Social Media Privacy Settings

Audience is the first control. Public means the post can be viewed without a relationship, often indexed, screenshotted, and copied into people-search pages you will meet in the next lesson. Friends or followers means a smaller circle — still not a secret. Anyone in that circle can screenshot. Anyone you accepted years ago and forgot still sits in the audience. Close Friends / lists exist because "friends" on a platform is a graph, not a trust rating. Defaults matter more than one heroic private post. If new posts default to Public, you will leak on a busy day. If Stories default to everyone, a location sticker or a bedroom background becomes a broadcast. Walk the setting that applies to NEW content first, then the setting that rewrites OLD content if the platform offers "limit past posts." Old jokes, old check-ins, and old tagged nights out are still live exhibits until you change them.

LinkedIn is a special case because the product is public-by-design for careers. That is legitimate — and it is also the cleanest OSINT resume on the open web: employer sequence, skills, volunteer roles, city, and often a photo you reuse elsewhere. Oversharing there is not "networking"; it is handing a stranger a timeline of where you worked, who might vouch for a fake reset email, and which internal tool names belong in a spear-phish. Hide phone numbers, exact street-level location, and anything you would not put on a conference badge. Keep the professional story. Cut the personal map.

Three leftover pipes keep leaking after you "got private." First: the archive. A profile set to friends today can still have years of Public posts, comments on other people's public threads, and groups that are searchable. Second: tags. A friend can pin your face and a place to a photo you never approved. Tag review is the gate: the photo does not appear on your timeline until you say yes. It does not stop them posting it on theirs — it stops you from amplifying it. Third: location. Precise location for the social app, geotags on the camera, live Stories, and "check in" buttons all advertise where you are or — worse — where you are not (home empty, on a flight, at a hotel). None of this requires an attacker to "hack" the platform. It requires the audience switch you left on Public, a tag you never reviewed, and a location permission you granted in 2019. The mechanism is settings plus leftover data, not malware.

Pick Facebook, Instagram, X, TikTok, LinkedIn, or whatever you actually use. You need three real clicks, not a screenshot of a blog. If a control has a different label on your version, match the intent: who sees new posts, who can tag you, whether the app has precise location. Save notes on your machine. Do not paste profile URLs of other people into the notes file.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/social-privacy.txt"

{
  echo "date: $(date -Iseconds 2>/dev/null || date /t)"
  echo "platform: (name the account YOU own)"
  echo "change_1: default audience"
  echo "change_2: tag review"
  echo "change_3: location / geotag"
  echo "note: I did not search or lock anyone else's profile"
} > "$NOTES"
chmod 600 "$NOTES"
cat "$NOTES"

You now treat audience, tags, and location as live controls — not vibes — and you practiced only on a profile you own. Old public posts and LinkedIn oversharing still feed the next problem: companies that never asked you for an account. Next — Data Brokers — how public records, purchases, and tracking get stitched into sold profiles, and what a legal opt-out can (and cannot) do.