Most people set their privacy settings once, when they first join a platform, and never look at them again — while the platform itself keeps changing its defaults, adding new features, and occasionally resetting things during updates. A twenty-minute audit, done once or twice a year, closes most of the gap.
What to check, and why it matters
Who can see your posts. This is the obvious one, but worth revisiting specifically: a profile set to "public" years ago, when you had a handful of followers, means something quite different now if it's grown into hundreds of loosely-known connections. Consider whether "public" still matches who you'd actually want reading everything you post.
Location tagging. Many platforms tag posts with location by default, and photo metadata can embed GPS coordinates even when you don't manually tag anything. A pattern of location-tagged posts over time can reveal your home area, your child's school, or your regular routine to anyone who cares to look — worth turning off by default and adding manually only when you actually want to.
Tagging and mentions. Check whether you can review a photo or post before it appears associated with your name. This matters less for your own posts and more for what other people post about you — a setting worth having even if you personally never post anything sensitive.
Old posts. Most platforms now let you bulk-adjust the audience for past posts, not just future ones. If your account has existed for a decade, it's worth a look — early posts made under a much more permissive default setting often stay that way indefinitely unless changed.
Connected apps and third-party access. Over the years, most people grant a long list of apps and games permission to access their social accounts — a quiz app, an old game, a service they used once. Each one is a potential point of exposure if that third party is ever breached. Reviewing and revoking access for anything you no longer use is a genuinely useful, if slightly tedious, cleanup.
Two-factor authentication. Worth stating again in this context specifically: a compromised social media account is often used to scam your own friends and family, since messages "from" someone you know carry far more trust than a message from a stranger. Securing your own account is partly about protecting the people who trust it's really you.
The piece that settings can't cover
Privacy settings control who can see what you post — they don't control what you choose to post in the first place. A public-facing habit worth building alongside the settings audit: before posting anything that reveals a location, a routine, or travel plans in real time, consider whether it can wait until after the fact. A holiday photo posted once you're home reveals the same memory with none of the "this house is currently empty" signal that posting it live does.
A reasonable cadence
Twice a year is enough for most people — reviewing settings alongside something you're already doing, like a birthday or the start of a new year, makes it more likely to actually happen than leaving it as an open-ended "someday" task.