Why does social media privacy matter?
Most people already know their clicks, hearts and shared photos get harvested, and very few grasp how that plays out in practice. For more, see Twitter sucks, brilliant ways to use your book with social media and Ten Arguments for Deleting Your Social Media Accounts.
What scares me about social media privacy is how ordinary the damage is. Nobody has to hack you. You post a birthday countdown and a vacation photo in the same week, and you’ve handed a stranger a security answer and told them when your house is empty.Share on X
I spent 20 years as Director of Computer Operations and Technical Services at a major corporation, responsible for the security of systems that handled sensitive data daily. I’ve also written a complete Family Cybersecurity that covers everything from router security to password management to social engineering attacks. Social media privacy is an area where I’ve watched people make the same preventable mistakes for decades.
Most users don’t understand what they’re trading for the convenience of connection, and that’s what makes social media risky.
What Are You Sharing on Social Media?
When you post a photo, you’re not just sharing an image.
You’re potentially sharing GPS coordinates embedded in the metadata, the time the photo was taken, the device you used to take it, and depending on the content, your location, your companions, and your routines. A birthday countdown reveals your date of birth, a security question answer for dozens of online accounts. A check-in at your favorite restaurant establishes a pattern. A vacation photo posted in real time announces that your house is empty.
None of this requires a sophisticated attacker. It requires someone who pays attention. Social engineering, the practice of manipulating people by exploiting the information they’ve voluntarily made public, is the most common attack vector in cybersecurity. It works because people hand over the raw materials without realizing it. Social engineering is the attack I respect most and worry about most, because it needs patience more than skill. A firewall can’t stop a person who reads your posts.
The cascade effect is real. One piece of information is harmless. Five pieces together form a profile. Ten pieces answer your security questions, reveal your daily schedule, identify your family members, and give a social engineer everything they need to impersonate you or someone you trust. Each individual post feels insignificant. The result is anything but.
Each post feels small, but one piece becomes a profile at five and an impersonation kit at ten.
Here’s a practical test from the Family Cybersecurity: review your family’s social media activity as if you were planning to rob yourselves. What would a criminal learn about your schedules, your financial situation, your routines, and when your house is empty? The answer shocks most families.
When Data Aggregation Becomes Weaponized
The Cambridge Analytica scandal made the abstract threat of data harvesting concrete.
A personality quiz app on Facebook collected data from people who took the quiz and from their Facebook friends as well, without consent. Over 87 million Facebook users had their personal details, political preferences, psychological profiles, and social connections harvested. That data was used to build psychological profiles for political targeting during the 2016 U.S. presidential election.
Facebook’s platform design enabled this because the company prioritized developer access and user engagement over privacy protection. The APIs allowed third-party apps to access information about users’ friends as well as the users who installed them. Users who took an innocent-looking quiz thought they were contributing to academic research. They were providing raw material for political manipulation. The FTC fined Facebook $5 billion. Cambridge Analytica closed. But the underlying business model that made it possible hasn’t changed.
Cambridge Analytica remains an outrage. People took a harmless-looking quiz and the platform let the app walk off with their friends’ data too, from people who never clicked anything. The fine was large. The business model survived it, and that tells you how much the fine mattered.
This is the clearest illustration of why social media privacy matters beyond the personal level. When individual data gets aggregated and weaponized, the consequences extend from identity theft to threats against democratic institutions.
Your connected devices compound the exposure. One family discovered that criminals had purchased location data showing all family members’ fitness trackers had been stationary at a resort in Cancun for five days. The criminals used this information to confirm the house was empty and plan a break-in. Another family received targeted advertisements for medical treatments they’d never searched for online. Their smart TV had recorded a private conversation about their daughter’s learning disability and shared the information with advertising companies.
These are documented cases from the Family Cybersecurity, which covers how data brokers, smart home devices, and social media platforms create an interconnected web of exposure that most families never see.
Are social media privacy settings enough?
