How social media platforms use your data
When you post on Facebook, TikTok, Instagram, X (formerly Twitter), or any other social media platform, you are not just sharing with your friends — you are also giving that platform permission to collect, store, and use information about you. The platform tracks what you post, what you like, what you search for, how long you spend looking at each post, and often your location and device information too.
Platforms make money primarily through advertising. The more they know about you — your age, interests, what you buy, what you worry about, who your friends are — the more precisely they can show you ads and sell that targeting information to advertisers. This is why you see ads for things you searched for on Google, or why an ad appears for a product you mentioned to a friend near your phone. The platforms are not listening to your microphone (usually), but they are collecting enough data from your behaviour that they can predict what you want before you ask.
You do have some control over this. Every major platform has privacy settings that let you limit who sees your posts, restrict how your data is used for ads, and read a copy of the information they hold about you. These settings are often buried in menus and default to the most permissive option — the one that benefits the platform most.
Key Takeaways
- Social media platforms collect data about your posts, likes, searches, location, and device to build a profile used for targeted advertising.
- Your privacy settings default to sharing the most information; you need to actively change them to restrict who sees your posts and how your data is used.
- You can request a read of all data a platform holds about you, though the file is often large and difficult to read.
- Deleting a post does not delete the data the platform collected about it, and deactivating your account does not delete your data either.
- Third-party apps that connect to your social media account can access your friends list, posts, and sometimes email address unless you revoke permission.
What information platforms collect and keep
Social media platforms collect far more than what you voluntarily type. They record metadata — the time you posted, the device you used, your IP address (which reveals your approximate location), and whether you posted from home, work, or somewhere else. They track which posts you view but do not like, how long you pause on each image, and whether you click links in comments.
Platforms also collect information you do not directly provide. If you have a smartphone, they may access your contacts, calendar, and photos. If you use their login button to sign into other websites ("Sign in with Facebook" or "Sign in with Google"), those websites share data back to the platform. If you visit a website that has a Facebook pixel or Google Analytics code embedded in it, the platform knows you visited, even if you did not click anything.
This data is kept indefinitely. Even if you delete a post, the platform has already recorded that you posted it, when you posted it, and what engagement it received. Even if you deactivate your account, the data remains in their servers. Some platforms will delete your data after a certain period if you request it, but the default is permanent storage.
Privacy settings on major platforms
Each platform has different privacy controls, but they follow a similar pattern. On Facebook and Instagram, go to Settings and Privacy, then Privacy to control who can see your posts and send you messages. On TikTok, go to Me, then Settings and Privacy. On X, go to Settings and Privacy, then Privacy and Safety. On YouTube, go to Settings, then Privacy.
The most important settings are: who can see your posts (public, friends only, or private), who can message you, whether your profile appears in search results, and whether the platform can use your data for targeted ads. You cannot turn off targeted ads entirely on most platforms — you can only reduce how much data they use to target them. Facebook and Instagram offer a "Limit Ad Topics" option that lets you hide ads about certain categories, but the platform still collects the data.
Privacy settings change frequently as platforms update their interfaces. If you cannot find a setting described here, search the platform's help centre for the specific setting name, or look for a three-line menu icon (called a hamburger menu) that usually contains Settings.
Third-party apps and permissions
When you use a quiz, game, or other app that says "Sign in with Facebook" or "Connect your Instagram," you are giving that app permission to access your social media account. The app can see your friends list, your public posts, your email address, and sometimes your birthday and phone number — depending on what permissions you grant.
Many people grant these permissions without reading what the app is asking for. The app developer can then use that data for their own purposes: selling it to data brokers, using it to build a profile of you, or straightforward storing it insecurely where hackers can steal it. Some apps request far more access than they need — a straightforward game might ask for permission to post on your behalf, which it will never use.
You can revoke these permissions at any time. On Facebook, go to Settings and Apps and Websites, then remove any app you no longer use or do not trust. On Instagram, go to Settings, then Apps and Websites. On TikTok, go to Settings, then Apps and Websites. On X, go to Settings and Privacy, then Apps and Sessions. Revoking permission does not delete the data the app already collected, but it stops them from collecting more.
