💡 What this audit actually does — and what it can't
Privacy settings on social platforms control who among other users and advertisers can see your content. They have essentially no effect on what the platform itself collects. Facebook logs your click patterns, dwell time on each post, scroll behavior, and device identifiers regardless of what your audience setting is. Instagram knows which posts you paused on, which profiles you visited, and which ads you lingered over — whether your account is public or private.
This audit meaningfully reduces your exposure to other people, to third-party advertisers, and to casual researchers. It does not remove you from the platform's own data infrastructure. Those are two separate problems — this checklist addresses the first. The second requires different tools entirely.
🔍 The data ecosystem this checklist doesn't cover
Social media platforms are one source of public personal data. Data brokers — Spokeo, WhitePages, BeenVerified, Intelius, Radaris, PeopleFinder, and 200+ others — aggregate your data from public records, purchase history, voter rolls, property records, and scraped social profiles into searchable dossiers. Cleaning up your Facebook settings does nothing to the profile that already exists on these services.
Most brokers offer individual opt-out pages, but the process is deliberately tedious: each service requires a separate request, some require identity verification before they'll remove your identity, and profiles often reappear within 90 days as new public records are processed. Paid services like DeleteMe (~$129/year) or Kanary automate recurring opt-outs. Manual opt-out is possible — budget 3–5 hours to cover the highest-traffic brokers.
Start with the ones that surface most in name searches: Spokeo, WhitePages, BeenVerified, Intelius, and Radaris. Search your name and city on each, locate your listing, and find the opt-out link — typically buried in the site footer under "Privacy" or "Do Not Sell My Information."
⚠️ The privacy gap no setting can close
Your settings control what you share. They don't control what your contacts share about you. A friend posting a group photo, tagging your location, or publicly recounting a conversation that includes your name is entirely outside your control. This is sometimes called the mutual exposure problem: your effective privacy level is partly a function of how privacy-conscious the people in your network are.
The practical implication: a direct conversation with close contacts about what you're comfortable being tagged in or posted about addresses this gap better than any platform setting. It's an uncomfortable topic, but it's the only lever you have for the content others create about you.
📝 What platforms retain after you delete
Deletion removes content from public view, but internal retention is a different matter:
- Platform backup copies typically persist for 30–90 days post-deletion before being purged from servers
- Messages you sent exist in your recipients' accounts and cannot be deleted by you alone
- Legal holds can preserve data indefinitely if the account is connected to any ongoing investigation
- Aggregated behavioral data derived from your activity — patterns, preferences, behavioral signals — is typically anonymized and retained permanently as part of their model training and analytics infrastructure
📖 Priya's data broker surprise
Priya did a thorough social media audit before a sensitive background check for a government contracting role. Her accounts were locked down. Six weeks later she Googled herself and found her old address, current employer, estimated age, and a list of relatives on three separate people-search sites — none of it sourced from her social accounts. It came from public records, utility registrations, and voter rolls that data brokers aggregate independently. Her afternoon of platform privacy settings had addressed one ecosystem entirely; the data broker layer was untouched and required a completely separate set of opt-out requests.
🧮 Why privacy settings are designed to be difficult
Social platforms are advertising businesses. Their revenue depends on the richness of the behavioral profiles they build on users and the precision with which those profiles can be sold to advertisers. Privacy settings that restrict data sharing directly reduce that revenue — which creates a structural incentive to make those settings hard to find, easy to miss after updates, and defaulting to the permissive state after any change.
The FTC has settled enforcement actions against platforms specifically for "dark patterns" — interface designs that make privacy-protective options harder to reach or visually deemphasized compared to data-sharing options. This context explains two recurring frustrations: why the most impactful settings are always several layers deep in the menus, and why the same settings keep resetting to permissive defaults. You are working against the interface, not with it.
🔧 What to tackle next, after the audit
Data broker opt-outs
Begin with Spokeo, WhitePages, BeenVerified, Intelius, and Radaris — these appear in most name searches. Manual opt-outs take 3–5 hours total. Profiles may return within 90 days; rechecking quarterly is necessary.
Email breach exposure
Check haveibeenpwned.com for every email address you've linked to social accounts. A breached email is the most common entry point for account takeover — especially if you reused the password anywhere.
Browser-level tracking
Social login cookies and tracking pixels follow you across the web independent of your platform settings. Firefox with uBlock Origin blocks most cross-site tracking at the browser level — a complement to anything you've changed in your apps.
⏱ Realistic time investment per platform
One platform done thoroughly is more valuable than all platforms rushed. Complete one per day to avoid decision fatigue.
60–90 min
Facebook (most complex; data archive review adds time)
Add 1–2 hours per platform if you plan a detailed post-by-post review. The data archive download (24–72 hours to generate) should be requested before you begin any platform — so start those requests today even if you plan to do the full audit later this week.
