Facebook Privacy, Locked Down Step by Step

Before you start: what Facebook actually holds

Facebook's privacy problem isn't one thing. It's a layered file built over years: every post you ever made, the audience you set when you made it, a shadow profile of your movements across much of the commercial web, an interest inventory assembled from your behaviour, and a list of third-party apps that still have a key to your account. Most people have never looked at any of it.

Understanding what social platforms collect and why is the foundation for everything that follows. The short version: Facebook's business model depends on knowing you well enough to sell advertisers precision targeting. The settings in this guide don't delete that business model, but they do reduce what's visible to strangers, limit what flows to advertisers, and stop the historical record from being quite so exposed.

Work through this with Facebook open, either in a browser or the app. The path descriptions here go to settings-screen level, but Facebook moves menus regularly, so treat them as landmarks rather than guaranteed turn-by-turn directions. On desktop, most of what follows lives under the downward arrow or your profile picture in the top right, then Settings and privacy, then Settings. On the app, tap the three horizontal lines (the menu icon), scroll to Settings and privacy, and go from there.

The ten-minute version: five settings that do most of the work

If you do nothing else today, do these five. They address the highest-exposure defaults and take under ten minutes combined.

• Set your future post audience to Friends (or Friends except acquaintances) rather than Public.
• Use the Limit Past Posts tool to switch all your old public posts to Friends in one step.
• Turn off search engine indexing so your profile doesn't appear in Google results.
• Enable tag review so no photo or post can tag you without your approval.
• Open Off-Facebook Activity, clear your history, and disconnect future activity from your account.

Each of these is explained in full below, with the social cost and the exact path. The rest of the guide covers everything else worth doing, but those five are where the biggest gaps are for most people.

Audience defaults, and fixing years of old public posts in one step

Who sees what you post from now on

Facebook's default audience for new posts has varied over the years and by account age, but many accounts still have it set to Public or Friends of Friends. Public means anyone on the internet, logged in or not. Friends of Friends can mean thousands of people you've never met, depending on how many mutual connections you have.

To change it: go to Settings, then Privacy, then Your activity. The first option is Who can see your future posts? Set this to Friends. If you want to be more selective, Facebook also lets you exclude specific people or use a custom list, which is useful if you have colleagues or distant acquaintances in your friends list you'd rather not share everything with.

The social cost here is essentially zero. Your friends still see everything. The only people who lose access are strangers, which is almost certainly what you want.

The one-click fix for years of old posts

This is the setting most people don't know exists. Everything you ever posted publicly, every check-in, every photo caption from 2011, is still out there with whatever audience you set at the time. Changing the future default doesn't touch any of it.

Facebook provides a bulk tool called Limit Past Posts. It's in the same Privacy section, a few options below the future posts setting. Tap or click it, confirm, and Facebook switches every previously public or Friends of Friends post to Friends. It's a one-way action: Facebook warns you that you can't undo it in bulk, though you can go back and change individual posts later if you need to.

For most people this is a clear win. The only reason to hesitate is if you've deliberately kept some posts public, perhaps professional announcements or public-interest content, in which case you'd want to adjust those individually afterwards.

Practical note: this tool doesn't affect posts other people made that you're tagged in. That's handled separately under tag review, covered below.

Your profile fields, friend list and search engine visibility

Profile fields: the information people see before they're even your friend

Your Facebook profile can contain your employer, hometown, current city, relationship status, phone number, email address, birthday and more. The default visibility on many of these fields is either Public or Friends of Friends. That means someone who has never met you can, depending on your settings, see where you work and roughly where you live just by visiting your profile.

Go to your profile page and click or tap Edit profile. Each field has its own audience control, usually a small icon or dropdown next to it. Work through them one by one. For most people, the sensible defaults are:

• Phone number and email: Only me, or remove them entirely if you added them years ago and no longer need them there.
• Birthday: Friends for the day and month (people like to wish you happy birthday), but Only me for the year. Your birth year is a useful piece of identity information.
• Workplace and education: your call, but worth asking whether you want this visible to strangers.
• Current city: Friends at most.

Who can see your friends list

Your friends list is more sensitive than it looks. It tells anyone who can see it who you're connected to, which can reveal family members, colleagues, or associations you'd rather keep private. It can also be used in social engineering: someone targeting you might approach a mutual friend as a way in.

