Make Your Instagram Account Private: Guide

Last summer, a college student in Arizona discovered that someone had been using her public Instagram photos to create a fake dating profile. The catfisher had scraped dozens of her pictures, copied her bio, and was messaging people across three different apps. She only found out when a friend stumbled across the fake account and sent her a screenshot. The worst part? Everything the scammer needed was sitting right there on her public profile.

She's not alone. Your Instagram profile might feel like a cozy corner of the internet where you share brunch photos and vacation snapshots, but unless you've locked down your privacy settings, it's actually a public billboard that anyone can access, screenshot, scrape, and repurpose. And here's the thing most people don't realize: even after you make Instagram private, the platform is still collecting mountains of data about you.

Let's fix that.

Why Instagram Privacy Actually Matters More Than You Think

When Instagram launched in 2010, sharing everything publicly was the default — and honestly, the point. But the landscape has shifted dramatically. Today, your Instagram content doesn't just live on Instagram. It gets indexed by search engines, scraped by data brokers, harvested by AI training models, and yes, stolen by scammers creating fake profiles.

Making your Instagram account private isn't about having something to hide. It's about controlling who gets access to your digital presence. A public Instagram profile reveals your face, your location history (hello, geotagged photos), your social network, your interests, your daily routine, and often your full name. That's a goldmine for identity thieves, stalkers, and the sprawling data broker industry that profits from aggregating this information.

The FTC reported over 5.7 million fraud and identity theft cases in 2023, and social media profiles consistently rank as one of the primary sources for gathering victim information. When your profile is public, you're essentially doing the reconnaissance work for bad actors.

But beyond individual security threats, there's a broader privacy ecosystem at play. Data brokers systematically scrape publicly available social media profiles to build shadow profiles about you — detailed dossiers they sell to marketers, employers, landlords, and anyone else willing to pay. Our analysis of thousands of data broker profiles at GhostMyData shows that social media data appears in roughly 68% of the comprehensive people-search reports we remove.

How to Make Your Instagram Account Private: Step-by-Step

Ready to lock things down? The actual process takes about 30 seconds. Here's exactly how to make Instagram private, whether you're on mobile or desktop.

Step 1: Open Your Instagram Settings

On the Instagram mobile app, tap your profile picture in the bottom right corner, then tap the three horizontal lines (the hamburger menu) in the top right. Select "Settings and privacy" from the menu that appears.

On desktop, go to instagram.com, click your profile picture, then click the gear icon next to "Edit profile" and select "Settings and privacy."

Step 2: Navigate to Account Privacy

In the Settings menu, look for "Account privacy" — it's usually near the top of the list. Tap it to open the privacy controls.

Step 3: Toggle Private Account On

You'll see a switch labeled "Private account" with an explanation underneath that reads something like "When your account is private, only people you approve can see your photos and videos on Instagram."

Flip that switch to the on position. It'll turn blue (or whatever accent color Instagram is using this month).

Step 4: Review Your Current Followers

Here's the part many people skip: once your account goes private, everyone who's already following you still has access to your content. If you've had a public account for years, you might have hundreds of followers you don't actually know.

Go through your follower list and remove anyone you don't recognize or trust. Yes, it's tedious. Yes, it's worth it. On your profile, tap "Followers," then tap the three dots next to any suspicious account and select "Remove follower."

That's the basic switch, but honestly? That's just the beginning. Instagram's privacy settings run much deeper than that single toggle, and most of them are buried in submenus that the platform doesn't exactly advertise.

What Your Privacy Settings Actually Control (And What They Don't)

Making your account private stops random people from seeing your posts, but Instagram's privacy architecture is more granular than most people realize. Let's break down what each setting actually does.

Private Account Status prevents non-followers from viewing your posts, Stories, and Reels. But here's what it doesn't hide: your profile picture, bio, and username remain publicly visible. Anyone can still find you and see that basic information.

Story Controls let you hide your Stories from specific followers without unfollowing them entirely. Go to Settings and privacy > Story > Hide story from, and select people you want to exclude. Your Stories also disappear after 24 hours unless you save them to Highlights — which brings us to an important point: Highlights stay on your profile permanently until you delete them, even for private accounts.

Close Friends List creates a subset of followers who can see designated Stories marked "Close Friends." This green-circle feature is genuinely useful if you want different privacy tiers. Your Close Friends list is private; people can't see if they're on it or who else is.

Activity Status shows when you were last active on Instagram and whether you're currently online. Most people don't realize this is on by default. Turn it off at Settings and privacy > Messages and story replies > Show activity status. The trade-off? You also won't see when others were last active.

