Social Media, Privacy and Your Digital Footprint
Where you are: Unit III — The Human Attack Surface · Lesson 3.5 · This lesson follows Chapter 8 of Dr. Al-Doori's Cyber Security Essentials, with the photo-location advice from Chapter 21.
Throughout this unit you have seen scammers use personal details to make their stories convincing, and public voice clips to clone voices. Much of that material comes from what people share themselves. This lesson closes the unit by helping you see your own profiles the way an attacker would, and adjust them without giving up the parts of social media you enjoy.
What you'll be able to do
Audit what your public profiles reveal and adjust your sharing so it does not hand attackers material for scams.
- Explain privacy as control, and why sharing is fine when it is a deliberate choice.
- Identify the kinds of posts that help scammers, from travel plans to voice clips and photo locations.
- Review your audience and location settings, and respond well if someone asks for your passwords.
Privacy is control
Dr. Al-Doori defines privacy in terms of control: deciding who knows what about you, and when. That definition is useful because it doesn't say "share nothing". Social media always involves revealing something: what you look like, who your friends are, what you enjoy. As the book says, sharing is the point. Trouble starts when people share more than they realise, with more people than they intend.
The book highlights three pitfalls, and each still applies:
- Too many "friends". Collecting contacts you barely know gives distant acquaintances the same view of your life as close friends.
- Copy and share. Anything someone can see, they can copy, screenshot and pass on. Deleting a post later doesn't recall the copies.
- Employers. Recruiters and employers may look you up, so what is public should represent you well.
Who sees what
Modern platforms give you more control than the book's era did. Most now let you choose an audience for each post (public, friends, a custom list or close friends) and set who can see your profile details, friend list and tagged photos. The UK's NCSC advises checking your privacy settings and thinking about who can see each post.
Settings change when apps update, and defaults often favour sharing. A quick review every few months is a good habit.
How attackers use what you post
From an attacker's point of view, public profiles are free research. The NCSC notes that criminals use information people share publicly to make their scams more convincing. Remember the CNN demonstration in Lesson 3.1: the attacker began with the reporter's public posts. Useful details for a scammer include:
- Personal facts such as your birthday, pets, school, family names and employer, which feed pretexts and guessable answers to old-style security questions.
- Travel and routine, such as "Off to Lisbon for two weeks!", which tells a scammer when a "stranded abroad" story will sound believable, and when your home is empty.
- Purchases and complaints, which reveal which companies you use and could be impersonated.
- Voice and video clips. The FBI warns that criminals use AI to clone voices and faces, and advises limiting the images and voice recordings you share publicly, making accounts private, and accepting requests only from people you know (Lesson 3.4).
Photo location
Photos taken on phones can carry hidden location metadata: data stored inside the image file that records where it was taken. Chapter 21 of the book warns that such location data in shared photos can lead people straight to your home, and recommends switching off location tagging on your camera.
Today you have two options:
- Remove location when sharing. On an iPhone, Apple's Personal Safety guide shows how: in the Share sheet, tap Options and turn off Location before sending. Other phones and apps have their own settings; look for "location" in the camera or sharing options.
- Stop the camera recording location in your phone's privacy or location settings, if you don't need it.
Also think about what's in the picture: house numbers, school uniforms, car number plates and boarding passes reveal a lot even without metadata.
Employers and passwords
The book advises preparing a polite refusal in case an employer ever asks for your social media password, and offering to show your public profile instead. That advice stands. Rules on employers requesting personal account passwords vary between countries and, in the US, between states. Whatever the rules where you live, never share passwords or one-time codes with anyone: not an employer, not a friend, not someone claiming to be from the platform. The FBI, for example, warns never to give your account password or PIN to a caller who asks for it.
Privacy-settings activity
Do this privately on your own phone or computer. You don't need to share or submit anything. Pick the social media account you use most.
- View your profile as the public. Many platforms have a "view as" or preview option; otherwise, log out or use a private browser window and look yourself up.
- Check your default audience for new posts and change it if "Public" isn't what you intend.
- Review older public posts that mention travel plans, your home area, your birthday, family members or your workplace. Limit or delete what you wouldn't tell a stranger.
- Check public voice and video clips. Decide whether each needs to be public.
- Turn off location on photo sharing, and review who can tag you.
- Prune your contacts. Remove people you don't actually know.
