What the default settings do
Instagram accounts are public by default for users over 18. This means your posts, stories, reels, and profile information are visible to anyone on the internet, not just people who follow you. Your activity status is visible to people you follow or have messaged, and Instagram shares data across Meta’s family of apps for advertising purposes.
Third-party apps you may have connected over the years retain access until manually revoked. Comment and message controls are relatively open by default, and sensitive content filtering is set to a moderate level.
Meta AI is built into Instagram and cannot be turned off entirely, though it can be muted or blocked within individual conversations. Separately, public posts and captions can be used to train Meta’s generative AI models. In the EU and UK you can formally object to that for your own content; in the US and most other places there is no equivalent opt-out. Public accounts are also opted in by default to “Sharing and reuse,” which lets other people reuse your posts and reels, including with Meta’s AI features. In July 2026 Meta briefly launched an image generator, Muse Image, that let anyone tag a public account in a prompt to make AI images from its photos, without notifying the account holder. Meta pulled it a few days later after criticism, but the underlying reuse setting is still on by default.
Two other features are worth knowing about. Instagram Map, launched in August 2025, can show your last active location to people you choose, but location sharing is off until you turn it on. And Meta uses AI to spot accounts that likely belong to teenagers, even when an adult birthday was entered, and moves them into Teen Accounts, which are private by default and limit who can contact them. In May 2026 Meta expanded this in some countries to analyze photos and videos for signs that a user is under 13; accounts flagged that way are deactivated unless the holder proves their age.
A reasonable privacy baseline
These settings are found in Settings and Privacy within the Instagram app, unless noted otherwise.
Account security
Two-factor authentication → On, using an authentication app (Profile → menu → Accounts Center → Password and security → Two-factor authentication)
Between April and the end of May 2026, attackers abused a flaw in Meta's AI-assisted support tool to get password reset links for Instagram accounts that were not theirs, and took over 20,225 accounts. Meta said the takeovers only worked on accounts without two-factor authentication. Instagram recommends an authentication app such as Google Authenticator or Duo Mobile over text message codes, which can be intercepted if your phone number is hijacked. Instagram is also adding passkey sign-in through the same Password and security screen as Accounts Center becomes "Meta Account," so use a passkey if your app offers one. Save the backup codes Instagram gives you somewhere safe.
Account visibility
Account Privacy → Private Account → On
A private account means only approved followers can see your posts, stories, and reels. Your profile photo and bio remain visible to everyone. This is the single most impactful privacy change on Instagram.
Activity Status → Off (Settings → Messages and story replies → Activity status)
When enabled, people you follow or have direct conversations with can see when you were last active. Turning it off hides this from others, and you also lose the ability to see their activity status.
Story Sharing → Allow Sharing to Stories → Off
Prevents others from sharing your posts to their stories. This is relevant even with a private account, because resharing can extend visibility beyond your followers.
Location sharing (Instagram Map) → No one, or a short custom list (Settings → Story, live and location → Location sharing)
Instagram Map, reached from the top of your messages screen, can show the people you pick your last active location, updated when you open the app. It is off unless you turn it on, and Instagram asks you to confirm before it starts. If you have shared it before, check this setting and keep the list short. Even with sharing off, location tags you add to individual posts, stories, and reels can still appear on the Map for people who can see that content.
Close Friends → Configure your list
Instagram lets you create a Close Friends list for sharing stories with a smaller group. This is not a setting to toggle but a useful tool for limiting story visibility without making your entire account private.
Meta AI and content use
Sharing and Reuse → Allow People to Reuse Your Content on Instagram and with AI Features at Meta → Off for both Posts and Reels (Profile → Menu → Sharing and reuse)
This is on by default for public accounts. It controls whether other people can reuse your posts (including your profile photo) and reels on Instagram and create things from them with Meta's AI features, and you are not notified when that happens. Turn off both toggles. The change applies going forward; anything someone already made from your content stays in circulation.