Message Controls determine who can send you DMs. You can restrict messages to people you follow, or use the "Others on Instagram" category that filters message requests into a separate folder. Go to Settings and privacy > Messages and story replies > Message controls.

Tags and Mentions determine whether people can tag you in photos or mention you in their Stories. You can set these to allow everyone, only people you follow, or no one. Find these at Settings and privacy > Tags and mentions. Pro tip: set "Manually approve tags" to on so you can review before tagged photos appear on your profile.

Comments can be filtered or restricted entirely. You can hide comments containing specific words, restrict comments to followers only, or turn them off completely for individual posts. The hidden words filter is particularly useful — Instagram has default lists for offensive terms, but you can add your own.

The Hidden Privacy Settings Instagram Doesn't Advertise

Instagram buries some of its most important privacy controls in places you'd never think to look. These settings won't show up if you just toggle your account to private — you have to hunt for them.

Location Data and Geotagging

Every time you add a location to a post or Story, you're creating a map of your movements. Instagram stores this data even if you later remove the location tag from the post. To stop sharing location data going forward, go to your phone's settings (not Instagram's), find Instagram in your app list, and set Location to "Never" or "Ask next time."

You should also audit old posts for location tags. Yes, manually. Search your own profile for location-specific posts and remove those tags by editing the post.

Search History and Data Download

Instagram tracks every account you search for and every post you interact with. Clear your search history regularly: Settings and privacy > Account Center > Your information and permissions > Activity off Meta technologies. While you're there, download your Instagram data to see exactly what the platform has collected about you. It's eye-opening and often horrifying.

Restricted Accounts Feature

This brilliant feature lets you shadowban specific followers without unfollowing them. When you restrict someone, they can still see your posts, but their comments are only visible to them (you can approve them to be public), they can't see when you're online, and their DMs move to message requests. It's perfect for managing toxic acquaintances or overly nosy relatives.

To restrict someone, go to their profile, tap the three dots, and select "Restrict." You can also manage all restricted accounts at Settings and privacy > Restricted accounts.

Third-Party App Permissions

Remember all those times you logged into apps or websites using your Instagram account? Each one potentially has ongoing access to your data. Review and revoke these at Settings and privacy > Account Center > Your information and permissions > Apps and websites. Delete anything you don't actively use.

Original Photo Metadata

When you upload photos to Instagram, the app strips out most EXIF metadata (like GPS coordinates embedded in the image file itself), but only for photos taken through the Instagram app. Photos uploaded from your camera roll might still contain this metadata. Use a metadata-removal tool before uploading if you're concerned.

What Instagram Still Collects When Your Account Is Private

Here's the uncomfortable truth: making your Instagram private controls who sees your content, but it does absolutely nothing to limit what Instagram itself collects about you. Meta (Instagram's parent company) is fundamentally an advertising business, and the data collection machinery runs whether your account is public or private.

Instagram tracks every action you take on the platform: every post you like, every Story you watch, how long you watch it, every account you visit, every hashtag you search, every ad you scroll past, and exactly how long you spend looking at it. The app monitors your location, your device information, your IP address, and your behavior patterns across Facebook, WhatsApp, and every website that uses Meta's advertising pixels or login integrations.

According to Meta's own Data Policy, the company collects "information about how you use our Products, such as the types of content you view or engage with; the features you use; the actions you take; the people or accounts you interact with; and the time, frequency and duration of your activities." That's a direct quote, and it applies equally to public and private accounts.

Instagram also builds "shadow profiles" about your social network, inferring relationships between users based on who appears in photos together (using facial recognition), who gets tagged together, and whose accounts are frequently viewed in sequence. Even if your friend's account is public and yours is private, Instagram is connecting those dots.

This data feeds into Meta's advertising algorithms, which is why you'll see ads for dog food after visiting your friend's puppy photos, or why you're suddenly getting targeted with engagement ring ads after your partner searches for them on their device connected to the same Wi-Fi network.

The only way to stop Instagram from collecting this data is to stop using Instagram. But you can limit what the company does with it through Settings and privacy > Account Center > Ad preferences. Turn off "Data about your activity from partners" and "Categories used to reach you" — though fair warning, Meta makes these settings deliberately confusing to navigate.

How Data Brokers Get Your Information from Social Media

Even with a private Instagram account, data brokers are still building profiles about you — they're just using different sources. Understanding this pipeline is crucial because it reveals why privacy settings alone aren't enough.

