Protecting your personal data on social media

Every photo, comment and story you post on social media is a small piece of information. On their own they look harmless, but put together they can tell a stranger where you live, which school your child attends and that you are not at home right now. This article is not about passwords — we covered those in detail in our online safety guide. Here we focus on privacy: what counts as personal data, how it “leaks”, what location data hides inside your photos, which settings to check in Telegram, Instagram and Facebook, how to tidy up old posts and what to do about a fake account or blackmail. At the end you will find a profile audit based on our fictional example, Sevara, common mistakes, a practical exercise and a checklist.

What personal data is and why it needs protecting

Personal data is any information that can identify you or reveal something important about you. Many people think only of their passport, but the list is much longer:

• Documents: passport or ID card, driving licence, birth certificate, diploma — their numbers and photos.
• Contact details: phone number, email address, home address.
• Financial information: bank card number, its expiry date, payment receipts.
• Family: your children’s names, ages, school and class, nursery, after-school clubs.
• Daily routine: when you leave for work, which days you go to the gym, what time you collect your child from school.
• Location: your home, your workplace and where you are right now.

Each of these opens a different door for a scammer. With a photo of your passport, someone might try to register for a service in your name. A phone number together with your full name makes the “call from the bank” scenario more convincing. And your child’s school and timetable directly affect their safety. The goal is not to disappear from the internet altogether, but to choose consciously what you show, to whom and when.

How data leaks: everyday examples

Most of the time people reveal personal information not on purpose but by accident. The most common situations:

• A photo of a document or ticket. Posting a document or a plane ticket with the caption “Finally got my new passport” or “Flying to Tashkent tomorrow”. The QR code or barcode on a ticket may contain the booking reference and surname — and these can sometimes be used to view or even change the booking.
• The view from your window. A pretty view from your window may show the building next door, a shop sign or a street name, making your home easy to find.
• A number plate. In a photo with your new car, the registration plate is perfectly legible.
• Your child’s uniform. A school uniform, a badge, or the school building and its number in a “first day of school” photo.
• “On holiday right now” posts. A real-time story from the beach announces that your flat is empty.
• Receipts and cards. A shared receipt may show part of your card number, your name and your account number.
• Screenshots. A screenshot of a chat can show other people’s numbers and names, and notifications in the status bar at the top.

A simple rule: before posting a photo, look at it once through a stranger’s eyes. Is there an address, a number, a code or a document? If so, crop it or cover it. Your phone’s built-in editor has Crop and Markup tools — cover a document number completely with a solid, opaque box. A semi-transparent “blur” is sometimes not enough. And post holiday photos after you get back: they will be just as beautiful, and your home will be safer.

Location: geotags, EXIF and app permissions

Hidden information in photos

Your phone’s camera writes invisible extra information into every photo. This is called metadata, or EXIF: the date and time the photo was taken, the phone model and — if location is switched on for the camera — the coordinates of where it was taken. In other words, a photo taken at home may quietly contain your home address.

Major social networks usually strip out most of this data when you upload a photo, but do not rely on that blindly. For example, if you send a photo in Telegram as a file (uncompressed) rather than as an ordinary picture, the original goes with all its metadata. The same applies to original photos sent by email.

What you can do:

1. Stop the camera recording location. On Android, the camera app’s settings usually have a “Location tags” option or something similar. On iPhone, go to Settings → Privacy & Security → Location Services → Camera and choose “Never”.
2. Remove location when sharing. On iPhone, the Options button at the top of the share sheet lets you switch off Location. Some versions of Android offer a similar choice when sharing from the gallery.
3. Be careful with public geotags. Adding a location tag (geotag) to a post or story is optional. Do not geotag your home, your child’s school or places you visit regularly.

App location permissions

Many apps ask for access to your location, but not all of them need it. In your phone’s settings (on Android: Settings → Location → App location permissions; on iPhone: Settings → Privacy & Security → Location Services) each app has a choice: “Allow all the time”, “Allow only while using the app” or “Don’t allow”. Maps and taxi apps only need “while using the app”. A torch, a game or a photo-filter app does not need your location at all. Also check social network features such as “share my location with friends”, and switch them off if you do not need them.

