Social Media Safety Tips: The Settings That Actually Protect Your Accounts

Social Media Safety Tips: The Settings That Actually Protect Your Accounts

My friend Sarah is a middle school teacher, and she has never intentionally shared her home address on social media. But last year, a student's parent — who had developed an unhealthy fixation — showed up at her front door. He had pieced together her address from background details in photos she'd posted: a distinctive mailbox visible in one photo, a street sign edge in another, a neighborhood landmark she'd tagged while walking the dog. None of those posts felt like privacy risks when she made them.

That story illustrates why social media safety tips matter beyond the obvious advice of "don't post your address." The risks are often invisible: accumulative, contextual, and not obvious until something goes wrong. This guide covers the specific settings and habits that actually protect you on Instagram, Facebook, LinkedIn, and TikTok — not generic advice, but the exact menu paths and settings that matter.

I've spent time auditing my own accounts and was genuinely surprised how much data I was sharing with defaults I'd never reviewed. Most of the settings that matter most are buried multiple menus deep, and platforms have no incentive to make privacy-protective options easy to find.

Why Social Media Privacy Settings Are a Moving Target

Before diving into specific settings, understand this: social media platforms change their privacy controls frequently, often without prominent notice to users. New features launch with permissive defaults. Existing settings get reorganized or split into new controls. What was private under last year's settings may no longer be private after an update.

This means a one-time configuration isn't sufficient. The habits matter as much as the initial setup. I'll cover both.

For broader context on protecting your digital presence, see our online privacy fundamentals guide and our cybersecurity basics overview.

Platform Privacy Settings Comparison

Here's an honest overview of how the major platforms compare on privacy controls before we go into specifics:

Instagram Account Security: The Complete Walkthrough

Instagram defaults to a public account, meaning anyone on the internet can see your posts, stories highlights, and tagged photos. For most users, this is not the appropriate setting.

Making Your Account Private

Settings > Privacy > Account Privacy > toggle on "Private Account." This means only approved followers can see your content. Existing followers remain, but new followers require your approval.

Note that even with a private account, your profile picture, username, and bio are visible to everyone. Do not include personal identifying information in those fields.

Location and Photo Settings

Settings > Privacy > Location > untoggle "Add Location to Posts." More importantly, go to your phone's app settings and set Instagram's location permission to "While Using" — never "Always." This prevents Instagram from tracking your location in the background.

For stories and posts you've already made, review and remove location tags on any that reveal sensitive information like your home neighborhood, regular gym, or workplace. Tap the post, click the three dots, Edit, then tap the location tag to remove it.

Who Can Find You

Settings > Privacy > scroll to "Discoverability." Here you can control whether people can find you by syncing contacts, whether your account appears in suggested users lists, and whether search engines can link to your profile.

Disable "Allow Others to Find You in Contacts" unless you specifically want that feature. Disable "Show Account Suggestions" to reduce your profile's exposure in recommendation algorithms.

Third-Party App Access

Settings > Security > Apps and Websites. This shows every third-party app that has been granted access to your Instagram account. Remove any you don't recognize or no longer use. I found seven apps with Instagram access when I first audited mine, including two I had completely forgotten about.

Instagram Account Security Checklist

• Account set to Private
• Two-factor authentication enabled (Settings > Security > Two-Factor Authentication — use authenticator app, not SMS)
• Login activity reviewed (Settings > Security > Login Activity) — unfamiliar logins revoked
• Saved login information reviewed for unknown devices
• Third-party apps audited and unused ones removed
• Location permission set to "While Using" in phone settings
• Email and phone number on file are current and secure

Facebook Privacy Settings: Navigating the Complexity

Facebook has the most extensive privacy controls of any social platform, but they're spread across dozens of menus and submenus in ways that can feel deliberately confusing. Here are the settings that matter most.

Audience Controls

Every post on Facebook has an audience selector — that small icon next to your name when posting. Options include Public, Friends, Friends except..., Specific friends, and Only me. The problem is that Facebook often resets this to a previous setting or default when you're not paying attention.

Go to Settings & Privacy > Settings > Privacy > Your Activity > Who Can See Your Future Posts. Set this to "Friends" as your default. Then navigate to "Limit Past Posts" and change all old public posts to Friends only with a single click. This is one of the highest-impact privacy actions available on Facebook.

Who Can Find You

Settings > Privacy > How People Find and Contact You. Here you can control who can send you friend requests (Everyone or Friends of Friends), who can look you up by phone number, and who can look you up by email address. Change all of these to "Friends of Friends" minimum, or "Friends" if you're comfortable with that limitation.

Critically: untick "Allow search engines outside of Facebook to link to your profile." This removes your Facebook profile from Google search results, which is significant since many people's Facebook profiles contain substantial personal information.

Facebook Two-Factor Authentication

Settings > Security and Login > Two-Factor Authentication. Use an authenticator app (Google Authenticator, Authy) rather than SMS. SMS-based two-factor authentication is vulnerable to SIM-swapping attacks where someone convinces your carrier to transfer your number to a new SIM they control.