Data brokers aggregate information from hundreds of sources: public records (property deeds, voter registrations, court filings), commercial transactions (loyalty programs, warranty registrations, magazine subscriptions), online activity (website cookies, app permissions, browsing history), and yes, social media scraping of public profiles.

When your Instagram is public, brokers can directly scrape your profile information. Companies like Spokeo, BeenVerified, and Whitepages have automated systems that continuously crawl public social media profiles, extracting names, photos, location data, and social connections. Our monitoring across 1,500+ data brokers at GhostMyData shows that social media scraping is increasingly sophisticated, with some brokers even using AI to analyze photo backgrounds for additional location clues.

But here's what surprises most people: even with a private account, your Instagram data still reaches data brokers through indirect pathways. If your friends tag you in their public posts, that association gets recorded. If you comment on a public account's posts, those comments are scrapable. If your email address or phone number is connected to your Instagram account, data brokers can link your Instagram profile to other records through that identifier — even if they can't see your posts.

The real danger is cross-platform correlation. Data brokers don't need your Instagram content if they can connect your Instagram profile to your Facebook, LinkedIn, Twitter, and TikTok accounts through shared usernames, email addresses, or phone numbers. They build a composite profile that's more detailed than any single platform contains.

This aggregated data then gets sold to people-search sites, background check services, marketing companies, and anyone else willing to pay. That's how a potential employer might find your college party photos even though your Instagram has been private for years — a data broker scraped them when your account was public in 2019 and has been reselling that information ever since.

Taking Control Beyond Instagram's Settings

Making Instagram private is an important first step, but meaningful privacy requires a broader strategy. Here's what actually works.

Use Different Usernames Across Platforms. If your Instagram handle is @sarahjohnson23 and your Twitter is also @sarahjohnson23, you've just made cross-platform correlation trivially easy. Unique usernames on each platform make it harder to connect your accounts.

Remove Your Phone Number and Email. Instagram doesn't require a phone number or email to stay connected to your account once it's created (though they'll nag you constantly). Unlinking these identifiers breaks a key correlation point that data brokers use. Go to Settings and privacy > Account Center > Personal details to manage these.

Regularly Search for Yourself. Google your full name plus "Instagram" in quotes to see what's indexed. Use people-search sites like FastPeopleSearch, Spokeo, and Whitepages to see what information is publicly available about you. What you find might be alarming.

Submit Opt-Out Requests to Data Brokers. This is where most people give up because it's genuinely overwhelming. Major brokers like Spokeo, BeenVerified, Intelius, and hundreds of others each have their own opt-out processes, many of which require mailing physical letters or creating accounts with the brokers themselves (which ironically gives them more data). Based on our removal data at GhostMyData, manually opting out of even 50 major brokers takes the average person 15-20 hours, and new brokers are constantly appearing.

That's exactly why automated removal services exist. We monitor 1,500+ data brokers continuously — compared to competitors who typically cover just 35-500 brokers — because the data broker ecosystem is that fragmented and that aggressive about reacquiring your information. A single opt-out request isn't permanent; brokers reacquire data from public records and purchase it from other brokers, which is why ongoing monitoring matters.

Enable Two-Factor Authentication. This won't protect your privacy, but it'll protect your account from being hacked and turned into a spam bot or impersonation profile. Use an authenticator app, not SMS codes. Settings and privacy > Account Center > Password and security > Two-factor authentication.

Review Connected Accounts Quarterly. Set a calendar reminder to audit your third-party app permissions, restricted accounts list, and follower list every three months. Privacy isn't a one-time setup; it's ongoing maintenance.

The Bigger Picture: Privacy as an Ongoing Practice

Instagram's privacy settings will evolve. Meta will bury important controls deeper in the settings. New data brokers will emerge with new scraping techniques. Privacy isn't a problem you solve once and forget about — it's a practice you maintain.

The college student from Arizona eventually locked down her Instagram, removed herself from the major people-search sites, and now checks her digital footprint monthly. The fake dating profile disappeared after she reported it to multiple platforms, but the screenshots of her photos are still out there somewhere, circulating in the digital ether. That's the hard truth about online privacy: you can't fully delete your past, but you can control your present and future.

If you're serious about privacy, start with Instagram's settings today. Then expand outward: check what data brokers have on you using our free exposure check, understand what information is publicly available, and decide whether ongoing monitoring makes sense for your situation. The data broker industry isn't slowing down — they've built a multi-billion-dollar business on information most people don't even know is being collected. The only counter is being intentional about what you share and persistent about removing what's already out there.

Your Instagram might be private now, but that's just the beginning of the conversation.