Objecting to Use of Your Data for Generative AI → Submit a request if you are in the EU or UK (Settings → Privacy Center → Privacy topics → AI at Meta → Privacy and generative AI)
In the EU and UK, privacy law gives you a right to object to Meta using your own public posts and captions to train its AI models, and Meta provides a form for it. In the US and most other countries there is no equivalent form for your own content; Meta's separate request form covers only personal information about you that came from third-party sources, such as the wider web, and Meta decides those requests itself. Either way, it only affects future training, not models already built. Making your account private is the most reliable way to keep new posts out of public-content training everywhere.
Data and advertising
Ad Preferences → Data Sharing with Meta → Review in **Accounts Center → Ad preferences**
Meta combines data from Instagram, Facebook, and other Meta services to build advertising profiles. You can review and limit some of this in the Accounts Center, though complete opt-out is not available while using Meta services.
Ad Topics → Hide topics you prefer not to see (Accounts Center → Ad preferences → Ad topics)
You can ask to see fewer ads about specific topics, such as alcohol, parenting, or dating. This does not stop data collection but narrows the categories of ads Instagram will show you.
Third-Party Apps → Review and revoke (Settings → Website permissions)
Apps and websites you have signed into using Instagram retain access to your account data. Review the list and remove any services you no longer use or recognize.
Download Your Data → Request periodically (Settings → Your activity → Download your information)
Instagram lets you download a copy of all your data including posts, messages, and search history. This is useful for understanding what Instagram has collected.
Interactions
Message Controls → Restrict message requests (Settings → Messages and story replies)
You can control who can send you message requests. Options include limiting to people you follow, or adding additional filtering. This reduces unwanted contact from strangers.
Sensitive Content Control → Less (Settings → Content preferences → Sensitive content)
Controls how much potentially sensitive content appears in Explore and recommendations. Setting this to "Less" reduces exposure to content that may be disturbing or unwanted.
Comment Filters → On (Settings → Hidden words)
Enables automatic filtering of comments containing offensive language or custom keywords you define. Filtered comments are hidden rather than deleted, so you can review them if needed.
Trade-offs
- A private account means your content will not appear in Explore, hashtag pages, or public search results. This significantly reduces discoverability, which may matter if you use Instagram for creative or professional work.
- Turning off activity status is reciprocal. You will not see when others were last active either.
- Disabling story sharing limits how your content can spread, which reduces both reach and unintended exposure.
- Restricting message requests may cause you to miss legitimate messages from people you do not follow.
- Setting sensitive content to “Less” may filter out some content you would have found acceptable or interesting.
- Two-factor authentication adds a step when you sign in on a new device, and an authentication app means keeping backup codes safe in case you replace your phone.
- Keeping Instagram Map location sharing off means friends cannot use the Map to see roughly where you are, even when that would be handy for meeting up.
- Opting out of AI content reuse and submitting an objection request only affects future use of your data; it does not remove your content from models already trained on it.
Who should not change these settings
- If you use Instagram for a business, brand, or public creative practice, a private account would undermine that purpose. Other settings in this guide can still be applied.
- If you want others to remix your reels or build on your posts, for example as a creator who benefits from reuse, leaving Sharing and reuse on is a reasonable trade, as long as you are comfortable with AI features drawing on your images too.
- If you use Instagram Map to coordinate with a small group of close friends, sharing with that custom list is a reasonable middle ground.
- If you rely on direct message requests for networking or collaboration, heavily restricting messages may not be practical.
- If seeing activity status helps you coordinate with friends or know when someone is available to chat, keeping it on is a reasonable choice.
- If you are comfortable with Meta’s data practices and prefer more relevant ads, there is no technical privacy risk in leaving ad personalization on - it is a preference.
- If you find Meta AI useful for search or in-app questions, there is no need to avoid it beyond being mindful that anything you directly send it is read by Meta, unlike an ordinary message to a friend.