Also review "Authorized Logins" — the list of browsers and devices where you can log in without two-factor. Remove any devices you no longer use.

LinkedIn Privacy: Protecting Your Professional Data

LinkedIn is often overlooked in privacy discussions because people assume that professional profiles are intended to be public. While your public professional presence is the point of LinkedIn, there are settings that affect your safety that most users haven't configured.

Who Can See Your Connections

Your LinkedIn connection list is a map of your professional network — potentially valuable to recruiters poaching your contacts, competitors doing competitive intelligence, or social engineers building targeting information. Go to Settings > Visibility > Visibility of Your LinkedIn Activity > Who Can See Your Connections. Change this to "Only you" unless you have a specific reason to share it.

Blocking Profile Data from Data Brokers

Settings > Data Privacy > Data for Generative AI Improvement — opt out. Settings > Advertising Data > Profile Data for Targeting — review and restrict. Settings > Visibility > Manage Active Status — consider turning off so connections can't see when you're online.

The Location Risk on LinkedIn

Unlike Instagram, LinkedIn is one of the few platforms where sharing your general city is professionally useful and expected. However, be careful with posts that reveal your physical location or daily patterns — LinkedIn content is indexed by Google, making it more persistent and publicly visible than most people realize.

TikTok Account Security: The Privacy-Complicated Platform

TikTok faces ongoing scrutiny over data practices, and its privacy settings deserve careful attention. The platform collects extensive data including location, device identifiers, content you've watched (not just liked), and keyboard input data on some devices.

Basic Account Privacy

Profile > Privacy > Private Account. TikTok defaults to a public account. Making it private means only approved followers see your content.

Under Privacy, also review: "Suggest Your Account to Others" (disable), "Allow Others to Find Me by Phone Number" (disable), and "Sync Contacts and Facebook Friends" (disable unless you specifically want that).

Location Settings

In your phone's app settings, set TikTok's location permission to "Never." TikTok does not require location access to function for most users — it infers your approximate location from IP address and device settings, which is sufficient for serving relevant content. Precise GPS location access benefits TikTok's data collection, not your experience.

Platform-Specific Red Flags for Compromised Accounts

Cross-Platform Safety Habits That Actually Work

Beyond platform-specific settings, several habits protect you across all social media:

Use unique passwords for every account. A password manager (Bitwarden is free and excellent) makes this practical. When one platform has a breach, unique passwords prevent that breach from unlocking your other accounts.

Be suspicious of login request emails. Phishing emails mimicking Instagram, Facebook, and LinkedIn account security notifications are among the most common phishing attacks. Never click security links in emails — go directly to the platform's website instead and check notifications there.

The 24-hour rule for sensitive posts. Before posting anything that reveals your location, routine, relationships, or personal struggles, wait 24 hours and ask: who is the full possible audience for this? Who might screenshot or share this? What could a determined bad actor learn from this?

Review tagged photos. On Instagram and Facebook, you can require your approval before tagged photos appear on your profile. Enable this. Friends' accounts may have different privacy settings than yours, meaning a photo tagged of you that they post may be visible to a much wider audience than your own posts.

For additional resources on protecting your accounts, visit StaySafeOnline.org — maintained by the National Cybersecurity Alliance — and the FTC's social media guidance. You'll also find our downloadable account security checklists at /notes helpful for systematic audits.

Frequently Asked Questions

What social media privacy settings should I change first?

Start with account visibility: set your profile to private on Instagram and TikTok, restrict your Facebook audience to Friends only, and audit who can find you by phone number or email on every platform. Next, enable two-factor authentication everywhere. These two actions — limiting who sees your content and securing your login — prevent the majority of social media safety incidents and take under 30 minutes to implement.

How do I know if my social media account has been hacked?

Warning signs include: login notifications from unfamiliar locations or devices, posts or messages you didn't send, friends reporting strange messages from your account, being suddenly logged out of all sessions, email or phone number changed on your account, and follower or following lists you don't recognize. If you notice any of these, immediately change your password, check and revoke third-party app access, review active sessions and log out all unknown devices, and enable two-factor authentication.

Is it safe to use Facebook Login or Google Login for other apps?

Using social login is convenient but carries risk: it connects your social account to the third-party service, and if your social account is compromised, all connected apps become vulnerable. Additionally, you're sharing profile data with those apps. A safer approach is using a dedicated email address (or alias) for each service. If you do use social login, regularly audit connected apps and remove any you no longer use.

Can someone track my location through social media?

Yes, in multiple ways. Direct location sharing through posts and stories is obvious, but the less obvious risks are: geotagged photos that embed GPS coordinates in file metadata, background information in photos revealing your neighborhood, check-ins and tagged locations building a pattern of your routine, and stories showing identifiable landmarks near your home. Disable location permissions for all social media apps in your phone settings, and review old posts for location data you may have shared without realizing it.

How often should I review my social media privacy settings?

Review your settings quarterly and after any major platform update. Social media platforms routinely change default privacy settings, introduce new features with permissive defaults, and modify how existing settings work — often without prominent notification. Set a calendar reminder every three months to do a 15-minute audit of your main accounts.