Facebook remains one of the most data-hungry platforms on the internet. Beyond the posts and photos you deliberately share, it tracks your offline purchases, the apps on your phone, the websites you visit, the contents of your photos, and your physical location throughout the day. The good news is that Facebook does offer privacy controls. The bad news is that they are buried deep in menus and almost never turned on by default. This guide walks you through every setting you need to change to reclaim your privacy on Facebook in 2026.
What Facebook Actually Knows About You
Before diving into settings, it helps to understand the scope of Facebook's data collection. The platform does not merely record your posts and likes. Its tracking extends to:
- Offline purchases: Through partnerships with data brokers and retailers, Facebook can link your in-store purchases to your profile.
- Apps and websites: The Meta Pixel and Facebook SDK are embedded in millions of apps and websites, reporting your activity back to Facebook even when you are not using the platform.
- Photo contents: Facebook's computer vision systems analyze the content of your photos, identifying objects, locations, and people.
- Physical location: If location services are enabled, Facebook logs where you go, how long you stay, and which businesses you visit.
- Relationship status, employer, and education: Advertisers can target you based on these profile details, even if you think they are only visible to friends.
Default Settings Are Not on Your Side
Facebook's default privacy settings are designed to maximize data collection and ad revenue, not to protect you. Every new feature typically launches with the most permissive settings enabled. If you have never manually adjusted your privacy controls, assume that nearly everything about your account is accessible to advertisers, app developers, and in many cases the general public.
Step 1: Lock Down Your Ad Preferences
Facebook's advertising system is the engine that drives its data collection. Limiting what advertisers can use to target you is one of the most impactful changes you can make.
Navigate to Settings & Privacy > Privacy Checkup > Your Ad Preferences. From here you can:
- Prevent advertisers from targeting you based on your relationship status.
- Remove your employer and education history from ad targeting criteria.
- Review and remove interest categories that Facebook has assigned to your profile based on your activity.
- Disable ads based on data from advertising partners.
Take your time in this section. Facebook often groups dozens of interest categories together, and each one represents a data point that advertisers can exploit.
Step 2: Disable Location Tracking
Go to Settings & Privacy > Settings > Location and turn off location tracking entirely. Additionally, open your phone's system settings and revoke Facebook's access to location services. Even with Facebook's internal setting disabled, the app may still request location data through your operating system if you have granted it permission there.
Disabling location tracking prevents Facebook from building a detailed map of your daily movements, which it uses for hyper-targeted local advertising and shares with third-party partners.
Step 3: Clear Off-Facebook Activity
This is one of the most important and least-known privacy settings on the platform. Navigate to Settings > Your Facebook Information > Off-Facebook Activity > Clear History.
Off-Facebook Activity is the data that other apps and websites send to Facebook about your behavior. Every time you visit a site with a Meta Pixel, make a purchase through a connected retailer, or use an app with the Facebook SDK, that activity gets linked to your profile.
Clearing this history breaks the connection between your Facebook account and that external data. However, this is not a one-time fix. Facebook begins collecting off-Facebook activity again immediately, so you should return to this setting and clear it regularly, ideally once a month.
Set a Monthly Reminder
Add a recurring calendar event to clear your off-Facebook activity on the first of each month. The data accumulates quickly, and there is currently no way to permanently opt out of its collection. Regular clearing is the only way to limit its impact on your profile.
Step 4: Restrict Your Post Audience
By default, your posts may be visible to the public or to friends of friends. Change this by going to Settings & Privacy > Settings > Privacy and setting your default audience to Friends only.
Equally important, use the Limit Past Posts tool in the same section. This retroactively changes the audience of all your previous public posts to Friends only. Without this step, years of old posts, photos, and check-ins remain publicly searchable and scrapable by data brokers.
Step 5: Strip Personal Information from Your Profile
Visit your profile and remove any sensitive information that does not need to be there:
- Phone number: Remove it from your public profile entirely. If Facebook requires it for account verification, set its visibility to "Only Me."
- Email address: Similarly, hide your email or remove it from the visible profile fields.
- Home address: There is no reason this should ever appear on a social media profile.
- Workplace and education: Consider whether the networking benefits outweigh the privacy risks. Advertisers and data brokers use these details extensively.
Step 6: Turn Off Face Recognition
If your account still offers the face recognition setting, turn it off. Navigate to Settings & Privacy > Settings > Face Recognition and select No. While Meta has announced various changes to its facial recognition program over the years, the setting may still be active on older accounts. Disabling it prevents Facebook from automatically identifying you in photos and videos uploaded by other people.
Step 7: Enable Two-Factor Authentication
Go to Settings & Privacy > Settings > Security and Login > Two-Factor Authentication. Choose Authentication App as your method rather than SMS. Text-message-based two-factor authentication is vulnerable to SIM-swapping attacks, where a criminal convinces your phone carrier to transfer your number to their device. An authenticator app like Google Authenticator, Authy, or Microsoft Authenticator generates codes locally on your device and is significantly more secure.
Step 8: Audit Third-Party App Permissions
Over the years, you have probably signed into dozens of apps and websites using your Facebook account. Each of those connections is a potential data leak. Go to Settings > Apps and Websites and review every connected app.
- Remove any app you no longer use.
- For apps you want to keep, click on them to review exactly what data they can access, and revoke any permissions that are not strictly necessary.
- Disable the platform entirely if you never use Facebook login for third-party services.
Step 9: Enable Login Alerts
Under Settings > Security and Login > Setting Up Extra Security, enable notifications for unrecognized logins. Facebook will alert you via email or push notification any time your account is accessed from a new device or browser. This gives you an early warning if someone gains unauthorized access to your account, allowing you to change your password and secure your data before serious damage is done.
Beyond Facebook Settings: The Data Broker Problem
Here is the uncomfortable truth: even if you follow every step in this guide perfectly, your personal information is still out there. Data brokers operate independently of Facebook, aggregating your data from public records, previous data breaches, retail loyalty programs, and years of scraped social media content. These brokers compile detailed profiles containing your name, address, phone number, email, family members, employment history, and more, then sell them to anyone willing to pay.
Facebook privacy settings control what the platform collects going forward. They do nothing about the information that has already been harvested and distributed across hundreds of data broker databases.
This is exactly the problem that PrivacyOn is built to solve. PrivacyOn continuously scans over 100 data broker sites for your personal information and submits removal requests on your behalf. While you lock down your Facebook account to stop new data from leaking, PrivacyOn works in the background to clean up the data that has already escaped into the broker ecosystem. Together, strong Facebook settings and ongoing data broker removal through PrivacyOn provide comprehensive privacy protection that neither approach can achieve alone.
Your Privacy Action Plan
You do not need to complete all nine steps in a single sitting. Start with the three highest-impact changes: clear your off-Facebook activity, restrict your post audience and limit past posts, and enable two-factor authentication. Then work through the remaining settings over the next few days. Set a quarterly reminder to revisit these settings, because Facebook frequently updates its privacy options and occasionally resets preferences during major platform changes.
Taking control of your Facebook privacy requires deliberate, sustained effort, but every setting you change makes it harder for advertisers, data brokers, and bad actors to profit from your personal information. Pair these settings with a data removal service like PrivacyOn, and you will have built a privacy foundation that protects you both on and off the platform.