Instagram Privacy, Locked Down Step by Step

Before you start: why the defaults matter

Instagram is free because you are, in a meaningful sense, the product. The app is built to collect as much signal about you as possible, share it across Meta's family of services, and use it to show you advertising. That's not a conspiracy theory, it's the business model, and Meta describes it in their own privacy policy. Understanding what social platforms collect about you is the foundation for everything that follows here.

None of the changes below will make Instagram stop being an ad-funded platform. What they will do is reduce how much of your life bleeds out beyond what you've consciously chosen to share. That's a reasonable thing to want.

A standing caveat before we go further: Meta moves these menus. The paths described below were accurate at the time of writing, but Instagram updates its app regularly and settings screens shift. If a menu isn't where this guide says it is, look one level up or search within the Settings screen. The setting almost certainly still exists.

The ten-minute version: five settings that do most of the work

If you only have ten minutes, these are the five changes that carry the most weight. Work through them now, then come back for the full sweep when you have more time.

• Switch to a private account: go to your profile, tap the three lines (top right), Settings and privacy, Account privacy, then toggle Private account on.
• Turn off activity status: Settings and privacy, Messages and story replies, Show activity status, toggle off.
• Turn off off-app activity tracking: go to Accounts Centre (inside Settings and privacy), Your information and permissions, Your activity off Meta technologies, then Disconnect future activity for Instagram.
• Review connected third-party apps: Accounts Centre, Your information and permissions, Apps and websites, then remove anything you don't recognise or no longer use.
• Turn off contact syncing: Settings and privacy, Account, Contacts syncing, toggle off, then tap Manage contacts to delete contacts already uploaded.

Done those? Good. The rest of this guide fills in the detail and covers the settings that matter slightly less but are still worth your attention.

Private account: what it does and does not gate

Switching to a private account is the single most visible change you can make. When your account is private, only people you've approved as followers can see your posts, your reels, and your stories. Anyone else who finds your profile sees your name, your profile photo, and your follower counts. That's it.

What it costs socially is real. If you use Instagram to reach people you don't already know, such as promoting a small business, sharing a hobby publicly, or building any kind of audience, a private account works against that. Be honest with yourself about whether that applies to you. For most people who use Instagram to stay in touch with friends and family, private is the right call.

What private does not do is worth understanding clearly. It does not stop Meta from seeing your content and your behaviour. Instagram still knows every post you like, every account you visit, every second you spend watching a particular reel. The private setting gates other users, not the platform itself. It also doesn't protect you if a follower you've approved screenshots your content and shares it elsewhere. Approved followers can still do that.

There's also the follower model to consider. When you go private, you'll probably want to audit your existing followers. Anyone already following you before you switched stays approved. Go to your profile, tap Followers, and remove anyone you don't actually want there. You can remove a follower without blocking them by tapping the three dots next to their name.

Takeaway: Go private unless you have a specific reason not to, and audit your existing follower list while you're there.

Activity status, stories and reels: shrinking the broadcast

Activity status

By default, Instagram tells people you message that you're currently active, or shows how long ago you were last online. This is the kind of low-level surveillance that most people don't think about until it causes a problem. A controlling ex, a persistent acquaintance, an employer who follows you. The reasons to turn it off are varied, but there's no meaningful cost to doing so. You lose the ability to see other people's activity status in return, which is a fair trade.

Path: Settings and privacy, Messages and story replies, Show activity status.

Story sharing

By default, anyone who can see your stories can share them as a direct message to someone else. If you'd rather your stories stayed within the people who see them, you can turn this off. Path: Settings and privacy, Messages and story replies, Sharing and reminders, Allow sharing to messages.

You can also control who can reply to your stories at all. Options are everyone, people you follow, or off entirely. For most people, limiting replies to people you follow is a reasonable middle ground that cuts out unsolicited messages from strangers without killing the social interaction entirely.

Reels sharing

Reels have their own sharing controls. If your account is private, reels you post should already be restricted to your followers, but it's worth checking that reels sharing to Stories and to external platforms is set the way you want. Path: Settings and privacy, Content preferences, and look at the sharing options under Reels.

Instagram's activity status tells other users when you were last online, and it's turned on by default. There's no meaningful cost to switching it off, and doing so removes a small but real way your presence is broadcast to people you may not want watching.

