

What actually counts as private

Privacy on these platforms operates at three layers, and people usually fix only the top one.

Visibility: who can see your posts. This is the settings menu everyone knows.
Discoverability: whether strangers can find you by phone number, email, or name search. Most people never touch this.
Inference: what someone can deduce by combining your posts, tags, and friends. You can't set this in a menu.

Layer three is where real damage happens. A single tagged photo at a conference reveals your employer, your city, and often your schedule. I once found a client's home neighborhood in under four minutes using nothing but three public posts and a Google search. He was not happy with me. But he fixed his tags that week.

Start with the settings nobody opens

Go into your account's privacy section and look specifically for these. They exist on Meta, X, TikTok, and LinkedIn under slightly different names.

Turn off phone number and email discoverability. This alone stops a huge share of unwanted contact.
Restrict who can tag you, and turn on manual review for tags before they appear.
Disable location tagging on cameras and stories by default. Check the app permission, not just the in-app toggle.
Set your friend or follower list to visible only to you. Attackers use it to map your real relationships.
Turn off "allow search engines to link to your profile" if you don't want your account indexed.

That last one is underrated. Removing yourself from search results cuts down casual scraping enormously. It won't stop determined actors, but it raises the cost.

Not a checklist to feel good about. A list you can actually run through. I've kept roughly these habits since a phishing attempt nearly got into a work account in 2022.

Use a password manager. Unique passwords everywhere. Non-negotiable.
Turn on two-factor authentication. Prefer an authenticator app or hardware key over SMS.
Lock down discoverability as described above.
Review app permissions quarterly. That quiz app from 2021 probably still has your data.
Never post your real-time location. Post the beach photo when you're home.
Check photos for metadata before sharing originals. Screenshots strip most of it; camera files don't.
Treat every DM link as hostile until proven otherwise, even from friends.
Set your profile to private if you don't need reach. Public accounts attract scrapers.
Verify login alerts and sessions, then log out old devices.
Keep a separate email for social accounts so breaches don't touch your main inbox.

Notice number six. It's the one most people skip, and it's the one that got a friend of mine. She posted a photo straight from her phone camera. The GPS coordinates were embedded. She lived in a small town. It was trivially easy to find her street. She now screenshots everything before posting, and honestly, so do I.

You'll see this floated around as if it's an official guideline. It isn't. There's no governing body that issued it. But the version I've adopted and recommend goes like this: before posting anything, pause for five seconds, ask yourself five questions, and wait five minutes if the answer to any of them is shaky.

The five questions I use:

Would I be comfortable if my employer read this?
Does it reveal a location, schedule, or relationship?
Could someone use this to impersonate me?
Am I angry right now?
Will this still be fine in a year?

The five-minute pause is the real value. Most bad posts are impulsive. I've deleted more drafts than I've published because of that pause, and I've never once regretted it. Treat the rule as a personal habit, not a law. It's flexible, and that's the point.

Start by deciding what "personal" means to you. Most people include their address and phone number. Fewer include their employer, their kids' school, or their dog's name—all of which are classic security questions. I stopped using my real birth date in security-question answers years ago, and I store the fake answers in my password manager. Sounds paranoid. It's not.

Hackers rarely "hack" in the movie sense. They call, message, or email pretending to be support, a friend, or a brand. This is social engineering, and it works because it exploits trust, not code. A common pattern: a cloned account of someone you know messages you, says they're locked out, and asks you to click a link to help them verify. The link steals your session.

Doxxing is the other one. An attacker gathers your real details and publishes them to intimidate you. Facial recognition makes this worse—a single untagged group photo can be matched to a tagged one. I've started asking people to avoid posting my face without asking. Awkward to say out loud. Worth it.

Defenses that hold up

Threat	What it looks like	Practical defense
Phishing DM	"I'm locked out, click this"	Verify via a separate channel
Account takeover	Password reused elsewhere	Password manager + authenticator app
Metadata leak	GPS in photo files	Screenshot or strip before posting
Cross-platform matching	Same handle everywhere	Vary usernames, avoid linking
Data scraping	Public profile harvested	Private account, no search indexing

Your rights, and how to actually use them

In the EU, the GDPR lets you request a copy of your data and demand its deletion. In California, the CCPA gives residents similar access rights. I've filed two access requests myself. One company replied in ten days. Another ignored me until I followed up a second time with a formal notice. Persistence works.

Keep it simple. Email support, state you're exercising your right to access or erasure, name the account, and give them thirty days. That's usually enough. You don't need a lawyer for a first request—you need a paper trail.

And yes, deleting an app does not delete the data the platform already collected. You have to ask. Many people assume the exit is the eraser. It isn't.

The part that sticks

Here's what I've landed on after years of testing this stuff on myself and on clients. No single setting saves you. What saves you is treating every post as a small deposit into a public record you don't control. You can reduce what you deposit. You can make it harder to find. You can ask for it back. But you can't un-deposit it.

So the question isn't "how do I make my account private." It's "what am I comfortable having permanently out there, and who do I want to be able to connect the dots?" Answer that honestly, and the settings become obvious. Answer it carelessly, and no amount of two-factor authentication will help you.

How to Protect Your Privacy on Social Media: 10 Simple Steps