Article
Social Media: What You Publish Without Realising It
Privacy settings aren't your main problem. The real issue is that your posts hand over, free of charge, exactly what someone needs to impersonate you, and most people give it away smiling.
The usual question is: "who can see my posts?"
It's the wrong one. A perfectly locked-down profile, visible only to your friends, can still supply in one evening everything needed to impersonate you to your phone carrier. Because the problem isn't the visibility of your content, it's its content.
We saw how phone number hijacking works in the online security article: the attacker gathers a few details, calls the carrier, poses as you. This article deals with the step before: where those details come from. They almost always come from you.
What your posts actually give away
Three categories, in order of severity.
The answers to security questions
This is the point almost nobody makes. Look at the secret questions banks and online services still offer: your first pet's name, primary school, city of birth, mother's maiden name, your first car's make.
Now look at what an ordinary person publishes: a photo of their dog with its name, the birthday message to their mother with her surname, the nostalgic post about their school, the "happy birthday" wishes that pin down their date of birth to the day.
Each element on its own is harmless. Together they form an account recovery file.
Date of birth deserves separate treatment: combined with your name and your town, it's one of the three items a call centre systematically asks for. Publishing it every year, and letting others publish it for you, is the most common gift made to fraudsters.
Your habits
An isolated post says little. Regularity says everything. The morning coffee always at the same place, sport on Tuesday evenings, the children's school in the background, the weekend trip: within a few weeks an observer knows your week better than some of your relatives do.
A particular case, well known to insurers: announcing a holiday departure amounts to announcing an empty home. The rule is simple and free: post on your return, never during.
What's around the subject
You photograph your meal, your dog, your new gear. In the background: a recognisable window view, a street number, a shop sign, a letter on the table, a work badge, a number plate.
That's exactly the geolocation method we described in the OSINT article, applied to you. The subject of the photo is irrelevant; it's the setting that talks.
Metadata, with the nuance everyone misses
A photo taken with a smartphone carries around twenty hidden fields: device, settings, date, time, and often GPS coordinates.
The nuance alarmist content leaves out: major platforms do strip most of that on upload, particularly GPS position. Instagram does so systematically.
The nuance reassuring content leaves out: that stripping is inconsistent between platforms, varies by image format, doesn't apply the same way to private messages as to public posts, and can change without notice after a product update. Above all, it only covers platforms: a photo sent by email, uploaded to cloud storage or shared as a raw file keeps everything.
The practical conclusion is simple: don't rely on the platform. Turn off photo geolocation in your phone camera's settings: one toggle, and it solves the problem at source for every future photo. And remember that the visible setting remains the main information vector, well ahead of metadata.
The settings that do help
They don't replace the above, but they reduce the surface.
Prune your contacts. The question isn't "do I have something to hide" but "do I actually know these three hundred people". Fake profiles collecting information start with a contact request accepted without thought.
Hide your contact list. It's the most underrated setting: it reveals your family, your colleagues, your circle, and it's used to build a credible fake profile that will then approach you claiming a mutual friend.
Remove your full date of birth, or display only day and month.
Check what a stranger sees. Most platforms offer a public preview of your profile. Look at it once a year: that's the version of you a recruiter, a curious neighbour, or someone preparing a scam will see.
Disable automatic tagging. Other people's posts escape your settings: you can be tagged in a photo taken at your home, with the location added by someone else.
And the reminder that covers everything: "private" doesn't mean private. Screenshots circulate, accounts get compromised, platforms get breached. Publish assuming it will one day be read by someone you didn't anticipate.
Children
A short mention, because it's necessary.
Regularly publishing a child's image builds, with no intent to harm, a public file on someone who didn't consent and who will have to live with it. Three concrete precautions:
- No school uniform, no school name, no recognisable school entrance. That's the trio that lets someone locate a child at a fixed time.
- No first name attached to a face in an open post.
- Nothing that can be turned against them, including what seems endearing today and will be humiliating in ten years.
The principle is the same as for you: it isn't the single post that's the problem, it's the accumulation.
The limits, and the classic mistake
What this sorting gives you: a real reduction in what a stranger can reconstruct about you, and therefore in your vulnerability to impersonation fraud.
What it doesn't give you: erasure. What has been published over ten years remains largely available, archived, captured, resold. The goal isn't to go back, it's to stop feeding.
The classic mistake is locking everything down for one evening and then resuming exactly the same posting habits the following week. Settings are a one-off adjustment; what you publish is a daily practice. The second one is what counts.
The second mistake is believing nothing can be done because "everything is already online". That's false: what matters to a fraudster is current information: your carrier today, your address today, your situation today. Stopping the flow has an immediate effect.
Where to actually start
- Turn off geolocation in your phone camera. One toggle, once, tonight.
- Remove your full date of birth from your profiles, and ask your relatives not to publish it.
- Hide your contact list and prune the requests you accepted without thinking.
- View your profile in public mode and note the three most revealing items to remove.
- Adopt the return rule: travel photos get posted once you're home.
- Before every post, look at the background before you look at the subject. Three seconds, every time.
Conclusion
Social media security isn't decided in a settings menu. It's decided by a habit: knowing what a post gives away, on top of what it shows.
An attacker preparing an impersonation hacks nothing. They read. And most of what they need (your date of birth, your approximate address, your dog's name, your schedule, your circle) was published voluntarily, free of charge, by you or by the people close to you.
Look at the background. Post on your return. Remove the date of birth. Assume it will be read.
Companion sheet: Download the printable A4 PDF
Sources and further reading
- EXIFData: Do social media sites strip EXIF data? 2025 test. Platform-by-platform testing: what is actually removed on upload, and what is added back.
- Wux Webtools: Removing EXIF metadata before sharing photos (in French): inconsistent stripping across platforms and formats, metadata surviving in messaging and attachments.
- MetadataRemover: Does social media strip metadata? (in French): why platforms remove this data and why policies change over time.
- Removing EXIF data from your photos (in French): what a smartphone photo's metadata actually contains and how to strip it.