The 2026 Social Media Privacy Settings Checklist for Every Major Platform

Open Instagram. Tap your profile picture, then the three-line menu, then Settings and activity > Account privacy. Toggle Private account on. That single switch is the most impactful privacy move on any platform in 2026. It means only followers you approve can see your posts, stories, and Reels. It does not protect your profile photo or your username, which remain public. It does not stop someone from screenshotting your posts and sharing them elsewhere. Private account is a gate, not a vault.

Each major platform popular in Singapore has a specific settings path, and each toggle protects something different. The difference between blocking and muting matters. End-to-end encryption protects message text but not metadata, meaning WhatsApp knows who you talk to even if it cannot read the words. Follow the exact path below for Instagram, TikTok, Facebook, WhatsApp, Telegram, and Xiaohongshu, checked in September 2026. Every path here is the one you follow on a phone, because that is where you use these apps.

Control Who Sees Your Stories

Beyond the private account toggle, Instagram buries settings that matter. Go to Settings and activity > Who can see your content. Here you control Story sharing. Turn off Allow sharing to messages to stop anyone from sending your story to someone you do not know. Turn off Allow sharing to stories to prevent your story from being reposted. These do not stop screenshots. Nothing on Instagram stops screenshots.

Reduce Sensitive Material And Activity Tracking

Go to Settings and activity > Suggested content. Set Sensitive content control to Less. Instagram uses algorithmic curation to decide what you see. The default level shows you material the platform considers sensitive, which often includes algorithmically boosted controversial posts. Setting it to Less reduces the reach of those posts into your feed. It does not remove them entirely. It does not affect what your friends see from you.

Turn off Activity status under Messages and story replies. This stops others from seeing when you were last active. It also stops you from seeing theirs. The trade-off is that you cannot see if someone is currently typing to you. Decide which matters more.

Set Your Account To Private

TikTok’s privacy settings are split between account-level and content-level controls. Open the app, tap your profile, then the three-line menu, then Settings and privacy > Privacy. Set your account to Private. For users under 16, this is the default. For everyone else, it is optional. A private account means you approve each follower. It does not stop TikTok from collecting your viewing data for algorithmic curation. It does not stop the platform from using your data for ad targeting.

Lock Down Messages, Downloads, And Mentions

Under Privacy > Direct Messages, set who can message you to Friends (mutual followers) or No one. The Everyone option is the default and is how strangers send you unsolicited material. Under Privacy > Downloads, turn off Video downloads. This prevents others from saving your videos to their device. It does not prevent them from screen recording. On Android and iOS, screen recording cannot be blocked by an app.

Under Privacy > Comment filters, enable Filter spam and offensive comments and add a custom keyword list for terms specific to your situation. TikTok’s comment filter catches obvious slurs but misses context-dependent harassment. Custom keywords catch what the filter misses. Under Privacy > Mentions and tags, set Who can mention you to No one or Friends to control who can link your profile in their posts.

Restrict Post Visibility And Tagging

Facebook’s settings are spread across multiple menus. Start with Settings > Privacy. Set Who can see your future posts to Friends. This is the most important toggle. It defaults to Public, meaning anyone on the internet can see your posts. Changing it to Friends does not retroactively apply to old posts. For those, use Limit past posts under the same menu to change all old public posts to Friends.

Under Settings > Profile and tagging, set Who can see posts you are tagged in to Only me if you want to approve tags before they appear on your profile. Set Review tags people add to your own posts to On. This prevents anyone from tagging you in a post without your approval. Blocking prevents that person from seeing your profile at all. Muting hides their posts from your feed without them knowing. Use muting for people you do not want to unfriend. Use blocking for people you do not want to see anything you post.

Turn Off Ad Tracking

Under Settings > Ad preferences, go to Ad settings. Turn off Ads based on data from partners. Turn off Ads based on your activity on Meta products. This reduces the amount of data Facebook uses to target you with ads. It does not stop ad tracking entirely. Facebook still shows you ads based on your profile information, your age, and your gender. It stops the creepiest targeting, the kind based on your browsing habits outside Facebook. The data categories here are: your information (profile fields), your activity on Meta products, and data from partners about your offline activity. Turn off all three.

Hide Your Activity And Profile

WhatsApp is the most widely used messaging app in Singapore. Its privacy settings are in Settings > Privacy. Start with Last seen & online. Set it to My contacts or Nobody. The default is Everyone, meaning anyone who has your number can see when you were last active. This is a metadata exposure problem: the content of your messages is end-to-end encrypted, but who you talk to, when, and for how long is not. WhatsApp knows this. Meta knows this. Setting last seen to Nobody is the only way to hide your activity pattern.

