Your Data on Social Media: What Each Platform Collects and How to Take Control

The deal you actually signed: free apps, paid with data

There's a line that gets repeated so often it's almost lost its meaning: if you're not paying for the product, you are the product. It's a cliché, but it's also a reasonably accurate description of the business model behind every major social platform. Meta, TikTok, X, Snapchat, LinkedIn. None of them charge you a subscription. All of them generate revenue primarily by selling advertisers the ability to reach you, specifically you, based on what they know about you.

What they know turns out to be quite a lot.

When you signed up, you agreed to a privacy policy. Almost nobody reads those policies in full, which is understandable because they're long, written in legal language, and deliberately difficult to skim. But under UK GDPR, you have rights that exist regardless of what you clicked. You can request your data, correct inaccuracies, and in some circumstances ask for it to be deleted. The Information Commissioner's Office is the UK's data protection regulator, and it publishes guidance on exercising those rights. Knowing they exist is the first step.

This piece goes platform by platform. It explains what each one collects, how it uses that data to target advertising, how to download your own file, and which settings reduce your exposure the most. You don't need to be technical. You just need about ten minutes per platform.

Practical takeaway: Before you adjust any settings, it helps to know what you've already shared. Keep reading, then decide which platform to start with.

Meta (Facebook and Instagram): the deepest file on you

Meta operates Facebook and Instagram as a single data ecosystem. Your activity on one platform feeds the other, and both feed Meta's advertising machine. The scope of what Meta collects is wider than most people expect.

On the app itself, Meta logs every post you write (including drafts you never sent), every photo you upload, every reaction, comment, share and search. It records which posts you paused on while scrolling, how long you spent looking at a particular piece of content, and whether you watched a video to the end or skipped it. Your friend list, your group memberships, the events you said you were attending, the Marketplace listings you looked at. All of it.

Beyond your direct actions, Meta collects device information: the model of your phone, your operating system, your battery level, your screen resolution, your IP address, and often a precise GPS location if you've allowed it. It also collects data about other apps on your device, depending on your operating system settings.

Then there's the off-app data, which we'll cover in more detail later. Meta's tracking pixel is embedded on an enormous number of third-party websites and apps. When you visit a site that carries the pixel, Meta receives a signal even if you never opened Facebook that day.

What does Meta do with all of this? It builds an interest profile. You can actually see a version of it. On Facebook, go to Settings, then "Your Facebook information", then "Ad preferences". You'll find a list of categories Meta believes describe you, from broad interests to inferred life events. Some will be accurate. Some will be oddly specific. A few might be wrong, which is its own kind of unsettling.

Meta also uses what researchers describe as "lookalike" targeting: advertisers upload their own customer lists, and Meta finds users who resemble those customers based on behavioural patterns. You don't have to have interacted with that advertiser at all.

To understand more about how this data eventually reaches advertisers and data brokers, the piece on how your data is collected and sold goes into the mechanics in detail.

Five highest-impact Meta settings:

1. Turn off "Ads based on data from partners" (Facebook: Settings, Ads, Ad settings). This limits Meta's use of off-app data for targeting.
2. Disconnect apps and websites via "Off-Facebook activity" (Settings, Your Facebook information). You can clear the history and turn off future collection.
3. Review location permissions on your phone's operating system. Set Facebook and Instagram to "Only while using" or "Never".
4. Turn off face recognition if it's still active on your account (some accounts still have legacy settings).
5. Limit who can see your friends list, your past posts, and your profile details to Friends rather than Public.

Full step-by-step lockdown guides for Facebook and Instagram are coming to Vivid Zero shortly.

Practical takeaway: Visit Ad preferences on Facebook today. Seeing your inferred interest categories takes two minutes and tells you more about what Meta knows than any privacy policy will.

TikTok: what it collects and what it infers

TikTok has attracted more regulatory scrutiny than almost any other platform in recent years, partly because of its ownership by ByteDance, a Chinese company, and questions about where data is stored and who can access it. The UK's ICO has examined TikTok's data practices, and in 2023 the platform was fined for misusing children's data. But even setting geopolitical concerns aside, TikTok's data collection is extensive in ways that are worth understanding on their own terms.

TikTok collects the obvious things: your profile information, your videos, your comments, your messages. It also collects your device identifiers, your IP address, and, on some devices, clipboard content (text you've copied). It tracks which videos you watch, how long you watch them, whether you replay them, and what you search for.

The inference layer is where TikTok's model becomes particularly interesting. The algorithm doesn't just record your stated preferences. It infers them from behaviour. If you consistently watch videos about a particular health condition, financial situation, or political viewpoint, TikTok builds a picture of you that you never explicitly created. Researchers have documented that TikTok's inferences can include sensitive categories: health, religion, political views. Under UK GDPR, sensitive personal data is supposed to receive stronger protections. Whether those protections are consistently applied is a matter of ongoing regulatory attention.

TikTok also collects data off the app via its own tracking tools embedded in third-party websites, similar to Meta's pixel.

