Facebook Privacy Settings: A Checklist With Trade-offs

#cyber-hygiene #facebook #privacy-settings #consumer-security #privacy-checkup #accounts-center

November 7, 2026 · PlayCISO

TL;DR · the short version

Open Settings & privacy and run Privacy Checkup, which Meta says covers who can see what you share, account security, how people find you, apps and websites you logged into with Facebook, and ad preferences. Then check your friends list audience, tag review, apps and websites, and where you are logged in. Every setting has a trade-off: a friends list set to Only Me can still show through a friend's public list, tag review does not stop people tagging you, and turning off apps breaks logins with Facebook elsewhere.

Put it into practice

Weigh the trade-offs in the Facebook Privacy Settings Lab

Eleven scored decisions on an old profile. Fictional people, no real accounts.

Open the lab

The quickest way to tighten Facebook is to open Settings & privacy and run Privacy Checkup. Meta's help page describes it as a guided walk through who can see what you share, account security, how people find you, the apps and websites you have used Facebook to log into, and your ad preferences. It does not cover every setting, so this checklist goes through the rest and, for each one, tells you what it does and what it costs. Meta renames menus often and the steps differ between the website and the apps, so where the exact path matters we link Meta's own help page.

There is no single "most private" setting. Each choice trades a little convenience, reach or reciprocity for a little privacy, and the right answer depends on how you use Facebook. If your account has already been taken over, start with our guide to a hacked Facebook account instead; this page is about getting the settings right before anything goes wrong.

Do this now: the 15-minute pass

Run Privacy Checkup. On a computer, Meta says to click your profile picture, choose Settings & privacy, then Privacy Checkup, and pick a topic. Meta notes you can only manage some of it from your main profile.
Set the audience for your profile details one item at a time, and use the View As tool to see your profile as others do.
Decide who sees your posts, both new ones and old ones, and who can post on your profile.
Choose who sees your friends list and read the caveat below first.
Narrow who can look you up by phone number or email, and who can send friend requests.
Turn on review for tags so you decide what appears on your profile.
Remove apps and websites you no longer use, and look at your ad preferences and off-Facebook activity controls.
Check your location permission on the phone.
Check where you are logged in, log out of sessions you do not recognise, and turn on login alerts and two-factor authentication.

You can rehearse these choices in the Facebook Privacy Settings Lab, a scenario with fictional people where nothing real is at stake.

Who can see your profile and posts

Profile details

Meta's help page says to click About below your cover photo, choose Options next to an item, then Edit, and use the audience selector. This applies to items such as places you have lived and family and relationships. It also says some information is visible to anyone: your name, profile picture, cover photo, gender, username, user ID and networks. So the aim is not to vanish, it is to stop volunteering the extras. The cost of narrowing: people who have lost touch with you find it harder to confirm they have the right person.

Your posts

You choose an audience each time you post. For what other people post on your profile, Meta's help page points to the setting "Who can see what others post on your profile?" under Profile and tagging, with audiences such as Friends or Public. Meta adds a caveat worth remembering: posts on your profile may appear in other places on Facebook, such as Feed and Search, for the people in the audience they were shared with.

Older posts

Meta has a separate help article, titled "Choose who can see your previous posts on Facebook", for changing the audience of posts you shared years ago. A bulk change is a quick first pass, but read the page for what it changes and what it leaves alone, and look through anything sensitive by hand. Audiences set on a post decide who sees it, whether or not anyone is tagged.

Your friends list

Meta's help page says to go to Settings & privacy, then Settings, then Audience and visibility, then How people find and contact you, and choose Who can see your friends list. It says the list is public by default. A public list is useful to scammers, who can copy your friends' names to build a lookalike profile.

The trade-off is the part people miss. Meta says your setting only controls the list on your profile. Your friends control who can see their own friendships, so setting yours to Only Me does not hide the friendship if your friend's list is public. People visiting your profile may also still see mutual friends. Set it to Friends or Only Me anyway, and ask close friends to do the same.

Who can find you

Privacy Checkup has a "how people can find you" section. Meta says it lets you choose who can send you friend requests and who can look you up on Facebook by your phone number or email address. A narrower choice, such as Friends, cuts down the strangers who find you by a number they already have. The cost is that an old friend who only has your number may not find you. Meta also has a help article on who Facebook can suggest your profile to based on your email or phone number. Neither setting hides you from a search by name.

Useful next, if this was relevant to you

Tags and timeline review

Under Settings, then Profile and tagging, Meta says you can turn on review so you approve or dismiss tagged photos, posts and app activity before they appear on your timeline. It also says you can still be tagged, and the tagged content is shared with the audience the person who posted it chose. So review protects your profile, not the post. If a tag worries you, ask the person to remove it, and use the review setting for next time.

