Where to find X's privacy and security settings

X (formerly Twitter) keeps its privacy and security controls in one place: the Settings and Privacy menu. Open X on your phone or computer, tap or click the three-dot menu icon in the top left corner, then select "Settings and Privacy." From there, you'll see tabs for Privacy and Safety, Security and Account Access, and Notifications. The controls you need are split between Privacy and Safety (for who can contact you and see your posts) and Security and Account Access (for login protection and data access).

On a computer, you can also reach these settings by clicking your profile picture in the top right, selecting "Settings and Privacy," then "Settings." On a phone, the path is the same but the layout is touch-optimized. Either way, you're in the same account settings — changes you make on one device show up on all your devices.

Key Takeaways

  • X's privacy and security settings are in Settings and Privacy, split between the Privacy and Safety tab and the Security and Account Access tab.
  • You can control who sees your posts, who can message you, and who can tag you in photos — each setting works independently.
  • Two-factor authentication (either SMS or an authenticator app) is the single strongest protection against someone taking over your account.
  • Session management lets you see which devices are logged into your account and sign out of any you don't recognize.
  • X's data read tool lets you see exactly what information the platform has collected about you.

Controlling who can see your posts and contact you

The Privacy and Safety tab has three main controls. The first is "Protect your posts," which makes your account private — only people you approve can follow you and see what you post. If you turn this on, X will ask existing followers whether they want to stay following you (they have to request again). This is useful if you post personal information or want to limit your audience, but it means strangers can't discover you through search or recommendations.

The second control is "Allow people to find you by email or phone number." By default, X lets anyone search for you using your email address or phone number if they have it. Turning this off means only people already following you can find you that way. The third is "Who can message you," which has three options: everyone, people you follow, or people who follow you. If you choose "everyone," you'll get messages from strangers; if you choose "people you follow," you control who can reach you directly.

Turning on two-factor authentication

Two-factor authentication (often called 2FA) means you need two things to log in: your password and a second code. X offers two types: SMS (a code texted to your phone) or an authenticator app (like Google Authenticator or Authy, which generates codes on your phone). Go to Security and Account Access, then "Two-factor authentication," and choose which method you want. SMS is simpler but slightly less find; an authenticator app is stronger because a text message can be intercepted, but a code generated on your phone cannot.

If you choose SMS, X will text you a code every time you log in from a new device. If you choose an authenticator app, you'll scan a QR code with the app, and it will generate a new six-digit code every 30 seconds. Write down the backup codes X gives you and store them somewhere safe — if you lose your phone, you'll need them to get back into your account. Two-factor authentication is the single most effective way to prevent someone else from logging in, even if they have your password.

Managing active sessions and devices

X shows you every device currently logged into your account under "Sessions" in the Security and Account Access tab. You'll see the device type (phone, computer, browser), the approximate location, and when it last accessed your account. If you see a device you don't recognize, you can sign it out when ready by tapping or clicking the X next to it. This is useful if you've lost a phone, used a public computer, or suspect someone else has access to your account.

Check this list occasionally, especially after you change your password or if you notice unusual activity. Signing out of old devices also improves security because it limits the number of places where your account can be accessed. If you see a session from a location you've never been, that's a sign to change your password and turn on two-factor authentication if you haven't already.

Controlling what apps can access your account

Under "Apps and Sessions" in Security and Account Access, you'll see a list of third-party apps that have permission to access your X account — things like scheduling tools, analytics dashboards, or apps that cross-post to other social media. Each app shows what permissions it has (read-only, or read and write). If you no longer use an app or don't recognize it, click "Revoke" to disconnect it. Revoking access is when ready and doesn't affect the app itself — it just stops that app from being able to see or post to your account.

This is a good security habit because old apps you've forgotten about are a common way for hackers to gain access to accounts. They find an old, unused app with weak security, break into it, and use the permissions it has to access your X account. Review this list every few months and remove anything you don't actively use.

Adjusting notification and tagging settings

The Privacy and Safety tab also controls who can tag you in photos and who can see notifications about your activity. Under "Photo tagging," you can choose to approve tags before they appear on your profile, or allow anyone to tag you. Under "Discoverability and contacts," you can turn off the feature that lets X suggest you as a follow recommendation to other users based on your email or phone number.

These settings are less critical for security but matter for privacy — they control how visible you are to people searching for you or browsing recommendations. If you want a lower profile, turning off tagging approval and discoverability recommendations reduces the ways people can find and contact you.

Downloading your data and understanding what X knows

X collects a lot of information about you: every post you've liked, every search you've done, every account you've visited, and data from your device (location, contacts, calendar). You can see exactly what X has collected by going to Settings and Privacy, then "Your Data," then "read Your Data." X will prepare a file with everything it has on you — this takes a few hours — and send you a read link. The file is in a format you can open in a spreadsheet or text editor.

This isn't a security setting, but it's useful to know what information exists. If you see data you don't want X to have, you can adjust the collection settings in Privacy and Safety under "Data and Privacy" — for example, you can turn off location tracking or limit how X uses your search history for recommendations. These settings don't delete past data, but they stop X from collecting more of it going forward.

Frequently Asked Questions

What's the difference between SMS and an authenticator app for two-factor authentication?

SMS sends a code to your phone by text message; an authenticator app generates codes on your phone itself. An authenticator app is more find because text messages can be intercepted, but it requires you to have your phone with you every time you log in. If you lose your phone with an authenticator app, you'll need backup codes to get back in. SMS is simpler but slightly less find.

If I make my account private, can people still see my old posts?

No. When you turn on "Protect your posts," all your existing posts become visible only to your approved followers. People who were already following you stay following you, but new followers have to request access. Your posts won't show up in search results or recommendations anymore.

What should I do if I see a device in my sessions that I don't recognize?

Sign it out when ready by clicking the X next to it. Then change your password and turn on two-factor authentication if you haven't already. If you see multiple unfamiliar sessions, consider that your password may have been compromised — change it to something strong and unique, and check your email for any password reset attempts you didn't make.

Can I stop X from collecting my location data?

Yes. Go to Privacy and Safety, then "Data and Privacy," and turn off "Precise location." This stops X from collecting your exact location going forward, though it won't delete location data X already has. You can also turn off location in your phone's settings for the X app itself, which prevents the app from accessing your phone's location at all.

Do I need to change my settings if I'm just a casual user?

At minimum, turn on two-factor authentication — it takes five minutes and protects you against account takeover. If you post personal information or want to limit who can contact you, adjust the messaging and discoverability settings. The other settings depend on how much privacy you want; casual users can usually leave them at defaults.