Where to find Facebook's privacy controls
Facebook's privacy settings live in one place: the Settings and Privacy menu in the top right corner of your screen. Click the downward arrow next to your profile picture, then select "Settings and privacy," then "Settings." On the left side, you'll see a menu with "Privacy" as one of the options. This is where you control who sees your posts, your friend list, your photos, and other information about you.
The controls here work in layers. You can set a default privacy level for all new posts you create, then override that setting for individual posts. You can also hide past posts from specific people or from the public entirely. Facebook also lets you control who can contact you, who can see your friend list, and who can look you up by email or phone number — settings that matter if you're trying to limit how much information data brokers can find about you.
Key Takeaways
- Your default post privacy setting controls who sees new posts unless you change it for each one, and you can find it under Settings > Privacy > Who can see your posts.
- You can hide your friend list from the public or from specific people, which prevents data brokers from scraping a list of people connected to you.
- Turning off the ability to be found by email or phone number stops Facebook from showing your profile to people searching for you that way.
- The "Limit Past Posts" button hides everything you posted before you changed your settings, but only from people who aren't already your friends.
- Facebook's "Off-Facebook Activity" tool shows you which apps and websites have tracked you and lets you disconnect that tracking.
Setting who can see your posts
When you create a new post, Facebook shows you a privacy button before you hit "Post." It usually says "Friends" or "Public" depending on what you chose last time. Click that button to change it for that single post. Your options are "Public" (anyone on the internet can see it), "Friends" (only people you've added as friends), "Friends except..." (everyone except specific people), or "Only me" (nobody else sees it at all).
To set a default for all future posts, go to Settings > Privacy > Who can see your posts. Choose the level you want, and every new post will use that setting unless you change it in the moment. This matters for data brokers because the less you post publicly, the less information they have to scrape and resell. Setting your default to "Friends" or "Only me" means you're not constantly feeding new information into the public internet.
Hiding your friend list and contact information
Your friend list is public by default, which means anyone — including data brokers — can see who you're connected to. To hide it, go to Settings > Privacy > Who can see your friends list. Change it from "Public" to "Friends only" or "Only me." If you choose "Friends only," your actual friends can still see the list, but strangers and automated scrapers cannot.
You should also control how people find you. Go to Settings > Privacy and look for "Who can look you up using the email address you provided" and "Who can look you up using the phone number you provided." Change both from "Everyone" to "Friends" or "Only me." This stops Facebook from showing your profile to someone who types your email or phone number into the search box — a common way data brokers locate and link information about you across the internet.
Limiting what you've already posted
If you've been posting publicly for years, changing your default setting only affects new posts. To hide old ones, Facebook offers a "Limit Past Posts" button. Go to Settings > Privacy and scroll down until you see it. Click it, and Facebook will change the privacy level of everything you posted before that moment to "Friends only." This doesn't delete the posts; it just hides them from people who aren't your friends.
This tool is useful if you're trying to reduce your public footprint after realizing data brokers have been collecting your information. It won't undo what's already been scraped and sold, but it stops new scraping from happening. Keep in mind that anything you've already shared with the public is likely already in a data broker's database, so limiting past posts is a forward-looking step, not a cleanup of what's already out there.
Controlling who can contact you
Data brokers sometimes use Facebook to verify information about you or to contact you directly. You can make that harder by limiting who can message you. Go to Settings > Privacy > Who can send you friend requests. Change it from "Everyone" to "Friends of friends" or "Friends only." You can also go to Settings > Privacy > Who can contact you and set it to "Friends" instead of "Everyone."
These settings don't stop determined people from finding workarounds, but they do reduce the casual contact that data brokers might use to verify your information or to sell you something. They also reduce the noise in your inbox from strangers, which is a side benefit.
Disconnecting apps and websites that track you
Facebook tracks you across the internet through a tool called the Facebook Pixel, which is code that websites install to see what you do on their pages. Facebook then uses that information to show you targeted ads and to build a profile of your interests. You can see which apps and websites are tracking you and disconnect that tracking.
Go to Settings > Apps and websites > Logged in with Facebook. You'll see a list of apps and websites that have permission to access your Facebook data. Review this list and remove any you don't recognize or no longer use. Then go to Settings > Apps and websites > Off-Facebook Activity. This tool shows you which websites have sent Facebook information about you. Click "Clear history" to tell Facebook to stop using that data to target ads to you. This won't stop the websites from tracking you, but it stops Facebook from combining that tracking data with your Facebook profile.
What privacy changes don't do
Changing your Facebook privacy settings stops Facebook and other websites from collecting new information about you going forward, but it does not remove information that's already been collected. If a data broker has already scraped your public posts, bought your information from a data source, or received it from another company, changing your privacy settings won't erase their copy of it.
Facebook privacy settings also don't control what Facebook itself does with your data. Facebook still collects information about you based on what you do on the platform — what you like, what you search for, what you click on — and uses that for advertising. Changing privacy settings controls who else can see that information, not whether Facebook collects it in the first place. If you want to limit Facebook's own data collection, you'll need to use additional tools like the Off-Facebook Activity feature mentioned above, or consider reducing how much you use the platform.
Frequently Asked Questions
Can I make my profile completely invisible to people who aren't my friends?
You can hide most of your information, but Facebook doesn't offer a fully invisible profile. Even with all privacy settings at maximum, people who aren't your friends can still see your profile picture, your name, and your username. If you want to be completely invisible, you would need to deactivate or delete your account. Deactivation hides your profile temporarily; deletion removes it permanently after 30 days.
If I change my privacy settings, will data brokers delete information they already have about me?
No. Changing your Facebook privacy settings only stops new information from being collected going forward. Data brokers that already have your information will keep it unless you contact them directly and request removal. You'll need to go through each data broker's removal process separately, which is why you may have arrived at this article from a guide about removing yourself from data broker websites.
Does limiting past posts delete them?
No, it hides them. The posts still exist on Facebook's servers and in your account history. Limiting past posts changes who can see them — it moves them from public to friends-only. If you want to actually delete a post, you have to delete it individually by clicking the three dots on the post and selecting "Delete."
What's the difference between "Friends" and "Friends except"?
"Friends" means only the people you've added as friends can see the post. "Friends except" lets you post to friends but hide it from specific people on your friends list — useful if you want to share something with most friends but not with one or two. Both are more private than "Public" but less private than "Only me."
If I turn off Off-Facebook Activity tracking, will websites stop tracking me?
No. Turning off Off-Facebook Activity only stops Facebook from seeing what you do on other websites. The websites themselves will still track you — they'll just do it without sending that information to Facebook. If you want to stop websites from tracking you entirely, you need browser privacy tools or extensions that block tracking pixels and cookies.