When you finish, note for yourself (not for anyone else) one change you made and one you plan to make. Capstone A will ask you to revisit this.
Real-World Example
Imagine: Daniel's public profile shows his dog's name, his birthday, his employer and a post saying he is "off to Lisbon for two weeks!", plus a short video of him talking. Two days later his grandmother gets a call in a voice that sounds like his: he's been robbed in Lisbon and needs money urgently. The caller even mentions the dog. Every detail came from Daniel's public posts, and the voice could have been cloned from his video.
His grandmother remembers the family code word and asks for it. The caller hangs up. Daniel later switches his default audience to friends, removes the video from public view and saves holiday posts for after he gets home. He still enjoys sharing; he just chooses who sees what.
From the Book to 2026
What the book teaches. Privacy is control over who knows what about you, and when; avoid "friend gluttony"; remember that anything posted can be copied; assume employers will look and never hand over your passwords; and (Chapter 21) switch off location tagging in your camera.
Why it made sense. Platforms then tended to give all friends the same access, so keeping your network small was the main control available. Every one of these points is still sound.
What has changed. Modern platforms have changed this risk. Per-post audience controls let you share different things with different people. There is also a new reason for care: the FBI warns that public images and voice recordings can feed AI voice and face cloning. Phones now let you remove location when you share.
What to do now. Review your audience settings, limit public voice clips and personal details, remove location when sharing photos, accept requests only from people you know, and never share passwords or codes.
Watch: What Do Your Digital Footprints Say About You? (TEDx Talks)
In this TEDx talk, Nicola Osborne of the University of Edinburgh explores the trail people leave online. It is about reputation rather than scams, so it complements the security focus of this lesson. The talk dates from 2016, so platform details have moved on.
As you watch, notice:
- The difference between the visible footprint you create on purpose and the invisible one, such as viewing and search history.
- The idea of context collapse: friends, family, colleagues and strangers all seeing the same posts, and why choosing your audience matters.
- How tagging means other people create part of your footprint, and her point that once something is out there it is hard to take back.
The video reinforces what you just read — the lesson is complete without it.
What Would You Do?
In a job interview, the interviewer says: "We like to check candidates properly. Could you log into your social media account on this laptop so we can look through it?" What do you say?
Knowledge Check
You want to share a photo of your new home's garden with friends. What is the best approach?
You get a friend request from someone you don't recognise who has several mutual friends. What should you do?
Answers explained
- Question 1 — b is right. Limiting the audience, removing location metadata and checking the background keeps the share deliberate. a is not right: location data inside the photo, or details in the picture, can reveal where you live. c is not right: anything public can be copied before you delete it. d is not right: deliberately leaving location on shares where you live, and photos are easily forwarded beyond the people you sent them to.
- Question 2 — c is right. The FBI advises accepting requests only from people you know, and checking through another channel follows the rule from Lesson 3.1. a is not right: mutual friends may have accepted the request without knowing the person, and accounts can be fake or copied. b is not right: once accepted, they can see whatever your friends can see before you change anything. d is not right: accepting first gives access before you have any reason to trust them.
- The interview (What Would You Do?): decline politely, as the book suggests. You might say you keep your accounts private but are happy for them to view your public profile. Never type your password where someone else controls the device or can watch. If the employer insists, you have learned something important about them.
Key Takeaways
- Privacy means control over who knows what about you, and when, not sharing nothing.
- Public posts give scammers material for pretexts, and public voice clips can feed voice cloning.
- Use per-post audience settings, prune contacts, and accept requests only from people you know.
- Remove location when sharing photos, and check what the picture itself reveals.
- Never share passwords or one-time codes with anyone, including an employer.
Sources
- UK NCSC — Social Media: how to use it safely
- UK NCSC — Phishing: Spot and report scam emails, texts, websites and calls
- FBI IC3 — Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public (PSA, 2022)
- FBI IC3 — Criminals Use Generative AI to Facilitate Financial Fraud (I-120324-PSA, December 2024)
- FBI IC3 — Senior US officials impersonated via smishing and AI voice (I-051525-PSA, May 2025)
- Apple — Manage location metadata in Photos (Personal Safety User Guide)
- National Conference of State Legislatures — Privacy of Employee and Student Social Media Accounts
- TEDx Talks — What Do Your Digital Footprints Say About You? (Nicola Osborne)
- Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 8: Social Media and Privacy; Chapter 21: Cyber Forensics