Most people only think about privacy settings on social media after something has already gone wrong: a photo shared further than intended, an old post resurfacing, or a message from someone they do not recognise. Getting ahead of that moment takes about twenty minutes per platform and a basic understanding of what you are actually controlling.
This guide walks through privacy settings on social media platform by platform, covering Facebook, Instagram, X, LinkedIn, TikTok, Pinterest, and newer apps like Threads, BeReal, and Discord. It also covers what your data protection rights mean in practice under UK law, and where the biggest gaps in most people’s settings tend to sit.
Table of Contents
Why Privacy Settings on Social Media Matter More Than Ever
Privacy settings on social media used to be mostly about audience: who sees your holiday photos, who can find your profile, who can tag you. That is still part of it, but two things have changed the picture since most of these settings were first designed.
Beyond Identity Theft: The Algorithm Angle
Every setting you leave open feeds data back into the platform, and that data shapes what you are shown next. Location history, the accounts you interact with, and how long you linger on a post all train the recommendation system behind your feed. Turning off ad personalisation or restricting data sharing does not just protect your identity from theft. It also changes the mix of content and adverts the platform decides you should see, which is a part of privacy settings on social media that most guides skip entirely.
There is a second, more immediate shift worth knowing about. As of 8 May 2026, Meta removed end-to-end encryption from Instagram direct messages, a feature that had been optional since 2023. Meta has said the change is intended to help it act on harmful content, but it also means the company can technically read message content that was previously private between sender and recipient. If you use Instagram DMs for anything sensitive, this is worth knowing before you send it.
What Are the Three Main Types of Privacy Settings?
Most platforms organise their controls into three broad categories, even if they never label them this way.
- Visibility covers who can see what you post: everyone, friends, or a custom list.
- Connectivity covers who can find, follow, tag, or message you in the first place, separate from what they can see once connected.
- Data permissions cover what the platform itself and any third parties it works with can collect and use, including your location, browsing habits, and contact list.
Reviewing your privacy settings on social media properly means checking all three, not just the first one, since it is entirely possible to have a private profile while still sharing your precise location with advertisers.
Platform by Platform: How to Check Privacy Settings on Social Media
Each platform hides its controls in a slightly different place, and the menu names change often enough that instructions become outdated within a year. The steps below reflect the current menu structure as of mid-2026, but if a label has moved, search the platform’s own help centre for the exact term rather than hunting through submenus.
Facebook’s Privacy Checkup tool is the fastest route through the settings that matter most. It walks you through who can see your future posts, who can send you friend requests, and which apps still have access to your account. Beyond the checkup itself, review your tagging settings to approve or reject tags before they appear on your timeline, and check the ad preferences page to view and adjust the interest categories Facebook has built from your activity. Because Facebook still holds more personal history for most users than any other platform, getting your privacy settings on social media right here tends to have the biggest overall impact.
Set your account to private if you want posts and stories limited to approved followers, and check the separate toggle for who can see your story specifically, since story visibility and post visibility are not always the same setting. Given the end-to-end encryption change mentioned above, also review who you have message requests open to, since Instagram now technically has visibility into direct message content it did not have before. If you have ever shared personal photos on the platform, our guide to protecting photos from being misused covers the additional steps worth taking beyond the basic privacy toggle.
X (formerly Twitter)
Protecting your posts limits them to approved followers only, similar to a private account elsewhere, but it also stops your posts from appearing in search or being quoted by others. Separately, review who can tag you in photos, who can send you direct messages, and whether your precise location is attached to your posts, which is a setting that resets more often than users expect after app updates. X remains one of the platforms where adjusting basic privacy settings on social media makes the most visible difference to a stranger’s ability to find you.
