Facebook & Messenger
What the default settings do
New Facebook posts default to whichever audience you last chose, which for many accounts ends up broader than intended, and profile details such as your birthday, phone number, email, and friends list can be visible to more people than you expect unless reviewed individually. Facial recognition based on automatic tag suggestions, once a default feature, was discontinued across Facebook in 2021, and Meta deleted the templates it had built. There is currently no face recognition toggle in the Facebook app for photo tagging, which puts it in a different position from Instagram, where Meta has introduced separate facial analysis for purposes like age estimation in some regions; the two should not be confused.
Within Messenger, active status is visible to your contacts by default, and read receipts behave similarly to other Meta messaging apps. Messenger is now a phone app plus the Messages section of the Facebook website: the Messenger desktop apps for Windows and Mac shut down on December 15, 2025, and messenger.com stopped working as a separate site in April 2026, sending visitors to facebook.com/messages instead. Ad preferences, ad topics, and the “Activity from other businesses” control apply account-wide across Facebook and Instagram. In mid-2026 Meta retired the separate “Your activity off Meta technologies” setting and expanded “Activity from other businesses” so that it now governs whether data that other businesses send Meta is used to personalize your Feed and Meta AI responses as well as ads. It controls how that data is used, not whether it is collected. They are covered in more depth in the Meta account guide and are only mentioned briefly here so the two guides do not repeat the same material.
Personal one-on-one chats and calls in Messenger are now end-to-end encrypted by default, a change Meta completed rolling out after first announcing it in December 2023, and it cannot be turned off for standard personal conversations. Group chats are being moved toward the same protection over time, though the pace of that rollout has varied. Because encrypted messages are not stored on Meta’s servers the way ordinary messages are, recovering chat history on a new device depends on a backup method you set up in advance. Facebook has also added an opt-in feature that suggests collages and edits from photos still sitting in your phone’s camera roll, including ones you have never posted. It works by uploading those photos to Meta’s cloud for processing. It launched in the US and Canada in October 2025 and reached the EU and UK in April 2026. Meta AI is also built into Messenger. It can be brought into any chat, and while its presence can be muted or minimized, it cannot be removed from the app entirely.
A reasonable privacy baseline
These settings are found in Settings & privacy → Settings within the Facebook app, and in Messenger’s own settings menu for chat-specific controls, unless noted otherwise.
Post and profile visibility
Who Can See Your Future Posts → Friends (Settings & privacy → Settings → Audience and visibility → Posts)
This sets the default audience applied to new posts going forward. You can still choose Public for an individual post when you want to. It does not change the audience of anything already shared; a separate "Limit Past Posts" option handles that and is covered in the Meta account guide.
Friends List Visibility → Only Me or Friends (Settings & privacy → Settings → Audience and visibility → Friends, though the exact menu wording can vary by app version)
Your list of friends can be visible to a broader audience than just your contacts by default. Restricting it reduces the ability of strangers to map your social connections or exploit mutual friends for scams and impersonation.
Who Can Send You Friend Requests → Friends of Friends
Facebook defaults to allowing anyone to send a friend request. Restricting this cuts down on unsolicited requests from strangers and fake accounts, at some cost to how easily genuine new contacts can find and add you.
Account security
Two-factor authentication → On, using an authentication app (Settings & privacy → Settings → Accounts Center → Password and security → Two-factor authentication)
Two-factor authentication means someone who learns or resets your password still cannot sign in without a second check. Meta recommends an authentication app such as Google Authenticator or Duo over text message codes, which can be intercepted if your phone number is hijacked. A security key is also offered, and recovery codes are worth saving somewhere safe. The same Password and security screen is where you can add a passkey, which lets you sign in with your phone's fingerprint, face, or PIN. Meta is gradually renaming Accounts Center to "Meta Account," so the label may differ on your phone.
