This isn’t just a parent thing or a kid thing. Anyone with an account can be stalked, doxxed, phished, or impersonated. The good news: a focused hour of settings changes makes you a much harder target for almost everyone who might try.
1The security base for everyone
Do these first, in order. They matter more than any single platform setting, because they protect the accounts an attacker would use to get into everything else.
- Use a password manager and a strong, unique password for every account. Reused passwords are the single biggest reason one leaked account turns into ten. A password manager generates and remembers long random passwords so you don’t have to.
- Turn on two-factor authentication (2FA) everywhere it’s offered, and prefer an authenticator app or a passkey over text-message codes. SMS codes can be intercepted or redirected through SIM-swapping; app-based codes and passkeys are much harder to attack. CISA recommends phishing-resistant methods over SMS where available.
- Set up a passkey wherever a platform offers one. Passkeys replace your password with your device’s fingerprint, face unlock, or PIN, and they can’t be phished the way a typed password can. Instagram, Facebook, X, TikTok, LinkedIn, and Google all support them now, alongside your password, not instead of having good account recovery.
- Check Have I Been Pwned for your email addresses and change any breached passwords immediately, especially anywhere you reused that password. If a password shows up in a breach, treat it as burned everywhere, not just on the site that leaked it.
- Secure your email account and its recovery options first. Email is the master key: whoever controls it can reset almost everything else. Use a strong unique password and 2FA on your email specifically, and make sure your recovery phone number and backup email are current and belong to you.
- Lock your device with a strong PIN, passcode, or biometric. A phone or laptop that’s unlocked, or protected by a weak 4-digit PIN, gives anyone who picks it up a shortcut around every other setting on this page.
If you only do three things: a unique password on every account (via a password manager), app-based or passkey two-factor authentication instead of SMS, and setting your main social accounts to private. Those three moves block the majority of casual account takeovers, credential-stuffing attempts, and stranger contact.
2Per-platform privacy hardening
Menus move around and get renamed, so these are current setting names as of mid-2026, but always look for the underlying idea (private account, who can message me, who can find me, connected apps) even if a label has shifted slightly by the time you read this. Teens on these platforms should use the strictest settings by default; if you’re a parent helping a younger child set up an account, walk through this list together rather than doing it for them silently, so it becomes a habit they understand.
- Make your account private: Settings and privacy → Account privacy → turn on Private account. Only approved followers see your posts and Stories.
- Use Restrict on anyone unwanted instead of blocking outright: Settings and privacy → search a username → Restrict. Their comments and messages become invisible to others and they can’t see your activity status or message read receipts, without them being notified.
- Control who can message and comment: Settings and privacy → Messages and story replies, and → Comments, to limit DMs and comments to followers or people you follow.
- Turn off activity status so people can’t see when you’re online: Settings and privacy → Messages and story replies → Show activity status.
- Review and manage Tag and mention controls, and turn on manual tag review so tagged photos need your approval before they appear on your profile: Settings and privacy → Tags and mentions.
- Review connected apps and websites: Settings and privacy → Accounts Center → Apps and websites, and remove anything you don’t recognise or no longer use.
- Limit ad topics and data used for ads: Settings and privacy → Accounts Center → Ad preferences.
- Run Privacy Checkup (Settings → Privacy Checkup): it walks through who can see your future posts, your friends list, and how people can find you by phone number or email in one guided flow.
- Turn on Profile Lock if it’s offered in your country, which hides your posts, photos, and profile/cover pictures from anyone who isn’t already a friend.
- Set who can send you friend requests and how message requests are delivered, in the « How people find and contact you » settings.
- Turn on tag review so posts and photos you’re tagged in need your approval before appearing on your timeline, and review tags others add to your posts.
- Turn off precise location for the Facebook app in your phone’s OS settings, and check location tags on individual posts before sharing.
- Review app settings under Settings → Apps and Websites and remove anything you don’t use.
- Limit ad personalisation under Settings → Ads → Ad settings.
TikTok
- Make your account private: Profile → Menu → Settings and privacy → Privacy → turn on Private account. Under-16 accounts are private by default on TikTok, but it’s worth confirming.
- Set who can send you Direct Messages and who can comment, duet, or stitch your videos: Settings and privacy → Privacy → Comment, Duet, Stitch, and Direct Messages controls.
- Turn off « Suggest your account to others » so TikTok stops recommending you to people who have your contacts, to limit how easily people find your account.
- Review and manage connected third-party apps: Settings and privacy → Security and permissions → Apps and devices with access to your account, or Manage app permissions.
- Adjust ad personalisation under Settings and privacy → Ads.
Snapchat
- Set who can contact you: Settings (gear icon) → App & Privacy → Contact Me, and restrict it to Friends rather than Everyone.
- Choose who can view your Story: Settings → App & Privacy → My Privacy & Data → Story settings, ideally « My Friends » or a Custom list.