Go to your profile, tap Friends, then the pencil or edit icon, and set the audience to Friends or Only me. Note that even if you hide your list, mutual friends are still visible on both profiles, so this isn't a complete solution, but it does remove the ability to browse your full network.

Search engine indexing

By default, Facebook allows search engines like Google to index your profile. This means your name, profile picture and some public information can appear in Google search results even for people who aren't on Facebook.

To turn this off: Settings, then Privacy, then scroll to Do you want search engines outside of Facebook to link to your profile? Switch it off. It can take some time for existing cached results to drop out of search engines, but no new indexing will happen.

The social cost is minimal. People who know you and are already on Facebook can still find you by searching within Facebook. This setting only affects external search engines.

Facebook's off-Facebook activity feed can contain data from thousands of businesses you've never consciously interacted with, built from tracking pixels and data-sharing deals that run quietly in the background of ordinary web browsing.

Tag review and timeline review: approving what lands on you

Tag review

When someone tags you in a photo or post, Facebook's default behaviour is to add that tag immediately, which means it can appear in your friends' feeds before you've even seen it. The photo might be unflattering. The post might be something you'd rather not be associated with. The tag might include location information.

Tag review lets you approve or reject tags before they go live. Go to Settings, then Profile and tagging. Look for Review tags people add to your posts before the tags appear on Facebook? and switch it on. Also look for the option to review tags before they appear on your timeline specifically.

The social cost is low. The person who tagged you can still see the tag on their own post. You're only controlling whether it appears on your profile and in your friends' feeds. Most people who tag you in something reasonable won't notice any difference.

Timeline review

Separate from tag review, timeline review controls whether posts that other people tag you in appear on your own timeline automatically. Enable it in the same Profile and tagging section: Review posts you're tagged in before the post appears on your timeline.

With both of these on, you have approval over what appears on your own profile. You can still be tagged, and the original post still exists on the other person's profile, but your timeline stays yours.

One more thing worth checking in this section: Who can post on your timeline? Setting this to Friends or even Only me stops people from writing directly on your profile wall, which is a much less common feature than it used to be but still worth locking down.

Off-Facebook activity: seeing it, clearing it, cutting the feed

This is the setting most people find genuinely surprising when they first open it. Off-Facebook Activity is Facebook's name for the data it receives about your behaviour on other websites and apps, sent back to Facebook via tracking pixels, the Facebook Login button, and data-sharing arrangements with thousands of businesses.

To understand the mechanics of how this tracking works across the web, the guide to how companies track you online covers the technical detail. For Facebook specifically: when you visit a website that has a Facebook pixel installed, that site sends a signal to Facebook confirming your visit, even if you never clicked anything Facebook-related. Facebook then links that signal to your account if you're logged in, or to a shadow profile if you're not.

To find it: Settings, then Your Facebook information, then Off-Facebook activity. What you see there is a partial log of businesses and apps that have sent data about you. Partial because Facebook doesn't show everything, but even the partial view tends to be extensive.

Clearing the history

You can clear your off-Facebook activity history. This disconnects the previously collected data from your account, meaning Facebook can no longer use it to target ads at you or build your interest profile from it. The data isn't deleted from Facebook's servers entirely, but it's disassociated from your identity.

Tap Clear history or Clear previous activity. Do it. It takes a few seconds.

Disconnecting future activity

Clearing the history only addresses the past. To stop future off-Facebook activity being linked to your account, look for Manage future activity or Future off-Facebook activity and turn it off. Facebook will still receive the signals from third-party sites (it can't stop that without those sites removing the pixel), but it won't link them to your account going forward.

The trade-off is real but manageable. Some Facebook features that rely on this data, like certain personalised recommendations, will become less relevant. You may also be logged out of sites where you used Facebook Login, which is worth knowing before you tap the button.

Ads: the interest file Facebook built and how to prune it

Facebook's ad targeting is built on two things: what you do on Facebook itself, and what it learns about you from off-Facebook activity. You've already addressed the second. Now for the first.

Go to Settings, then Ads. There are several subsections worth working through.

Ad preferences and your interest categories

Ad interests shows you the categories Facebook has assigned to you based on your activity: pages you've liked, content you've engaged with, things you've searched for. The list can be long and occasionally bizarre. You can remove individual interests by clicking the X next to each one. Removing them doesn't stop ads, but it does reduce the precision of targeting and, more practically, it tells you something about what Facebook thinks it knows about you.

