Nobody sets out to overshare. You joined a platform years ago, filled in the profile because it asked, posted a few hundred things, connected a couple of apps to save yourself a login, and then just lived your life. None of it felt like a decision. It accumulated.
Here is the good news: cleaning it up is one evening. Not a weekend, not a project. Make some coffee, get everybody’s phones on the table, and work through the list below together. You will be surprised what turns up, and the family members who roll their eyes at the start are usually the ones still poking at settings an hour later.
Start With the Audience Question
Every platform has an audience setting: who can see the things you post. It is usually set once, years ago, and then forgotten. Most people have no idea what it is currently set to, because the app rarely reminds them.
The Federal Trade Commission’s advice is refreshingly simple: go to your account settings to see how a service uses your information and adjust your settings to match your preferences. Look in the privacy or audience area of each app’s settings. Most major platforms now include a guided privacy review that walks you through the same questions in order.
- Check the default for new posts. This is the one that matters most going forward. Set it to friends, followers you approved, or whatever the narrow option is called.
- Then deal with the past. Several platforms offer a bulk option that narrows the audience on everything you already posted at once. It sits near the audience settings and is worth hunting for, because scrolling back through eleven years of posts is not a plan anybody finishes.
- Look at your own profile while signed out. Open a private browser window and search for yourself. That is the honest view, and the one a stranger gets.
- Check who can find you by phone number or email. This setting hides in a “how people find you” section and is often wide open by default.
The Profile Details That Are Also Security Answers
This is the part almost nobody connects. Your profile asks for your birthday, hometown, high school, first job, pets. Now think about the questions your bank asks when you forget a password.
The FTC describes one category of login credential as “something you know,” and gives the answer to a security question as an example alongside passcodes and PINs. That is the whole problem in one sentence. A security answer is a secret. If it is also a public profile field, it is not a secret anymore, and neither is the birthday-and-hometown pair that gets used to verify people over the phone.
Two fixes, and you want both. Trim the public profile fields down to what a stranger genuinely needs, which is close to nothing. Then stop answering security questions honestly. Treat them as extra passwords, put nonsense in them, and store the nonsense in your password manager. Better still, move the accounts that matter onto a real second factor instead. Our comparison of passkeys, security keys, and text codes lays out which is worth the trouble for which kind of account.
Location, Kids, and What Is in the Background
Posting from where you are is different from posting about where you were. The first tells people the house is empty right now. The second is just a nice picture. The habit worth building is a small delay: post the vacation photos when you get home.
Location shows up in more places than the tag you add on purpose. Photos can carry location data recorded by the camera, and apps can read location from the phone itself. The FTC recommends going to the privacy settings on your smartphone to see what information apps can access from your device, and turning off unnecessary permissions or deleting apps that request permissions they do not need to function. Location is the first permission to audit.
Then there is the background of the photo. The school name on the sign, the team logo on the jersey, the house number on the door. Any one is harmless. Together they are a map. Under the children’s privacy rule the FTC enforces, photos, videos, and audio recordings of a child count as personal information, right alongside their name, address, and physical location. Federal law treats a picture of your kid as identifying data. It is reasonable to treat it that way too. Also turn on the setting that lets you review tags before they appear on your profile.
The Apps You Connected and the Accounts You Abandoned
Somewhere in your account settings is a list of apps and websites you signed into using this account. Go find it. It is usually called connected apps, apps and websites, or third-party access. For most people it is a museum: a game from six years ago, a quiz, a photo filter, a fitness tracker for a bike you sold.
Every one of those still holds a doorway into your account and whatever you granted it. Remove anything you do not actively use. Nothing breaks. If you need it again, you sign in again and it takes four seconds.
The same logic applies to whole accounts you abandoned. The old forum, the retired social network, the shopping site from a single purchase. They still hold your email address, an old password you probably reused, and a slice of personal detail. Delete what you can, and where deletion is not offered, strip the profile down and change the password. The FTC has reported that email was the most common way consumers said scammers contacted them in 2024, and forgotten accounts are exactly how an address and a set of personal details end up in the wrong hands. That is also the raw material for a convincing message, which is worth reading about in our piece on why phishing keeps getting through.
Do It Together, or It Will Not Stick
A lecture about privacy changes nothing. An hour at the kitchen table with everybody’s phone out changes quite a lot, for one specific reason: your kids get to see you find something embarrassing in your own settings. That is the moment this stops being a rule and starts being a shared project.
Keep it light. Give everyone the same short checklist. Let each person drive their own phone rather than handing it over. Ask questions instead of issuing verdicts: who do you actually want seeing this, and what would you not want a stranger to know? Teenagers are often stricter than their parents once they understand what the settings do. Worth mentioning too: under the FTC’s children’s privacy rule, parents have the right to review information a covered service collected about their child, withdraw consent, and have it deleted. Then put next year’s session on the calendar before you clear the table.
The Bottom Line
The Federal Trade Commission reported that imposter scams were the most commonly reported fraud category in 2024, and imposters run on detail. The more a stranger knows about your job, your kids, your schedule, and your hometown, the more convincing they get. A privacy audit is not about hiding. It is about making yourself a harder person to imitate, and giving your family a bit of practice at noticing what they are giving away. One evening, once a year.
We do this work for businesses across Denton County, but the cyber part of life does not stop at the office door. If you sit down for your audit and hit something confusing, or you find a connected app you cannot explain, or someone in the house has an account they think has been taken over, reach out. We are happy to walk you through it. Contact us today.
Sources:
Comments are closed