Camera roll and Meta AI
Camera roll sharing suggestions → Off (Settings & privacy → Settings → Preferences → Camera roll sharing suggestions)
If you said yes to the pop-up offering "cloud processing" of your camera roll, Facebook uploads photos from your phone on an ongoing basis so Meta AI can suggest collages, recaps, and restyled images, including photos you have never shared. Meta says this media is not used for ad targeting, and is not used to improve its AI unless you edit or share a suggestion. This screen has two toggles, one for the suggestions and one for cloud processing; turning both off stops the uploads. If you never accepted the prompt, nothing is being uploaded.
Messenger activity and Meta AI
Active Status → Show when you're active → Off (Facebook app: Settings & privacy → Settings → Audience and visibility → Active status; Messenger app: menu → Settings → Active status)
Active status has to be turned off separately in the Facebook app and the Messenger app, since each tracks it independently; turning it off in one can leave you showing as active in the other. On a computer, Messenger now lives inside facebook.com, so the Facebook setting is the one that applies there. Turning it off is mutual: you also stop seeing when your contacts were last active. Read receipts are separate and still show the moment a message has been opened, regardless of this setting.
Meta AI in Chats → Mute, or turn off message sharing (chat → info button → Meta AI or mute options)
Meta AI can be brought into a conversation by any participant, and once invoked it can read whatever is shared with it, along with profile details such as age, gender, and inferred interests, plus general location. It can be muted for a fixed window, commonly ranging from fifteen minutes up to twenty-four hours, or muted until you turn it back on, but it cannot be removed from Messenger altogether. Turning off message-sharing permissions for a chat stops others in it from forwarding your messages to Meta AI.
Encrypted chat backup
Secure Storage PIN → Set a PIN (Messenger → Settings → Privacy & safety, or the prompt shown when you first set up backup)
Because personal chats are end-to-end encrypted by default, Meta cannot restore their content if you lose access to a device without a backup you configured yourself. Setting a PIN, or an alternative recovery method such as a one-time code, lets you restore encrypted chat history on a new phone or computer. If the PIN and every recovery option are lost, that history cannot be recovered, by you or by Meta.
Trade-offs
- Setting your default post audience to Friends means manually choosing Public each time you want broader reach; it does not retroactively change older posts.
- Hiding your friends list and restricting who can send requests makes your account harder to map for strangers, but also somewhat harder to find for people who know you only loosely.
- Turning off Active Status is mutual and stops you from seeing others’ status too. It also does not hide read receipts, which remain visible once a message is opened.
- Muting Meta AI in a chat only lasts as long as the window you choose, or until you unmute it; it will respond again once invoked or once the mute period lapses.
- Setting up a Secure Storage PIN is what allows encrypted chat history to move to a new device. Skipping it, or forgetting the PIN with no other recovery method enabled, means that history is simply gone.
- Two-factor authentication adds a step when you sign in on a new device, and an authentication app means keeping recovery codes safe in case you replace your phone.
- Turning off camera roll suggestions means you no longer get ready-made collages and recaps from your photos.
- Because ad preferences and off-platform data sharing work the same way here as described in the Meta account guide, applying those account-level settings alongside this guide gives a fuller picture than either guide alone.
Who should not change these settings
- If you use Facebook publicly for a business, page, or public profile, keeping post defaults at Public and your friends list visible may better suit an audience trying to find or verify you.
- If you coordinate frequently with friends and rely on seeing when they are active, turning off Active Status removes that convenience for both of you.
- If you enjoy the camera roll collages and recaps and are comfortable with Meta processing your unposted photos in its cloud, leaving that feature on is a reasonable choice.
- If you find Meta AI useful for quick answers inside a chat, there is little reason to avoid it beyond being aware that anything shared with it is read by Meta, unlike an ordinary encrypted message.
- If you are confident you will always keep access to your current device or another logged-in session, setting up a recovery PIN is less urgent, though losing every device without one means permanent loss of encrypted history.
- If you are comfortable with Meta’s advertising and off-platform data practices, the account-wide ad and activity settings described in the Meta account guide can reasonably be left at their defaults.