What happens when you delete your account
Deactivating your account (temporary) and deleting your account (permanent) are different things. Deactivation hides your profile and posts from public view, but the platform keeps all your data and can reactivate your account if you log back in. Deletion is supposed to be permanent, but it takes time — usually 30 days — for the platform to actually remove your data from their servers.
Even after deletion, some of your data may persist. Posts you made may have been shared, screenshot, or archived by other users or by third-party archiving services. Comments you left on other people's posts may remain visible. If you used your social media login to sign into other websites, those websites may still have data about you. If you participated in research studies or allowed the platform to share your data with researchers, that data may continue to exist in research databases.
Before you delete your account, read your data. Most platforms offer a "read Your Information" or "Data read" tool in Settings. This gives you a copy of your posts, photos, messages, and profile information. The file is usually in a format that is difficult to read without special software, but it proves what the platform collected about you.
How to protect yourself on social media
Start by reviewing your privacy settings on each platform you use. Set your posts to visible only to friends (or to a custom list if the platform offers it), turn off location tracking, and disable ad targeting based on your activity. None of these steps will stop the platform from collecting data, but they will reduce how much of that data is visible to strangers and how precisely you are targeted with ads.
Be cautious about what you post. Anything you share can be screenshot, shared, or archived. Avoid posting your full date of birth, phone number, address, or workplace — this information can be used for identity theft or to find you in person. Be aware that platforms use your posts to build a psychological profile of you, so consider whether you want them to know your political views, health concerns, or relationship status.
Limit the apps and websites you connect to your social media account. Only use "Sign in with Facebook" or similar features when necessary, and revoke access to apps you no longer use. Use a strong, unique password for your social media account — not the same password you use for email or banking — so that if one platform is hacked, your other accounts remain find.
Consider using a VPN (virtual private network) when you access social media on public WiFi. A VPN encrypts your connection so that the WiFi network owner cannot see what you are doing. This does not hide your activity from the social media platform itself, but it does protect you from hackers on the same network.
Understanding data brokers and data sales
Social media platforms do not always sell your data directly to advertisers. Instead, they often sell it to data brokers — companies whose only business is collecting and selling personal information. These brokers buy data from platforms, websites, retailers, and public records, then package it and sell it to advertisers, insurance companies, employers, and sometimes law enforcement.
You have limited control over this. You cannot opt out of data brokers the way you can adjust privacy settings on a social media platform. However, some data brokers allow you to request that they delete your information. The major ones include Experian, Equifax, TransUnion, Acxiom, and Epsilon. You can search "data broker opt out" plus your state name to find brokers operating in your area and their opt-out processes, though these vary widely and some brokers make the process deliberately difficult.
This is one reason why privacy advocates recommend sharing less on social media in the first place. The less you post, the less data exists for brokers to buy and sell.
Frequently Asked Questions
Can I stop social media platforms from collecting my data?
No. Platforms collect data as a condition of using their service. You can limit what data they collect (by adjusting privacy settings and not posting certain information), and you can limit how they use it (by opting out of ad targeting), but you cannot stop collection entirely without leaving the platform.
If I make my account private, can people still see my posts?
Only people you approve as friends can see your posts. However, the platform itself still sees everything you post, and so does anyone you message. If you send a private message to someone, that person can screenshot it and share it publicly.
What does it mean when an app asks for "permission to post on my behalf"?
It means the app can create posts, stories, or comments on your account without you typing them. Most apps that ask for this permission never actually use it. Revoke this permission unless you are certain you need it — for example, if you are using a scheduling tool to post at specific times.
Is it safe to use my social media login to sign into other websites?
It is convenient, but it means both the social media platform and the other website know you are using that account. If the other website is hacked, hackers may be able to access your social media account too. Use a unique password for each important account instead.
Do I need to delete my social media account to protect my privacy?
Not necessarily. If you adjust your privacy settings, limit what you post, and revoke permissions from apps you do not trust, you can reduce your exposure significantly. Deletion is an option if you decide the trade-offs are not worth it, but many people find a middle ground works for them.