Social media, the privacy settings almost nobody checks

Setting a social media account to "private" gives a false sense of total control. In reality, several of the most common information leaks come through neither a hack nor a technical flaw, just settings or mechanisms almost nobody thinks to check.

Metadata hidden inside a photo

A photo taken with a smartphone often contains, on top of the image itself, metadata invisible to the naked eye, including the precise GPS coordinates of where it was taken. Most major social media platforms automatically strip this metadata when a photo is posted, but that isn't universal everywhere, and above all, sending the original photo directly through a messaging app rather than through the platform itself usually keeps this data intact. A series of vacation photos sent this way can unintentionally reveal the exact address of a home left empty while its owner is away.

Tagging by others, beyond your direct control

An account set to private protects what its owner posts themselves, but not what others post about them. A person tagged in a photo posted by someone else, with a public account, can have their presence at a specific place, at a specific time, revealed publicly, regardless of their own privacy settings. Most platforms offer an option to manually approve each tag before it appears on the profile, an option rarely turned on by default and even more rarely known about.

Connected third-party apps, forgotten over time

Logging into an outside service "with Google" or "with Facebook," instead of creating a separate account, relies on the same authorization-token principle already described in the article on APIs. These authorizations pile up over the years, often completely forgotten, each one remaining an active access point into part of the account until it's manually revoked. The article on the Klue breach showed how a token forgotten for years can become an entry point exploited long after its original purpose stopped making sense: the same risk applies, on an individual scale, to the long list of third-party apps a social media account piles up and never cleans out.

The "public by default" profile, even without thinking about it

Many platforms create a new account with public visibility by default, leaving it up to the user to restrict it themselves if they want to. Even once an account is switched to private, some basic information (the displayed name, profile picture, sometimes the list of accounts followed) stays publicly visible depending on the platform and its exact settings, a nuance that varies enough to be worth checking directly rather than assumed.

What privacy settings never protect

A private account limits who can see content at the moment it's posted, not what happens once that content has been seen. Someone accepted as a follower can always take a screenshot and share it elsewhere, with the original privacy setting changing nothing about that. Someone determined enough to access a private account's content can also create a credible fake profile to get accepted, a direct variant of social engineering (see the dedicated article) applied to social media rather than an email or a call.

Good habits to keep

• Check whether location sharing is on by default on the device before posting a photo, and turn off GPS metadata if the app allows it
• Turn on manual approval for tags before they appear publicly on a profile
• Review, at least once a year, the list of third-party apps connected to each account, and revoke the ones no longer in use
• Actually check, from another account or in private browsing, what stays genuinely visible publicly once an account is set to private, rather than assuming it

A "private" account remains a good baseline setting, but it protects less than its name suggests. Most information leaks on social media go through these exact blind spots, never through hacking in the strict sense.