Because LinkedIn sits closer to your professional identity than your personal one, its privacy settings deserve a different kind of attention. You can browse other profiles anonymously rather than showing up in their “who viewed your profile” list, control whether your connections list is visible to others, and manage what data LinkedIn shares with advertisers. Given how often LinkedIn data ends up scraped and resold, it is also worth checking third-party app access here at least twice a year. LinkedIn is proof that privacy settings on social media are not only a personal concern; for many people they are a professional one too.
TikTok
TikTok’s privacy controls sit under Settings and Privacy, then Privacy. Switching to a private account restricts your videos to approved followers, and it also stops other users from duetting, stitching, or downloading your content, according to TikTok’s own support documentation. You can additionally set visibility per video, choosing Everyone, Friends, or Only Me each time you post, and separately control who can comment, message you, or duet your content.
Given how quickly TikTok content can be reshared off-platform, treat the private account toggle as your baseline, not your only line of defence, particularly if your audience includes people you do not know personally. Because TikTok’s discovery feed works differently from other apps, reviewing your privacy settings on social media here needs its own separate check rather than a quick copy of what you set on Instagram.
Pinterest’s privacy settings are less about audience and more about data. You can create secret boards visible only to you or invited collaborators, limit personalised advertising based on your browsing activity, and adjust how visible your full profile is in search results. If you use Pinterest to plan something private, such as a house move or a life event, secret boards are the setting most people forget to check before it becomes a problem.
A Quick Comparison Across Platforms
Taken together, the platforms above default to very different starting points. Facebook and X both offer a single audience-wide toggle for your whole account, whereas Instagram and TikTok let you mix a private account with per-post or per-video visibility. LinkedIn and Pinterest sit apart from the rest, since their main privacy concern is data and advertising rather than who can see your posts. None of this means one platform is safer than another by default. It means the effort required to reach a similar level of privacy on social media varies considerably depending on which app you use.
New Apps, New Risks: Threads, BeReal, and Discord
The platforms above cover the accounts most people already have, but a newer generation of apps has grown quickly enough that their privacy settings rarely get the same attention. Each works differently enough from the older platforms that assuming the same rules apply is a mistake. Treating privacy settings on social media as a “set once” task is exactly how these newer apps end up overlooked.
Threads
Threads runs on your Instagram login, but its privacy setting is independent of your Instagram account and must be set separately: go to your profile, open the menu, then Privacy, and toggle Private Profile. A private Instagram account does not automatically make Threads private, which catches a lot of people out. Blocking someone on Instagram does carry over to Threads automatically, but the reverse is not true, so a block made only on Threads will not protect you on Instagram.
BeReal
Location sharing on BeReal is off by default, but it resets for every single post rather than staying off permanently, so it is easy to accidentally share your precise location on a day you meant not to. Before posting, check both the location toggle and the audience toggle, which lets you choose between friends only or a wider discovery feed. If you share your location, other users can tap through to see the exact spot on a map, not just an approximate area.
Discord
By default, anyone who shares a server with you can send you a direct message, which is one of the more common routes for scams and unsolicited contact on the platform. Discord’s own safety guidance recommends turning off “allow direct messages from server members” either globally or per server, and reviewing your friend request settings so that only people with a mutual friend or shared server can add you. If you manage a Discord server for a community that includes younger members, our overview of cyberbullying statistics is worth reading alongside your server’s moderation settings.
A Five-Step Framework for Every App
Rather than treating each platform as a separate project, it helps to run through the same five checks whenever you join something new or do your periodic review of your privacy settings on social media.
Turn on two-factor authentication wherever it is offered, ideally via an authenticator app rather than text messages, which can be intercepted via SIM swapping. Use a password manager so each account has a unique password rather than a variation on the same one. Review which third-party apps and websites still have access to your accounts through “log in with Facebook” or similar options, and revoke anything you no longer use.
Turn off precise location sharing by default and enable it only when you actively want to share it. Finally, revisit these settings every few months, since platforms update their menus and defaults more often than most people check them. Building even one of these into a habit does more for your overall privacy settings on social media than adjusting every toggle once and never returning.