Takeaway: Turn off activity status now. Then set story replies to people you follow, and decide whether you're comfortable with stories being forwardable as messages.

Messages, tags and mentions: controlling what reaches you

Message requests

If someone you don't follow tries to send you a direct message, it arrives as a message request rather than landing directly in your inbox. That's already a reasonable default. But you can go further. Under Settings and privacy, Privacy, Messages, you can control who can send you message requests at all. The options are broadly: everyone, people with mutual followers, or people you follow. Tightening this to people you follow stops cold-contact messages from strangers reaching you even as requests.

The cost: you might miss a message from someone you know in real life who happens not to follow you yet. Whether that matters depends on how you use the app.

Tags and mentions

By default, anyone can tag you in a photo or video, and that tag appears on your profile. Anyone can also mention you in a comment or caption, which can surface your username to an audience you didn't choose. Both of these are worth tightening.

For tags: Settings and privacy, Privacy, Tags, then set who can tag you to people you follow, or switch on manual tag review so you approve tags before they appear on your profile. The manual review option is the more protective of the two.

For mentions: Settings and privacy, Privacy, Mentions, and set this to people you follow or no one, depending on your preference.

Neither of these changes stops someone tagging or mentioning you. They just stop those tags and mentions from having any visible effect without your approval. That's a useful distinction.

Takeaway: Enable manual tag review and restrict mentions to people you follow. It takes two minutes and removes a route by which strangers can attach themselves to your profile.

The Accounts Centre underneath: ads, off-app activity and your data file

This is the layer most people never find, and it's where some of the most significant data controls live. Accounts Centre is Meta's unified settings hub across Instagram, Facebook, and (to a degree) Threads. You reach it from Instagram's Settings and privacy screen, at the bottom, under Accounts Centre.

Ad topics and ad preferences

Inside Accounts Centre, go to Ad preferences. You'll find a list of interest categories Meta has inferred about you and a control for ad topics. You can mark certain topics as things you'd rather not see ads about, such as alcohol, parenting, or gambling. This doesn't reduce the number of ads you see. It doesn't stop Meta from profiling you. What it does is give you some influence over the surface of what you're shown. Limited, but real.

You can also see which advertisers have uploaded your contact details to target you directly. That list can be instructive.

Off-app activity (formerly Off-Facebook Activity)

This is one of the most important controls in the whole Accounts Centre, and it's genuinely underused. When you visit other websites and apps, many of them send data back to Meta about what you did there, because they use Meta's tracking tools (the Meta Pixel, for example). By default, Meta connects that browsing history to your Instagram profile and uses it to refine your ad targeting.

The mechanics of how companies track you across the web go deeper than a single settings change can fix, but disconnecting your off-app activity is a meaningful step. Path: Accounts Centre, Your information and permissions, Your activity off Meta technologies. You can view the history of what's been sent, clear it, and, crucially, toggle off future activity being connected to your account.

Note that disconnecting future activity doesn't stop websites from sending data to Meta. It stops Meta from attaching that data to your profile. There's a difference, but it's still worth doing.

The ICO's UK GDPR guidance makes clear that UK users have rights around how their data is used for profiling and advertising. If you want to go further than the in-app controls allow, the ICO's website explains how to exercise those rights formally.

Downloading your data

You have a right under UK GDPR to see what Instagram holds about you. Accounts Centre, Your information and permissions, Download your information. Request a copy and Meta will prepare a file, usually within a few days, that includes your posts, messages, search history, ad interests, and a great deal more. It's worth doing once, just to see the shape of it.

Takeaway: Go to Accounts Centre and disconnect future off-app activity from your profile. Then, when you have twenty minutes, request a copy of your data and have a look at what's there.

Third-party apps and contact syncing (and undoing old syncs)

Third-party app access

At some point you've probably used your Instagram account to log in to another app or website. Each time you do that, you grant that third party some level of access to your Instagram data. Over time, these permissions accumulate and most people forget they exist.

Path: Accounts Centre, Your information and permissions, Apps and websites. You'll see a list of everything that currently has access. For each one, you can see what permissions were granted and remove access entirely. Be methodical here. Old apps you no longer use should go. Apps you don't recognise should definitely go.

