Privacy in Social Media: Risks, Rights, and How to Protect Yourself

Privacy in social media is one of the most pressing concerns in the digital world. Every time a user creates a profile, posts an update, shares a photo, or simply scrolls through a feed, social media platforms collect, analyse, and monetise personal data on a scale that most people do not fully understand.

This article provides educational information about privacy in social media and the legal frameworks that govern it. It is not legal advice. Consult a qualified attorney for guidance on your specific situation.

How Social Media Platforms Collect Personal Data

Social media privacy starts with understanding the sheer volume and variety of data that platforms gather. The information collected goes well beyond what users voluntarily share in their profiles and posts.

Data Users Provide Directly

When signing up for a social media account, users typically provide their name, email address, phone number, date of birth, and sometimes government-issued identification. Every post, comment, message, photo, and video uploaded to the platform becomes data that the company stores and can analyse.

Profile information such as employment history, education, relationship status, and location is explicitly shared by users but often used in ways they did not anticipate when filling out those fields.

Data Collected Automatically

Platforms collect extensive technical and behavioural data without requiring any active input from users:

• Device information: Operating system, browser type, device model, screen resolution, and unique device identifiers.
• Location data: GPS coordinates, Wi-Fi access points, cell tower data, and IP-based geolocation, often collected continuously when mobile apps have location permissions enabled.
• Usage patterns: Time spent on the platform, content viewed, links clicked, search queries, scroll behaviour, and interaction patterns with other users.
• Contact lists: Many platforms request access to phone contacts during onboarding, uploading names, phone numbers, and email addresses of people who may not even use the platform.

Data Collected from Third Parties

Social media companies also gather data from sources outside their own platforms. Tracking pixels, social login buttons, and "like" or "share" widgets embedded on third-party websites report user activity back to the platform. Data brokers and advertising partners contribute additional information about purchasing behaviour, credit history, and offline activities.

Meta's "Off-Facebook Activity" tool, for example, revealed that the platform receives data from hundreds of thousands of websites and apps about user interactions that occur entirely outside of Facebook.

Privacy Risks of Social Media

The data collection practices described above create several concrete risks for individuals.

Profiling and Behavioural Manipulation

Platforms use collected data to build detailed psychological profiles of users. These profiles power recommendation algorithms that determine what content appears in feeds, which notifications are sent, and how engagement is maximised. Research published in the Proceedings of the National Academy of Sciences demonstrated that Facebook likes alone could predict personality traits more accurately than friends or family members.

This profiling extends to advertising. Advertisers can target users based on inferred characteristics, including health conditions, financial status, and political leanings, that users never explicitly disclosed. The Cambridge Analytica scandal in 2018 showed how social media data could be harvested and used for political influence campaigns.

Data Breaches and Unauthorised Access

Social media platforms are high-value targets for cyberattacks because they concentrate vast amounts of personal data. Notable breaches include:

• LinkedIn: 700 million user records scraped and sold in 2021.
• Facebook: 533 million user records, including phone numbers, leaked in April 2021.
• Twitter: 5.4 million accounts exposed through an API vulnerability in 2022.

Once personal data is exposed in a breach, it cannot be un-leaked. Stolen data is traded on dark web marketplaces and used for identity theft, phishing, and social engineering attacks for years after the original incident.

Location Tracking and Physical Safety

Continuous location tracking by social media apps creates risks beyond digital privacy. Geotagged posts and check-ins can reveal home addresses, daily routines, travel schedules, and real-time whereabouts. Stalkers, burglars, and other bad actors have exploited this information. Fitness tracking apps that double as social platforms have inadvertently exposed the locations of military personnel and intelligence operatives.

Children and Vulnerable Users

Children face heightened privacy risks on social media. They are less likely to understand the long-term consequences of sharing personal information and more susceptible to manipulation by recommendation algorithms. In the United States, the Children's Online Privacy Protection Act (COPPA) prohibits collecting personal information from children under 13 without verifiable parental consent, yet enforcement remains challenging when children misrepresent their age to create accounts.

The UK Age Appropriate Design Code (Children's Code) requires platforms likely to be accessed by children to provide default high-privacy settings and prohibits using personal data in ways that are detrimental to a child's wellbeing.

Laws That Protect Privacy in Social Media

Several legal frameworks address how social media platforms handle personal data, though their scope and enforcement mechanisms vary significantly.