Privacy settings on each platform

The paths below are for the English-language interface. Apps are updated frequently, so a menu item’s name or position may have changed slightly — if so, use the search box in the settings and look for “Privacy”.

Telegram

The main settings are under Settings → Privacy and Security. Most of them offer three options — Everybody, My Contacts and Nobody — plus the ability to add exceptions.

• Phone Number — who can see your phone number. Choose “Nobody” or “My Contacts”. Here you will also find “Who can find me by my number”, which limits whether strangers who know your number can find you.
• Last Seen & Online — when you were last online. This reveals your daily routine: when you go to sleep and when you wake up.
• Profile Photos — who can see your profile picture.
• Groups & Channels — who can add you to groups. Choosing “My Contacts” stops you being added to random advertising and scam groups.
• Calls and Forwarded Messages — who can call you and whether a link to your account appears when your messages are forwarded.

If you run your own channel, keep your personal account and channel details separate — we touch on this in our article on running a Telegram channel.

Instagram

• Private account — Settings and activity → Account privacy. With a private account, only followers you approve can see your posts. For a personal profile, this is the simplest and strongest protection.
• Close Friends — share a story only with a chosen inner circle. Family moments and anything involving children are best posted to this list.
• Hide story from — hide your stories from specific people.
• Tags and mentions — limit who can tag and mention you.

If your page is for a business, it is natural for it to be public — but keep your personal life in a separate private account. We cover this in our article on Instagram business profiles.

Facebook

Facebook has a Settings & privacy → Privacy Checkup section that walks you step by step through who can see your posts, who can find you by phone number or email, and who can see your profile details (date of birth, workplace, city). The interface changes often, but the name “Privacy Checkup” or “Privacy Center” usually stays.

Contact syncing

Many apps offer to upload your phone’s address book (“Sync Contacts”, “Connect contacts”). This sends not only your number but the numbers of everyone in your contacts to their servers. In Telegram you can switch this off under Settings → Privacy and Security → Data Settings → Sync Contacts; the same screen has a button to delete contacts uploaded earlier. In other apps, look for a similar option in the settings.

Other people’s photos and your digital footprint

Post with consent

Just as you protect your own privacy, others expect the same. Before posting a group photo from a wedding, a birthday or a work meeting, ask the people in it. Take special care with photos of children: a child cannot yet give consent, and a photo posted online can still be found years later. A child’s face, name and school should never appear together. If a photo with other children in it was shared in a nursery or class group chat, do not repost it on your public page. A useful habit for admins of class and neighbourhood (mahalla) groups: keep members’ numbers hidden and share photos of children only with parents’ consent.

Old posts and your digital footprint

Your digital footprint is everything about you that remains online: posts, comments, tagged photos, old profiles. An employer, a college or simply a curious person may see it.

How to tidy up:

1. Search for yourself. Search for your full name, phone number and username in quotation marks and review the results.
2. Close old accounts. Pages created years ago and forgotten are a common source of leaks. If you can still log in, delete the ones you no longer need.
3. Archive old posts. In Instagram, Archive in a post’s menu hides it from others without deleting it. In Facebook you can limit the visibility of past posts in one go (in the privacy section of Settings & privacy).
4. Check your tags. Review photos others have tagged you in and remove tags you do not want.

A positive digital footprint is useful too: if you want to be known as a professional, read our article on your LinkedIn profile to learn how to run an open, professional page. What matters is consciously separating public from private.

Fake accounts, hacked accounts and blackmail

Social engineering

Social engineering means deceiving people rather than machines. A scammer uses the public information on your profile to pose as someone you know: “Hello, I’m Dilshod’s colleague, we met at the wedding” — or creates a fake account with a relative’s photo and name and writes: “This is my new number, I lost the old one, I need help urgently”. The more information about you is public, the more convincing such a story sounds.

How to protect yourself: check an acquaintance who writes “from a new number” through another channel — call their old number; do not open links or files; be suspicious of recently created accounts with few photos and no mutual friends. Report a fake account using the platform’s Report function and warn your family and friends. Phishing links also often arrive inside these “familiar” messages.