The first step most security guides recommend is setting your accounts to private. That’s correct and important. A private account limits who can see your posts to people you’ve approved. But it’s not a complete solution, and treating it as one creates a false sense of security.
Private accounts still share data with the platform itself. Your posts, your browsing patterns, your interactions, your location data: all of this is collected regardless of your privacy settings. The settings control who among other users can see your content. They don’t control what the company does with your data behind the scenes.
Third-party apps compound the problem. Every time you log into a service using your Facebook or Google account, you’re granting that service access to some portion of your profile data. Every quiz, game, or “which character are you” app that asks for permissions is harvesting information. Some of these are legitimate. Many are designed to collect data from users who click “Allow” without reading what they’re allowing.
Those quiz apps disturb me. “Which character are you” is a toy wrapped around a permission request, and it keeps working because the toy is fun.
Strong, unique passwords remain the foundation of account security.
A password manager generates and stores complex passwords so you don’t reuse the same one across multiple accounts. Two-factor authentication adds a second layer that prevents access even if a password is compromised. These are baseline measures that every social media user should have in place. The Family Cybersecurity covers password management and authentication in detail.
What Did You Agree to in the Terms of Service?
The Terms of Service and Privacy Policy documents that appear when you sign up for a platform contain critical information about how the platform treats your data. Most people scroll to the bottom and click “Agree” without reading a word. This is understandable. Platforms deliberately make these documents lengthy, jargon-heavy, and difficult to parse.
People skip these documents for good reason, and the companies know it. The industry decided a contract nobody reads counts as consent, and that decision offends me more than any single clause inside it.
What they typically contain: how the platform stores your data, who it might share it with, how long it keeps it, how it uses it for targeted advertising, and sometimes clauses that allow the platform to use your content (photos, posts, videos) in ways you might not have anticipated. Some platforms retain the right to use your uploaded content in their marketing or to train their algorithms. That means your personal photos could end up in contexts you never intended.
The onus falls on the user to understand these terms. Online summaries and user-friendly breakdowns of major platform policies exist and are worth consulting. Being aware of what you’ve agreed to doesn’t just protect your privacy. It helps you to hold platforms accountable when they violate their own stated policies.
Confidentiality in Professional Writing
As a ghostwriter, I handle sensitive information constantly. For more on ghostwriting and cybersecurity, hear this conversation. Client manuscripts contain business strategies, personal stories, financial details, and proprietary structures that aren’t public knowledge. The confidentiality requirements of ghostwriting are the foundation the entire professional relationship is built on.
Every ghostwriting engagement works under strict confidentiality. I protect the client’s unpublished material, their interview transcripts, their personal anecdotes, and the draft manuscript itself.
No client’s private information appears in another client’s project. I don’t share any draft outside the working relationship. I don’t use any personal detail from the interviews for any purpose other than the book the client shared it for.
This professional standard mirrors what social media users should expect from the platforms they use: clear boundaries around what information is collected, how it’s used, and who has access to it. The difference is that ghostwriting clients receive explicit confidentiality agreements. Social media users receive Terms of Service documents that most people never read.
The Sharing Paradox
The industry decided a contract nobody reads counts as consent, and that decision offends me more than any single clause inside it.
Social media exists because people want to share. That’s not a flaw. Connection, community, and the ability to stay in touch with people across distances are real benefits. Nobody needs to stop sharing. The goal is to share deliberately instead of carelessly. I’ve listened to people say they’re being watched in everything they do, and I always wonder why they think anyone cares. Unless you commit a crime or do something stupid, nobody cares about an ordinary person’s day. What you post yourself is another matter, because that’s there for anyone who bothers to look.
Before posting, the question to ask is “what does this reveal?” A photo of your new car reveals your location, your financial status, and possibly your license plate.
A post about your child’s first day of school reveals their name, their age, which school they attend, and what time they arrive. A complaint about your boss reveals your employer, your dissatisfaction, and potentially information that could affect your employment.