GDPR (European Economic Area)

The General Data Protection Regulation applies to any social media platform that processes personal data of individuals in the EEA, regardless of where the platform is headquartered. Key requirements include:

• Lawful basis for processing (Article 6): Platforms must have a valid legal basis for each type of data processing. The GDPR does not permit processing simply because a user agreed to lengthy terms of service.
• Transparency (Articles 13 and 14): Platforms must clearly explain what data they collect, why, and who receives it.
• Consent for tracking (Article 7 and ePrivacy Directive): Cookies and tracking technologies require informed, freely given consent. The GDPR has driven the adoption of cookie consent banners across websites that integrate social media widgets.
• Right to erasure (Article 17): Users can request that platforms delete their personal data.
• Right to data portability (Article 20): Users can request their data in a machine-readable format to transfer to another service.
• Data Protection Impact Assessments (Article 35): Platforms must assess the risks of high-risk processing, such as large-scale profiling for advertising.

Penalties for GDPR violations reach up to 20 million EUR or 4% of annual global turnover, whichever is higher. Meta alone has received GDPR fines exceeding 2.5 billion EUR across multiple enforcement actions.

CCPA and CPRA (California)

The California Consumer Privacy Act and California Privacy Rights Act give California residents specific rights regarding their social media data:

• The right to know what personal information is collected, sold, or shared.
• The right to delete personal information.
• The right to opt out of the sale or sharing of personal information, including the sharing of data for cross-context behavioural advertising.
• The right to limit the use of sensitive personal information.

Penalties for CCPA violations range from $2,500 per unintentional violation to $7,500 per intentional violation. The CPRA also created the California Privacy Protection Agency (CPPA) as a dedicated enforcement body.

Other Relevant Laws

• COPPA (United States): Restricts collection of personal data from children under 13. The FTC has fined TikTok, YouTube, and other platforms for COPPA violations.
• Digital Services Act (EU): Requires very large online platforms to assess systemic risks, including risks to fundamental rights and privacy, and take mitigation measures.
• UK Data Protection Act 2018 and UK GDPR: Mirrors EU GDPR protections for UK residents after Brexit.
• Brazil's LGPD: Grants data subjects rights similar to the GDPR, including access, correction, and deletion.

How Social Media Platforms Use Data for Advertising

Advertising revenue is the primary business model for most social media platforms, and personal data is the engine that drives it. Understanding this relationship is essential to understanding privacy in social media.

Platforms combine first-party data (what users do on the platform) with third-party data (what users do elsewhere on the internet) to create advertising profiles of remarkable granularity. An advertiser on Meta's platforms can target users based on age, gender, location, language, education level, job title, relationship status, interests inferred from likes and follows, purchase behaviour, device type, and connections to specific pages or events.

Beyond basic targeting, platforms use personal data for:

• Lookalike audiences: Creating groups of users who resemble a company's existing customers, based on shared behavioural and demographic patterns.
• Conversion tracking: Monitoring whether users who saw an ad later visited a website, made a purchase, or took another desired action.
• Retargeting: Showing ads to users who previously interacted with a brand's website or content on other platforms.
• Ad auction optimisation: Using machine learning to predict which users are most likely to engage with or convert from a given ad, then prioritising delivery to those users.

This advertising infrastructure is what makes social media platforms free to use. The trade-off is that users pay with their personal data and attention rather than with money.

Practical Steps to Protect Your Privacy in Social Media

While legal frameworks provide rights and protections, individuals can also take concrete steps to reduce their exposure.

Review and Adjust Privacy Settings

Every major social media platform provides privacy controls, though they are often buried in settings menus and default to the least private option. Key settings to review include:

1. Profile visibility: Restrict who can see your profile, posts, friends list, and personal details. Set defaults to "friends only" rather than "public."
2. Location sharing: Disable location tagging for posts and turn off background location access for social media apps in your device settings.
3. Ad personalisation: Most platforms offer an option to limit ad targeting based on your activity. On Meta platforms, this is found under "Ad Preferences." On Google, it is under "My Ad Center."
4. Third-party app access: Revoke permissions for apps and websites that you connected to your social media accounts but no longer use.
5. Facial recognition: Where available, disable automatic face tagging in photos.