If your account is hacked

In short: change your password straight away (starting with your email), sign out of all other sessions, turn on two-step verification and warn your friends through another channel. If you cannot log in, use the platform’s official recovery page. Detailed steps are in the online safety guide mentioned above.

Blackmail and threats

If someone threatens to publish private photos or messages and demands money or anything else:

1. Do not give in or negotiate. A demand met once usually leads to the next one.
2. Keep the evidence. Take screenshots of the messages, the account name and link, and the dates. Do not delete the conversation straight away.
3. Do not reply, and once you have saved the evidence, block the account that threatened you.
4. Do not deal with it alone. Tell someone you trust — a parent, a teacher, a family member. It is nothing to be ashamed of, and it is not your fault.
5. Report it to the platform and to law enforcement (for example, the internal affairs authorities). Check the official sources for how to file a report.

This section matters especially for teenagers: agree with your child in advance — “if this ever happens, tell me, and I won’t be angry”.

Example: Sevara audits her profile

Sevara is a fictional example — a university student in Samarkand. At the start of the autumn term she decided to put her pages in order and completed these 10 steps in one evening:

1. Search. She searched for her full name and username, found a forgotten page she had created at school and deleted it.
2. Telegram number. Phone Number → “Nobody”, “Who can find me by my number” → “My Contacts”.
3. Last Seen. Set to “My Contacts” — her coursemates can see it, strangers cannot.
4. Groups. Groups & Channels → “My Contacts”: now nobody can add her to unknown “job offer” groups.
5. Instagram. Made her personal account Private and created a Close Friends list for family photos.
6. Old posts. A selfie with her passport and a photo from her student hall window showing the street name — she archived both.
7. Geotags. Switched off location recording in the camera settings and removed geotags of a café near her home from her posts.
8. App permissions. Removed “all the time” location access from two photo-filter apps.
9. Contacts. Switched off Sync Contacts in Telegram and deleted previously uploaded contacts.
10. Bio. Removed her phone number and the line “3rd year, group 2” from her profile description, keeping her interests instead.

As a result, Sevara’s page is as lively as ever for her friends, but a stranger cannot work out where she lives or what her daily routine is.

Common mistakes

• “Who would be interested in my page?” — to scammers, any public profile is a source of information, especially for deceiving your contacts.
• Posting a document or ticket “just for an hour”. A screenshot takes a second, and a copy remains even after the story is deleted.
• Showing a child’s face, name and school together.
• Announcing your location in real time — “we’re at the airport now”, “off on holiday for a week”.
• Tapping “Allow” on every permission request — without thinking about what the app is asking for.
• Forgetting old accounts. Until they are closed, the information in them stays public.
• Hiding blackmail and giving in to demands — the problem only gets bigger.

Practical exercise and checklist

Set aside 30–40 minutes today and check your own page the way Sevara did:

1. Search for your full name and username in a search engine and note down what you find.
2. Go through every item under Settings → Privacy and Security in Telegram.
3. Make your personal Instagram account Private, or at least create a Close Friends list.
4. Complete Privacy Checkup in Facebook.
5. Look through your posts from the past year: are there documents, numbers, an address or your child’s school?
6. Open the list of apps with location access on your phone and switch off the unnecessary ones.
7. Have a short conversation with your family about children’s photos and what to do in case of blackmail.

Checklist

• Strangers cannot see my phone number, and finding me by my number is restricted.
• Only my contacts can add me to groups.
• My personal Instagram is private, or I have a Close Friends list for stories.
• My camera does not record location in photos, and there are no geotags for my home or school.
• No app has unnecessary location access, and contact syncing has been checked.
• My profile has no photos showing documents, ticket codes, number plates or my address.
• Old and unused accounts are closed.
• I post photos of other people, especially children, only with consent.
• I know what to do in case of blackmail or threats.

Protecting personal data is not a one-off task: apps update and new settings appear. Make a habit of going through this list once or twice a year, and share what you have learnt with those close to you, especially older relatives who are just starting to use a smartphone.

If you would like to study digital safety in more depth with a tutor, take a look at our association’s free cybersecurity programme and our other free programmes. When you are ready, submit an application — our team will get in touch with you.