None of these posts are inherently wrong. But each one is a decision about what information you’re making public, and that decision should be conscious instead of reflexive. The people who get hurt by social media privacy failures are the ones who didn’t realize what they were revealing.
| Post | What it can reveal |
|---|---|
| Any photo | GPS coordinates, time taken, device, location, companions and routines. |
| Birthday countdown | Your date of birth, a security answer for many accounts. |
| Restaurant check-in | A pattern in your routine. |
| Real-time vacation photo | That your house is empty. |
| Photo of a new car | Your location, financial status and possibly your license plate. |
| Child’s first day of school | Their name, age, school and arrival time. |
| Complaint about your boss | Your employer, your dissatisfaction and details that could affect your job. |
Authors have an extra reason to be careful. Don’t let readers connect with you on your personal LinkedIn or Facebook account. Have them follow your page. Personal accounts give away private information you don’t need to give, and some readers turn hostile. With fiction it’s essential, because fiction readers sometimes include stalkers and weird people. A writer friend of mine found that out. She got stalked by the weirdest people.
Children’s social media activity deserves particular attention. Every photo they post, every game they play, every app they download creates a permanent digital record. Colleges and employers routinely search social media profiles during application processes. That embarrassing photo from a teenager’s party could cost them a scholarship. That angry comment posted during a bad day could affect job prospects years later. Children’s digital footprints follow them forever, and most kids don’t think in those terms. That’s the parents’ job.
This is the paragraph I’d want every parent to read twice. A kid can’t weigh a permanent record against a funny photo, and the platforms are happy to let them try.
What’s Changing
Regulation is shifting. The General Data Protection Regulation (GDPR) in the European Union imposed stringent rules on how companies can use and store personal data.
The rules center on user consent and rights. Similar regulations have followed in other jurisdictions. These policies are forcing platforms to be more transparent about data collection and to give users more control over their information.
Technical protections are improving too. End-to-end encryption, disappearing messages, and better permission controls are becoming standard features instead of premium add-ons. (More on where that encryption came from) Platforms are responding to user demand for better privacy tools, though the pace of change rarely matches the pace of the threats.
Despite these improvements, the tension remains: social media’s business model is built on collecting and monetizing user data. The platforms have a financial incentive to collect as much information as possible, and users have a personal incentive to protect it. That tension won’t resolve itself. It requires users who understand what’s at stake and make informed decisions about what they share, where they share it, and which platforms they trust with their data.
My take
Privacy settings won’t save you, because the business model runs on collecting your data. The platforms profit from every photo and heart reaction, and regulation moves slower than the threats. Assume somebody will store, sell or leak every post. Before you share, picture a stranger piecing it together with everything else you’ve posted. If that picture bothers you, keep it off the platform.
The Ongoing Practice
Digital security is an ongoing practice. Platforms change their privacy settings. New features introduce new data collection methods. Threats evolve. The privacy settings you configured two years ago may not reflect the current state of the platform. Routinely revisiting your privacy settings, staying informed about policy changes, and maintaining strong authentication practices are the minimum requirements for anyone who uses social media. For a full approach to digital security that covers both social media and your entire family’s online presence, the Family Cybersecurity provides the complete structure.
The digital world isn’t going to become less connected, and the platforms aren’t going to start protecting you out of kindness. After decades of watching people hand over their lives one post at a time, I’ve lost patience with companies that call this a fair trade. Protect yours deliberately, because nobody on the other end of that data is going to do it for you.
Your data has value to platforms because somebody decided your attention was a resource. Sins of the Internet is my book about what the platforms did to us.
Frequently Asked Questions
The book on this: Sins of the Internet is 168 pages on what the platforms take and what they do with it, written for people who never agreed to any of it.
- FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook, U.S. Federal Trade Commission
- Facebook data: Cambridge Analytica received data of nearly 87 million people, CBS News
- FTC Sues Cambridge Analytica, Settles with Former CEO and App Developer, U.S. Federal Trade Commission
