Most privacy settings that actually matter aren't the ones platforms put front and center during onboarding. They're a few menus deep, on by default, and quietly do more work than people realize.
Instagram and Facebook
- Location metadata attached to photos - often still embedded even after you delete the post that used it
- "Public" as the default audience for new posts, reset after certain account changes
- Contact sync, which uploads your entire address book to suggest friends, silently linking people who never signed up
- Ad personalization built from off-platform activity, not just what you do inside the app
- "Who can see your connections" defaults to public, exposing your entire professional network to anyone
- Profile viewing shows your name to people you look up, unless you switch to private mode
- Data shared with LinkedIn's partners for research, on by default under "Data privacy"
YouTube
- Watch history and search history feed recommendations and are visible in your account activity unless paused
- Old comments and playlists often stay public long after the account that made them stopped being active
- Subscriptions are public by default, which quietly signals a lot about a person's interests
Defaults are a business decision, not a safety recommendation. Reviewing them is the least glamorous, most effective privacy work there is.
None of this requires deleting accounts you actually use. It's a twenty-minute pass through settings most people last touched during signup - worth doing once and then again after any major app update, since defaults have a habit of resetting.