Advertisers and businesses

There's a section showing advertisers who have uploaded a contact list that included you, meaning a business had your email address or phone number, uploaded it to Facebook, and Facebook matched it to your account. You can't opt out of this entirely within Facebook's current settings, but you can see it happening, which is useful information. The ICO's guidance on social media and your rights is worth reading if you want to understand your options under UK GDPR, including the right to object to certain types of processing.

Ad settings

Within the Ads section, look for controls over whether Facebook uses your relationship status, employer or other profile data to target ads at you. Turn off whatever you're comfortable removing. Also look for the setting controlling whether Facebook can use your social actions (likes, shares) in ads shown to your friends. Most people find this one worth switching off.

Apps and websites still holding a key to your account

Every time you've used Continue with Facebook to log into another service, you've given that app or website access to some part of your Facebook account. The level of access varies: some apps only needed your name and email, others requested permission to post on your behalf or read your friends list.

Go to Settings, then Apps and websites. You'll see a list of active, expired and removed connections. Active ones still have access. Expired ones have lapsed but are still listed. Removed ones you've already revoked.

Work through the active list. For each app, you can see what permissions it has and when it last accessed your account. Apps you haven't used in a year or more are worth removing entirely. Apps you still use are worth reviewing: do they need all the permissions they've been granted? Some will have requested broad access during a login flow years ago, and you can often narrow what they can see without losing the ability to log in.

To remove an app, tick the box next to it and select Remove. Facebook gives you the option to also delete posts or activity that app created on your behalf, which is worth doing if the option appears.

This matters beyond Facebook. If any of those apps have been compromised in a data breach, or if the app itself has poor security practices, the connection to your Facebook account is a potential route in. Revoking unused access is basic hygiene, not paranoia.

• Open Apps and websites in Settings and review every active connection.
• Remove any app you haven't used in the past twelve months.
• For apps you keep, check whether the permissions they hold are proportionate to what the app actually does.
• Delete any posts or activity those apps created on your behalf when Facebook offers the option.

The decision nobody makes: legacy contact, memorialisation and the re-check rhythm

What happens to your account when you die

This is the setting almost no one has touched, and it's genuinely worth five minutes of your time. Facebook accounts don't disappear when someone dies. By default, they stay active until someone reports the death, at which point Facebook can memorialise the account, turning it into a place where friends can leave messages. Without any instruction from you, Facebook makes decisions about your account on your behalf.

Facebook gives you two options. You can designate a legacy contact: someone you trust who can manage certain aspects of your memorialised account, including pinning a tribute post, responding to new friend requests, and updating your profile picture. They can't log in as you or read your messages, but they have limited stewardship.

Alternatively, you can request that your account be permanently deleted after your death rather than memorialised. If you'd rather your account simply disappear, this is the option to choose.

Find it under Settings, then General, then Memorialisation settings, or search for it in the settings search bar. It takes two minutes. It's the kind of thing that's easy to defer indefinitely and genuinely worth not deferring.

The Privacy Checkup: useful starting point, limited finish line

Facebook's own Privacy Checkup tool (find it under Settings and privacy) walks you through a guided review of key settings. It's a reasonable starting point and worth doing if you've never touched your settings before. Its limit is that it covers a curated subset of settings, framed in Facebook's own language, and it doesn't cover off-Facebook activity, the apps list, or the ad interest file in any depth. Think of it as the introduction, not the whole course.

The re-check rhythm

Facebook updates its settings interface and introduces new features, which sometimes means new defaults you haven't opted into. A quarterly check of the key areas takes about fifteen minutes and catches most of what changes. The areas most likely to have shifted are ad preferences, off-Facebook activity, and any new features Facebook has launched with permissive defaults.

The ICO publishes guidance on your rights under UK GDPR in relation to social media, including the right to access the data Facebook holds about you and the right to object to certain processing. The ICO's social media guidance is the place to start if you want to go further than settings and exercise formal data rights.

One last thing. None of these settings changes your password or improves your account security directly. A strong, unique password and two-factor authentication are separate from privacy settings but equally important. If you haven't enabled two-factor authentication on Facebook, that's worth doing immediately after this, under Settings, then Security and login. A password manager (the category of tool, not any specific product) makes unique passwords practical across all your accounts. That's a different guide, but consider it the companion piece to this one.

You've now got a genuinely tighter account. Not invisible, not impervious, but substantially more private than it was an hour ago. That's a reasonable outcome.