Facebook, Instagram and YouTube have privacy practices that could put your data at risk

social media app shortcuts shown off on an iphone
(Image credit: Pexels)

Even if you take steps to protect your data privacy like using one of the best VPNs, doing something as simple as using social media could still put your personal information at risk.

In fact, research by personal data removal service Incogni has shown just how insecure some social media platforms' privacy practices are, with Facebook, Facebook Messenger and LinkedIn having the weakest.

Facebook has the weakest privacy practices, research from privacy platform Incogni has found.

Incogni has performed a comprehensive analysis of the way various social media platforms handle user data. It has found that many social media sites have dodgy data retention practises, with many storing your data for up to 180 days after you've deleted your account.

On the flip side, the sites leading the way for privacy-focused social media are Reddit, as well as Snapchat and Pinterest.

WeChat and WhatsApp icon on a smartphone. WeChat is a Chinese multi-purpose messaging, social media and mobile payment app

(Image credit: IB Photography | Shutterstock)

In its ranking, Incogni looked at the data collected and stored by the platforms, the control users have over their data, the number of government fines and data breaches experienced by each platform, how accessible certain features are for users and how much user data reaches governments. It also studied how easy to understand the platform's privacy policy is and how simple it is for a user to delete their account.

It was the data collection and retention category that contributed the most to the poor scores for Facebook and Facebook Messenger, as the Meta-owned platforms (along with Instagram, YouTube and Discord) all retain user's information for up to 180 days after their accounts are deleted. This is compared to secure messaging app Telegram, which keeps this data for just a day.

This is significant as this means user's data (including names, personal photos, messages, health details and financial details) could be retained by the social media sites for up to six months after users believe they have been deleted. This puts this personal information at risk of data breaches and even data theft.

With only four platforms not experiencing any government fines or data breaches (Reddit, Quora, Discord and Telegram), this could potentially be devastating for former users of these social media sites.

A chart showing the results of Incogni's data privacy research into social media sites

(Image credit: Incogni)

Even if you want to delete your social media accounts, and by extension the data associated with it, this is no mean feat.

Incogni's research found that some social media platforms are particularly difficult to actually delete your information from, with Facebook, YouTube, Instagram, and Messenger taking six steps to delete your account.

Other social media platforms, for example TikTok, Telegram, Discord, only take two steps, meaning that its far easier to remove yourself from these platforms.

Darius Belejevas, data privacy expert and head of Incogni, said of the findings: “Social media platforms facilitate rich and meaningful interactions but they also pose significant privacy and data security risks.

“Users may be shocked to discover that some social media platforms hold onto their data for six months after they have deleted their account.

“It raises big questions about what happens to that data, whether it’s being sold to third parties and if people could be unknowingly caught up in data breaches long after they thought they’d severed connections with a platform.

“Our ranking provides an important glimpse into how highly social media platforms value their users’ privacy and whether they are doing enough to keep data secure.”

Facebook, Instagram, YouTube, Pinterest, X, LinkedIn, Reddit, TikTok, Threads apps on an iPhone

(Image credit: Getty Images)

How can I improve my data privacy on social media?

If you're concerned about your personal data falling into the wrong hands via social media, there are steps you can take to keep yourself safe.

A spokesperson from Incogni, Emilia Jasinska-Dias, recommended that people opt for social media platforms that don't require you to input your real details when registering. The majority of the social media platforms analysed in the research do require this.

Jansinska-Dias also recommends that people take note of what social media platforms are actually owned by other, larger companies: "It’s worth noting that platforms belonging to Google and Meta make managing your privacy more complicated. 

"Users need to be aware that most platforms are integrated into a bigger group, which might affect the scope of data handling."

Olivia Powell
Tech Software Commissioning Editor

Olivia joined Tom's Guide in October 2023 as part of the core Future Tech Software team, and is the Commissioning Editor for Tech Software. With a background in cybersecurity, Olivia stays up-to-date with all things cyber and creates content across TechRadar Pro, TechRadar and Tom’s Guide. She is particularly interested in threat intelligence, detection and response, data security, fraud prevention and the ever-evolving threat landscape.