Most people manage this checklist manually, which is why it tends to slip after the first month. Setting a recurring calendar reminder, or pairing it with an existing habit such as a quarterly password change, keeps the review from depending on memory alone. Families with children on these platforms may also find it worth doing this check together, since younger users are less likely to notice when a platform quietly changes a default setting back to public after an update.
Your Data Rights in the UK
Alongside the settings each platform gives you, UK law gives you rights that exist independently of what any single app decides to offer. These sit under the UK GDPR and the Data Protection Act 2018, and they apply to every platform processing your data, regardless of where the company is based. In other words, your privacy settings on social media are only one layer of protection; the law is the layer underneath them.
The clearest of these is the right to erasure, sometimes called the right to be forgotten. Under guidance from the Information Commissioner’s Office, you can ask an organisation, in writing or verbally, to delete personal data it holds about you, and it must respond within one month. This applies in specific circumstances, such as when the data is no longer needed for its original purpose or when you withdraw consent you previously gave. If a platform has made your data public, including on social media, it must also take reasonable steps to inform others who may hold copies or links to it.
Enforcement of these rights is not theoretical. In October 2020, the ICO fined British Airways £20 million after a data breach exposed the personal details of around 400,000 customers, having originally proposed a fine of £183 million before reducing it following representations from the airline. It remains one of the largest penalties the ICO has issued to date, and it illustrates that these rights come with real consequences for organisations that mishandle personal data, social media companies included.
For businesses navigating the practical side of GDPR and PECR compliance, the specifics are covered in more technical detail in ProfileTree’s guide to privacy-first marketing for UK SMBs, and organisations wanting a grounding in the wider legal framework can start with ProfileTree’s GDPR training overview. For a broader look at how social media privacy law has developed beyond the UK, our own guide to social media privacy laws covers the international picture.
Keeping Your Privacy Settings Up to Date
Privacy settings on social media are not a one-off task. Platforms redesign their menus, introduce new features with permissive defaults, and occasionally reset preferences after major updates. Set a reminder every few months to run through the five-step framework above, starting with whichever platform you use most. It takes less time than the process of trying to undo a post that has already spread further than you intended.
Frequently Asked Questions
The questions below come up most often once people start adjusting their privacy settings on social media and realise the topic is more layered than a single toggle.
What are the three main types of privacy settings?
Visibility (who sees your posts), connectivity (who can find or contact you), and data permissions (what the platform and its partners can collect and use). Most platforms blend all three into one settings menu, which is why it is easy to fix one and overlook the others.
Does making my profile private hide my old posts?
Usually yes, but with caveats. Older posts that were already shared, screenshotted, or reshared by others before you switched to private will not be pulled back. On some platforms, content tagged by other people, such as photos someone else posted of you, is not covered by your own privacy settings at all.
Can my employer see my private social media accounts?
Not directly, since a private account restricts casual viewing. However, mutual connections, publicly visible comments on other people’s posts, and information you have shared in professional networks can still surface. Treat “private” as reduced exposure rather than complete invisibility.
How do I change privacy settings on all my social media accounts at once?
There is no single master switch. Each platform manages its own settings, so the five-step framework above is the closest equivalent: a consistent checklist you apply to each app individually rather than a single setting that covers everything.
What is the right to erasure in the UK?
It is your right under the UK GDPR to ask an organisation to delete personal data it holds about you in specific circumstances, such as when it is no longer needed for its original purpose. The organisation has one month to respond, and you can complain to the ICO if it fails to do so without a valid legal reason.
Is two-factor authentication a privacy setting?
It sits closer to security than privacy in the strictest sense, but the two overlap heavily. A compromised account exposes everything your privacy settings were meant to protect, so enabling two-factor authentication is one of the highest-impact changes you can make alongside your visibility and data settings. If you want to understand who typically targets weak account security, our guide to types of hackers explains the different motives behind account takeovers.