Five highest-impact TikTok settings:

1. Turn off personalised ads (Settings, Privacy, Ads). This limits interest-based targeting.
2. Disable "Suggest your account to others" under Privacy settings to reduce profile discoverability.
3. Set your account to private if you're not using TikTok for public reach.
4. Review location permissions on your device and set to "Never" unless you actively use location features.
5. Turn off syncing contacts and Facebook friends under Settings, Privacy, to limit the social graph TikTok builds around you.

A full TikTok privacy guide is coming to Vivid Zero. In the meantime, TikTok's own privacy policy sets out what it collects, and the ICO's website covers your rights if you want to make a subject access request.

Practical takeaway: Check TikTok's ad settings today. The personalised ads toggle is in Privacy and takes about thirty seconds to switch off.

X, Snapchat and LinkedIn: the ones people forget

These three platforms tend to get less attention in privacy conversations. They shouldn't.

X (formerly Twitter)

X collects your posts, likes, follows, and direct messages. It also infers interests from your activity and uses those inferences for ad targeting. Since Elon Musk's acquisition of the platform in 2022, X's privacy practices have shifted in ways that are still being assessed by regulators. The platform's privacy policy permits it to collect location data, device information, and browsing history via its tracking tools on other sites.

One thing many X users don't realise: even if your account is protected (private), X still collects your behavioural data and uses it internally. Privacy from other users is not the same as privacy from the platform.

Five highest-impact X settings:

1. Turn off personalised ads (Settings, Privacy and safety, Ads preferences).
2. Disable "Allow additional information sharing with business partners" in the same menu.
3. Turn off location information in Privacy and safety settings.
4. Review connected apps (Settings, Security and account access, Apps and sessions) and revoke access to anything you no longer use.
5. Turn off discoverability via phone number and email in Privacy and safety to reduce how easily you can be found and cross-referenced.

Snapchat

Snapchat has a reputation for ephemerality: messages disappear. But the platform collects a significant amount of persistent data. It logs your location if you use Snap Map, your contacts if you allow it, your device identifiers, and your usage patterns. Snap's advertising platform uses this data to target ads, and like other platforms it uses off-app tracking tools.

Snap Map deserves particular attention. It can share your location with friends in near-real-time, which is a feature some users want and others have enabled without fully thinking through. The ICO has previously highlighted location data as among the most sensitive categories of personal information.

Five highest-impact Snapchat settings:

1. Set Snap Map to Ghost Mode (tap your avatar, then the Settings cog on Snap Map). This stops sharing your location with anyone.
2. Turn off ad personalisation (Settings, Privacy, Ads). Opt out of interest-based ads and audience-based ads separately.
3. Disable contact syncing in Privacy settings.
4. Review who can contact you and who can view your stories. Default settings are often more open than users expect.
5. Turn off "Show me in Quick Add" to limit discoverability.

LinkedIn

LinkedIn is often thought of as a professional network, which leads people to assume it's somehow less invasive. It isn't. LinkedIn, owned by Microsoft, collects your employment history, education, skills, and endorsements. It also tracks your activity on the platform and, via its tracking tools, your activity on third-party websites. It uses all of this for advertising targeting, including targeted ads sold to recruiters and to businesses.

LinkedIn also has a feature called "Insights Tag" that functions similarly to Meta's pixel: it allows companies to track visitors to their websites and connect that behaviour back to LinkedIn profiles for retargeting purposes. If you've ever visited a company's website and then seen an ad from that company on LinkedIn, that's the mechanism.

Five highest-impact LinkedIn settings:

1. Turn off "Data for ads" (Settings, Data privacy, Data for ads). This limits third-party data being used to target you.
2. Opt out of "Profile data for third-party research" in the same section.
3. Review who can see your connections (Settings, Visibility). Your network is valuable data.
4. Turn off activity broadcasts if you don't want your network notified when you update your profile.
5. Check which third-party apps have access to your LinkedIn account (Settings, Data privacy, Other applications).

Full guides for X, Snapchat and LinkedIn are in development at Vivid Zero.

Practical takeaway: Pick whichever of these three platforms you use most and spend five minutes in its Privacy settings today. The ad personalisation toggle alone is worth finding.

Off-app tracking: how platforms follow you around the web

This is the part that surprises people most. You log out of Instagram. You close the app. You go and browse a recipe website, read the news, look at a sofa on a furniture retailer's site. Instagram may still be receiving data about that browsing session.

How? Through tracking tools embedded in third-party websites. Meta's is called the Meta Pixel. TikTok has its Pixel. LinkedIn has its Insights Tag. X has its own equivalent. These are small pieces of code that website owners install to measure the effectiveness of their advertising. When you visit a site that carries one of these tools, it sends a signal back to the platform: this device, at this time, visited this page.

The platform then associates that signal with your account (if you're logged in, or if your device can be identified through fingerprinting techniques). Your profile gets richer. The advertising targeting gets more precise.