Under Profile photo, set it to My contacts. Under About, set it to My contacts. Under Groups, set who can add you to groups to My contacts or My contacts except…. The default is Everyone, which is how you get added to spam groups. Under Status, set Who can see my status to My contacts or a custom list. Status updates are not end-to-end encrypted. Treat them as public posts.

Enable Two-Factor Authentication

Enable Two-factor authentication under Account > Two-step verification. This requires a six-digit PIN to register your phone number on a new device. It prevents SIM swap attacks where an attacker convinces your mobile provider to transfer your number to their SIM card. Two-factor authentication on WhatsApp is app-based, not SMS-based, which is the more secure method per NIST 2024 guidance and CSA recommendations. A hardware security key is more secure than an app-based one-time password, but WhatsApp does not support FIDO2 keys. Use what is available.

Restrict Who Sees Your Number And Activity

Telegram’s default privacy settings are loose. Open Settings > Privacy and Security. Set Last seen & online to Nobody or My contacts. Telegram offers a granular option: Always share with… and Never share with… which lets you allow specific contacts to see your status while blocking everyone else. This is more flexible than WhatsApp’s binary setting.

Set Phone number to Nobody. Telegram defaults to showing your phone number to anyone who finds you by searching. This is a major privacy risk. Setting it to Nobody means only your contacts can see your number. New contacts you message will not see your number unless you choose to share it.

Understand Encryption Limits

Set Profile photo to My contacts. Set Forwarded messages to Nobody to stop others from linking your account when they forward your messages. Telegram’s end-to-end encryption is not default. Only Secret Chats use end-to-end encryption. Regular chats and group chats are encrypted between your device and Telegram’s server, meaning Telegram can read them. If you want end-to-end encryption on Telegram, you must manually start a Secret Chat. Most users do not. The platform does not make this obvious.

Make Your Posts And Messages Private

Xiaohongshu (Little Red Book) is popular among Singaporeans for travel, beauty, and lifestyle posts. Its privacy settings are in Chinese by default, though an English interface is available. Open your profile, tap the three-dot menu, then Settings > Privacy. Set Who can see my notes to Friends only or Only me. The default is Public. This controls profile visibility: who can see your posts, your collection lists, and your profile.

Set Who can comment on my notes to Friends only or No one. Xiaohongshu’s comment section is where harassment and unsolicited promotion happen. The platform’s moderation is inconsistent. Set Who can send me private messages to Friends only or No one. The default is Everyone.

Hide Your Location

Set Hide my location to On. Xiaohongshu tags your posts with your location by default. This is location sharing that persists even if you do not add a location manually. Turning it off stops the app from appending your GPS coordinates to your posts. It does not stop the app from collecting your location data for its own purposes. The platform’s terms of service allow it to use your data for algorithmic curation and ad targeting. There is no toggle to opt out of data collection entirely.

Every privacy toggle on every platform protects something specific and misses something adjacent. Here is the pattern:

• Private account (Instagram, TikTok, Facebook): Protects your posts from being seen by non-followers. Misses your profile photo, username, and bio. Does not stop screenshots.
• Activity status (WhatsApp, Instagram, Facebook): Hides your online presence. Misses that the platform still logs your activity for its own analytics.
• Ad tracking toggles: Reduce the precision of ads shown to you. Misses that platforms still collect your data. The difference is whether they use it for targeting or for aggregate reporting.
• End-to-end encryption (WhatsApp, Telegram Secret Chats): Protects message text from being read by the platform or anyone intercepting the transmission. Misses metadata: who you talk to, when, and for how long. Metadata is often more revealing than the words themselves.
• Blocking: Prevents the blocked account from seeing your profile, contacting you, or interacting with your posts. The blocked person knows they are blocked if they search for you. Muting hides their posts from your feed without their knowledge. They can still interact with your public posts.
• Two-factor authentication: Protects your account from being accessed by someone who has your password. Misses the scenario where someone has physical access to your phone. A security key is more secure than an app-based code, which is more secure than SMS. Use app-based if a security key is not an option.

The most common mistake is thinking you have locked down your privacy when you have only locked down one app. A digital footprint is the sum of every platform you use. A private Instagram account does not protect you from a data breach on a shopping site where you used the same email address. Turning off ad tracking on Facebook does not stop Google from tracking your location through your phone’s settings. Privacy is not a single toggle. It is a practised habit across every service you use. The platforms change their settings paths every few months. The version you check today will be different by next year. Check again.

Use this as a repeatable checklist for each platform. Give it to a teenager who needs concrete steps, not panic. Show it to a small-business owner targeted by impersonation scams who needs pattern recognition, not technical jargon. For official communications or legal advice, go to the Personal Data Protection Commission or the Singapore Police Force.