Limit What You Share

The most effective privacy measure is also the simplest: share less. Before posting, consider whether the content reveals your location, routine, financial situation, health status, or other sensitive information. Remember that content shared with friends can be screenshotted, reshared, or accessed through friends' less secure accounts.

Avoid using social media logins ("Sign in with Facebook/Google") on third-party websites, as this shares data between the platform and the website and creates a single point of failure if your social media account is compromised.

Use Platform Data Download Tools

The GDPR's right to data portability and the CCPA's right to know have prompted most platforms to offer data download tools. Downloading your data archive reveals what information the platform holds about you, which is often surprising in its scope and detail. This exercise is valuable even if you do not intend to delete your account, because it provides transparency into the data collection practices you are subject to.

Monitor Third-Party Data Sharing

Review the "Off-Facebook Activity" tool (or equivalent on other platforms) to see which external websites and apps are sending data about you to the platform. You can clear this history and disconnect future activity, though doing so may affect ad relevance and some platform features.

Privacy in Social Media for Website Operators

If you operate a website that integrates social media features, you have your own compliance obligations to consider.

Social plugins, share buttons, embedded posts, and tracking pixels from social media platforms place cookies and collect data from your visitors. Under the GDPR and ePrivacy Directive, you need informed consent before loading these technologies. A cookie policy should disclose which social media trackers are present on your site and what data they collect.

Your privacy policy must explain what personal data is shared with social media platforms, the purposes of that sharing, and the legal basis for it. If you run social media advertising campaigns that use retargeting pixels on your website, your visitors must be informed about this data flow.

Tools like TermsBox can scan your website to identify social media trackers and other third-party cookies, generate compliant legal documents, and provide a consent management platform that gives visitors genuine control over which tracking technologies are activated.

The Future of Social Media Privacy

Privacy in social media continues to evolve as regulators, platforms, and users push in different directions.

The EU Digital Markets Act, which took effect in March 2024, restricts how "gatekeeper" platforms (including Meta) can combine personal data across services without consent. This has already forced changes to how platforms handle cross-service profiling.

In the United States, a federal privacy law remains elusive, but state-level legislation continues to expand. More than 15 states have enacted comprehensive privacy laws since California led the way with the CCPA in 2018. Many of these laws include specific provisions addressing social media data.

Platform-level changes are also underway. Apple's App Tracking Transparency framework, introduced in 2021, requires apps to obtain permission before tracking users across other apps and websites. This single change reduced the data available to social media advertising platforms by billions of dollars in estimated annual revenue.

Decentralised social media protocols like ActivityPub (powering Mastodon and Threads' planned federation) and Bluesky's AT Protocol offer architectural alternatives where users can choose their hosting provider and take their data and social connections with them. Whether these alternatives achieve mainstream adoption remains uncertain, but they represent a structural shift away from the centralised data collection model.

Frequently Asked Questions

What personal data do social media platforms collect?

Social media platforms collect far more than what users voluntarily post. Data collection typically includes profile information, posts and messages, location data from GPS and Wi-Fi signals, device identifiers and operating system details, browsing activity across the web via tracking pixels and social plugins, contact lists uploaded from phones, facial recognition data from photos, purchasing behaviour, and inferences about interests, political views, and relationship status derived from usage patterns.

Can I delete my data from social media platforms?

Under the GDPR (Article 17) and CCPA (Section 1798.105), you have the legal right to request deletion of your personal data from social media platforms. Most major platforms provide account deletion tools in their settings. However, deletion may not be immediate or complete: platforms may retain certain data for legal compliance, and data already shared with third-party apps or copied by other users cannot be recalled. Backups and cached copies may persist for a limited period after your request.

What laws protect social media privacy?

Several laws address social media privacy depending on your location. The GDPR protects individuals in the European Economic Area with rights to access, delete, and port their data, with fines up to 20 million EUR or 4% of global turnover. The CCPA and CPRA give California residents the right to opt out of the sale or sharing of personal data, with penalties of $2,500 to $7,500 per violation. COPPA in the United States prohibits collecting personal information from children under 13 without parental consent.

How do social media platforms use my data for advertising?

Social media platforms build detailed advertising profiles by combining data from your posts, likes, follows, messages, browsing history, location, device information, and activity on third-party websites that embed social plugins or tracking pixels. Advertisers can then target you based on demographics, interests, behaviours, life events, and even lookalike audiences modelled on your profile. This data is also used to measure ad effectiveness and optimise future ad delivery.