There are things that reduce this. Browser-level tracking protection, which Firefox and Safari have enabled by default in recent years, blocks some of these signals. A browser extension designed to block trackers can block more. Using a separate browser for social media, one that you don't use for general browsing, creates a degree of separation. None of these approaches is perfect, but they meaningfully reduce the data flowing back to platforms.

For a deeper look at how these tracking mechanisms work technically, including pixels, fingerprinting, and cookie syncing, the piece on how companies track you online covers the mechanics without requiring a technical background.

Practical takeaway: Check your browser's privacy settings. If you're using Chrome with default settings, consider whether Firefox or Safari's built-in tracker blocking would suit you. You don't need a specialist tool to get started.

Download your data: see your own file in 10 minutes

Under UK GDPR, every major platform operating in the UK is required to let you download a copy of the personal data it holds about you. This is called a Subject Access Request, or SAR. Most platforms have made this available as a self-service download rather than a formal request process, which means you can do it right now, from the app or the website.

Here's where to find it on each platform:

The files usually arrive within 24 to 48 hours, sometimes faster. They come as a zip archive containing HTML or JSON files. You don't need to understand JSON to get value from this. Start with the HTML files, which are readable in any browser. Look for the ad interests or inferences section first. That's where you'll find the clearest picture of how the platform has categorised you.

What you find might be mundane. It might be startling. Either way, it's information you're entitled to, and seeing it tends to make abstract privacy concerns feel concrete and manageable.

If you want to go further than a self-service download, the ICO's guidance on your right to get copies of your data explains the formal SAR process and what to do if a platform doesn't respond properly.

Practical takeaway: Request your data from one platform today. Facebook or Instagram are good starting points because the files are relatively readable. It takes about two minutes to initiate the request.

The five settings that matter most on every platform

The settings menus on social platforms are long and often confusing by design. Buried options, double negatives, toggles that reset after app updates. It can feel like the friction is intentional. It probably is.

But across all platforms, five categories of setting consistently have the highest impact on your privacy. If you do nothing else, find these five on each platform you use.

1. Ad personalisation. Every major platform has a setting to limit interest-based advertising. Turning this off doesn't mean you'll see no ads. It means the ads won't be targeted using your behavioural profile. The ads become less relevant, which some people find preferable.
2. Off-platform data use. Look for settings labelled "Off-app activity", "Data from partners", or similar. These control whether the platform can use data collected about you from other websites and apps. Restricting this is one of the most meaningful things you can do.
3. Location access. Check your phone's operating system settings, not just the app's settings. Set each social app to "Only while using" at most. "Always" location access means the app can log your location even when it's running in the background.
4. Connected apps and third-party access. Over time, you may have logged into other services using your social account ("Log in with Facebook", "Connect with LinkedIn"). Each of those connections is a data-sharing relationship. Review them and revoke any you no longer use or recognise.
5. Profile visibility and discoverability. Who can find you via your phone number or email address? Who can see your friends or connections list? These settings affect not just your privacy but the privacy of the people connected to you. Tightening them is a form of collective care as much as personal protection.

One thing worth being clear about: changing these settings reduces what platforms collect and how they use it going forward. It doesn't erase what they've already collected. For that, you'd need to look at deletion requests, which are a separate process and covered by your UK GDPR rights. The ICO's guidance on the right to erasure explains when and how that applies.

Practical takeaway: Work through these five categories on your most-used platform this week. The whole process rarely takes more than fifteen minutes once you know what you're looking for.

A saner way to keep using social media

Nothing in this piece is an argument for deleting your accounts. Social media has genuine value. Staying in touch with people, finding communities, following news and culture. The goal here isn't to make you anxious about using it. It's to help you use it with a clearer sense of what's happening in the background.

A few habits that make a meaningful difference over time, without requiring much effort:

• Use a browser with tracking protection for general browsing. Firefox with its default Enhanced Tracking Protection, or Safari on Apple devices, both block a significant proportion of the tracking pixels and scripts that social platforms embed on third-party sites. This is passive protection that works without you thinking about it.
• Log out of social apps when you're not using them, or use a separate browser profile for social media. This reduces the ability of platforms to associate your general browsing with your social account.
• Be deliberate about permissions when apps update. App updates sometimes reset privacy settings or request new permissions. A quick check after a major update is a sensible habit.
• Review connected apps once or twice a year. It takes five minutes and removes data-sharing relationships you've forgotten about.
• Know your rights. You can request your data, correct inaccuracies, and in some circumstances ask for deletion. These aren't theoretical rights. The ICO's Your data matters pages explain them clearly and tell you how to complain if a platform doesn't respond properly.

The broader picture of how personal data flows from platforms to advertisers and data brokers is covered in the piece on how your data is collected and sold. Understanding that system, even at a high level, makes the individual settings feel less like arbitrary switches and more like meaningful choices.

Social media isn't going away. Neither is data collection. But the gap between the most exposed version of your social media use and a more considered version is smaller than it might seem, and most of it can be closed in an afternoon.

Practical takeaway: Pick one platform, spend fifteen minutes in its settings, and download your data file. That's it. You don't have to do everything at once. Starting somewhere is what matters.