- Turn on Ghost Mode so your location isn’t shared on Snap Map: from the Map, tap the gear icon and toggle Ghost Mode on, or Settings → See My Location → Ghost Mode. Note that Snaps you choose to submit to Snap Map’s public « Our Story » can still show your location regardless of this setting, so think before you submit.
- Check who can see you appear in Quick Add / discoverability by phone number under App & Privacy settings.
X (Twitter)
- Protect your posts so only approved followers see them: Settings and privacy → Privacy and safety → Audience, media and tagging → turn on Protect your posts.
- Turn off email and phone discoverability so people can’t find your account just by having your contact details: Settings and privacy → Privacy and safety → Discoverability and contacts → turn off « Let others find you by your email » and « Let others find you by your phone. »
- Control who can message you under Settings and privacy → Privacy and safety → Direct Messages.
- Turn off photo-tagging permissions, or limit tagging to people you follow, under Audience, media and tagging.
- Adjust personalisation and data settings under Settings and privacy → Privacy and safety → Data sharing and off-X activity.
- Control your public profile visibility (what non-members and search engines see): Settings → Visibility → « Edit your public profile, » and turn off individual sections you don’t want publicly visible.
- Hide your connections list from other members: Settings → Visibility → « Connections » → set to « Only you. »
- Turn off « Who can see your last name » and profile-viewing options (browse anonymously or as a private profile) under Settings → Visibility → Profile viewing options, if you don’t want people to see you viewed their profile.
- Review permitted services and third-party app access under Settings → Data privacy → Other applications.
- Turn off ad personalisation under Settings → Advertising data.
Google Account / YouTube
- Run a Privacy Checkup at myaccount.google.com/intro/privacycheckup: it walks through what’s shared publicly, ad personalisation, and what Google saves about your activity and location.
- Set up a passkey for sign-in and confirm 2-Step Verification (2FA) is on, preferring an authenticator app or passkey over SMS codes.
- Make your YouTube « Subscriptions, » « Saved playlists, » and channel activity private under YouTube Settings → Privacy, if you don’t want them public.
- Review third-party apps and sites with account access at myaccount.google.com → Security → « Your connections to third-party apps & services, » and remove anything unfamiliar.
- Turn off Web & App Activity or Location History, or set them to auto-delete, under myaccount.google.com → Data & privacy.
- Limit ad personalisation under Data & privacy → « Ad settings. »
3Reduce your discoverability more broadly
Locking down platforms only helps if the same information isn’t sitting in public data broker listings that anyone can search. This is a bigger topic covered in more depth in our digital footprint guide; here’s the short version.
- Opt out of people-search and data broker sites (services that compile your name, address, phone number, relatives, and more into searchable public profiles). Each site has its own opt-out process, and there’s no single one-click fix; expect to work through a list over a few sessions, and to repeat it periodically since brokers re-add data.
- Use Google’s « Results about you » tool (myactivity.google.com/results-about-you) to find search results that surface your phone number, home address, or email, and request their removal from Google Search. This removes them from Google’s results, not necessarily from the source site, so pair it with opting out at the source when you can.
4Keep it up
Privacy settings aren’t a one-time chore. Platforms change menus, add features, and sometimes quietly reset defaults after an update.
- Re-run Privacy Checkup-style tools every few months, and again after any major app update.
- Prune old posts, photos, and check-ins that reveal more than you’d want a stranger to know, especially old location tags.
- Delete or deactivate accounts you no longer use rather than leaving them dormant with old data and weak passwords attached.
- After any breach notice or « new sign-in » alert, change that password immediately and check Have I Been Pwned again.
Sources
- Make your Instagram account private — Instagram Help Center
- Restrict or unrestrict someone on Instagram — Instagram Help Center
- Manage privacy settings for apps and websites connected to Instagram — Instagram Help Center
- Facebook Privacy Checkup — Facebook Help Center
- Lock your Facebook profile — Facebook Help Center
- Making your account public or private — TikTok Support
- Account privacy settings — TikTok Support
- How do I change my privacy settings on Snapchat? — Snapchat Support
- How do I turn on Ghost Mode? — Snapchat Support
- About your email and phone number discoverability settings — X Help Center
- LinkedIn public profile visibility — LinkedIn Help
- Who’s viewed your profile visibility settings — LinkedIn Help
- Google Account Privacy Checkup
- Find and remove personal info in Google Search results (« Results about you ») — Google Search Help
- Privacy settings that put you in control — Google Safety Center
- Have I Been Pwned: check if your email has been exposed in a data breach
- Have I Been Pwned: Pwned Passwords
- More than a Password — CISA
- Implementing Phishing-Resistant MFA — CISA
- How to remove your contact info from online people-search sites — Consumer Reports
- Data Brokers — Privacy Rights Clearinghouse