Apps and websites

Under Settings, then Apps and Websites, you can see what you connected with Facebook. The old quiz or game you logged into years ago may still be there. Meta's help page describes the master switch for apps, websites and games: turning it off removes apps and games connected to your account, including outside accounts you linked. The costs it lists are that you cannot log into other apps or websites with Facebook, you may permanently lose app data such as high scores, and posts those apps made to your timeline may be removed. If you use "Log in with Facebook" on sites you care about, remove the ones you do not use rather than switching off everything. Privacy Checkup also covers this under data settings.

Ads and activity off Facebook

Privacy Checkup includes ad preferences: the profile information advertisers can use to reach you, and who sees your likes or follows beside ads. Separately, Meta publishes controls for activity off Meta technologies, which is information other businesses share about your use of their apps and sites. Meta's earlier Off-Facebook Activity page says disconnecting this does not delete the data. Meta's help pages also note some of these features are not available in every region, so what you see depends on where you are. Expect to keep seeing ads either way; the controls change what they are based on.

Location

Meta's help page puts the main control on the phone: in your device's settings, find Facebook and set its location permission, with choices on Android such as Allow only while using the app, Ask every time or Don't allow. While using the app covers most features. Meta also says that when Location Services are off, it may infer your location from things such as check-ins, events and your IP address, so turning the permission off is a real reduction, not a guarantee. Think twice before checking in while you are away from home.

Where you are logged in, and the account itself

Audience settings control who sees things. They do nothing if someone else logs in as you. Meta's help page says to open Password and security in Accounts Center, choose Where you're logged in, and review the sessions. Each shows a date, time, location and device type. You can select devices and log out, which takes effect immediately on those devices. Meta notes it is gradually moving people to Meta Accounts, so you may see Accounts Center or Meta Account settings. In the same area Meta lists password changes, two-factor authentication, login alerts and login activity.

Use a unique password from a password manager.
Turn on two-factor authentication. Where offered, a passkey or authenticator app is stronger than text messages; our Passkey Lab shows how they work.
Turn on login alerts, which Privacy Checkup lists under account security.
Keep your recovery email and phone number current.

How to tell it is working

View As shows only what you meant to show.
Your friends list is hidden on your profile, and you understand that a friend's public list can still reveal the link.
Where you're logged in lists only your own devices.
The Apps and Websites list holds only things you still use.
A web search for your name shows what you expect; our Digital Footprint Check can help.

Prevent it next time: a checklist

Re-run Privacy Checkup every few months, and after any change to the app.
Set your default audience for new posts to Friends.
Turn on tag review.
Remove apps and websites you no longer use.
Check Where you're logged in after travelling or lending a device.
Keep two-factor authentication and login alerts on.
Do not accept friend requests from people you do not know, since everything shared with Friends is shared with them.
Be wary of messages that say your page violates a rule and ask you to click; if you are caught out, see our hacked Facebook guide and the Facebook Hacked Recovery Lab.

Frequently asked questions

What are the most important Facebook privacy settings?

Start with Privacy Checkup, which Meta says covers who can see what you share, account security, how people find you, apps and websites you used Facebook to log into, and ad preferences. Then check your friends list audience, profile and tagging settings, apps and websites, and where you are logged in.

If I set my friends list to Only Me, can people still see who my friends are?

Possibly. Meta says your setting only controls the list on your profile. Your friends control who can see their own friendships, so a friend with a public list can still show the connection, and people visiting your profile may still see mutual friends.

Does turning on tag review stop people tagging me?

No. Meta says you can still be tagged with timeline review on, and that the tagged content is shared with the audience the person who posted it chose, such as in Feed and search. Review controls what appears on your own timeline.

Does turning off Apps, websites and games delete my data at those apps?

Meta says it removes the apps and games connected to your Facebook account, that you will not be able to log into other apps or websites with Facebook, and that you may permanently lose app data such as high scores. The page does not say it deletes data those companies already hold.

How do I log out of Facebook on a device I do not recognise?

Meta says to open Password and security in Accounts Center, choose Where you're logged in, select the sessions and log out. Each entry shows a date, time, location and device type, and logging out takes effect immediately on the selected devices.

Does location off mean Facebook cannot tell where I am?

Not entirely. Meta says that when Location Services are turned off it may infer your location from things such as check-ins, events and your IP address.

Sources

This is general guidance. Meta's menus and wording change by version and platform, and some features vary by region; follow the official help pages above for the current steps.

Weigh the trade-offs in the Facebook Privacy Settings Lab

Eleven scored decisions on an old profile. Fictional people, no real accounts.

Open the lab