Removing access doesn't delete data those apps already collected. But it stops any further data flowing to them, which is the part you can control now.

Contact syncing

Instagram asks, at various points, whether it can access your phone's contacts. If you ever said yes, it uploaded your entire contact list to Meta's servers. This is used to suggest people you might know and to build what researchers call a shadow profile of people who aren't even on Instagram, because their phone number appears in the contacts of people who are.

Turning off contact syncing going forward is straightforward: Settings and privacy, Account, Contacts syncing, toggle off. But the contacts already uploaded don't disappear automatically when you do that. You need to take a second step. On the same screen, tap Manage contacts, then Delete all. That sends a deletion request for the contacts already on Meta's servers.

It's also worth checking your phone's own permissions. On an iPhone, go to Settings, Privacy and Security, Contacts, and check whether Instagram is listed. On Android, go to Settings, Apps, Instagram, Permissions, Contacts. Revoking the permission at the operating system level means Instagram can't re-sync even if a future app update tries to prompt you again.

Takeaway: Turn off contact syncing, delete the contacts already uploaded, and revoke the contacts permission in your phone's settings. All three steps are needed for a complete job.

Location: in the app and in the photos themselves

Location access in the app

Instagram can request access to your device's precise location. The app uses this for features like location tags on posts and stories, and for local advertising. You almost certainly don't need to grant it precise location access for any feature you actually use.

The right place to manage this is your phone's settings, not Instagram's. On iPhone: Settings, Privacy and Security, Location Services, Instagram. Set this to Never, or at most While Using the App if you genuinely use location tags. On Android: Settings, Apps, Instagram, Permissions, Location. Precise location can be switched to approximate, or denied entirely.

Within Instagram itself, you can also just choose not to add location tags to your posts and stories. That sounds obvious, but it's worth saying: even if Instagram has location access, you don't have to use the tag feature. The two things are separate.

Location data embedded in photos

This is a less obvious one. Photos taken on a smartphone often contain EXIF metadata, which can include the precise GPS coordinates of where the photo was taken. Instagram strips most EXIF data when you upload a photo, so this is less of a risk on Instagram than it once was on email or other file-sharing contexts. But it's worth knowing the principle: if you ever share original photo files directly rather than through a platform that strips metadata, that location data travels with the image.

You can turn off location data in photos at the camera level. On iPhone: Settings, Privacy and Security, Location Services, Camera, set to Never. On Android, open the Camera app, go to its settings, and look for a location tag or geotagging option to disable.

Takeaway: Set Instagram's location permission to Never in your phone's settings. While you're there, turn off geotagging in your camera app so new photos don't carry location data at all.

Keeping it locked: the re-check rhythm

Here's the thing about Instagram privacy settings: they don't stay put. Meta updates the app regularly, introduces new features with new defaults, and occasionally restructures where settings live entirely. A lockdown you completed six months ago may have gaps today that didn't exist when you did it.

This isn't paranoia. It's just how the platform works. New features tend to launch with permissive defaults, because that serves Meta's interests. The burden is on users to notice and adjust.

A practical rhythm: set a reminder every three to four months to re-walk the key settings. It takes about fifteen minutes once you know where things are. Pay particular attention after any Instagram update that prompts you to review something or introduces a new feature, because those moments often come with freshly reset or newly added settings.

The ICO periodically publishes updated guidance on social media and data rights for UK users. Checking ico.org.uk occasionally is a reasonable habit, not because you need to become an expert in data law, but because the regulator sometimes flags when a platform's practices have changed in ways that affect your rights.

The Electronic Frontier Foundation's privacy resources and Mozilla's *Privacy Not Included project are also worth bookmarking for broader context on how platforms handle data, even if their focus isn't always UK-specific.

Finally: the settings in this guide reduce your exposure, but they don't eliminate it. Instagram is still an ad-funded platform that profits from knowing things about you. If that's a fundamental concern, the honest answer is that no combination of settings fully resolves it. What the settings do is push the dial meaningfully in your direction. That's a worthwhile thing to do, and you've now done it.

Takeaway: Set a recurring reminder to re-check these settings every three to four months. Treat any Instagram update that asks you to review something as a prompt to do the full walk-through again.