X (Twitter)
What the default settings do
X accounts are public by default. Your posts, likes, replies, and profile information are visible to anyone on the internet and are indexed by search engines. X allows other users to find your account through your email address or phone number by default. The platform collects data about your activity, interests, and device information for ad targeting, and shares some data with advertising partners.
Location tagging is available for posts, and X uses your activity data to personalize the content and ads you see. Cookie-based tracking across websites is enabled by default for logged-in users. Since November 2025, every profile also has an “About this account” panel that shows, among other things, the country your account is based in. Country is the default; you can reduce it to a broader region.
In November 2025, X replaced direct messages with Chat, which adds end-to-end encryption, vanishing messages, and voice and video calls, and asks you to set a four-digit passcode before you can use it. Older DMs were carried over. X has acknowledged that the encryption does not hide metadata such as who is talking to whom, and that it does not yet protect against so-called man-in-the-middle attacks, so it is better than before but not on par with dedicated encrypted messengers.
X is also opted in by default to letting your public posts and Grok interactions train Grok and other xAI models. This default-on setting does not apply in the EU and EEA, where regulatory action has kept it off unless you turn it on. Our Grok guide covers the training opt-out and Grok’s own settings in more detail.
A reasonable privacy baseline
These settings are found in Settings and Privacy on the X website or app.
Account security
Two-factor authentication → Authentication app or Security key (Settings and privacy → Security and account access → Security → Two-factor authentication)
Two-factor authentication means a stolen password alone is not enough to get into your account. An authentication app or a physical security key is stronger than text message codes, which can be intercepted if your phone number is hijacked. On the same Security screen, under Additional password protection, you can also add a passkey, which lets you sign in with your device's fingerprint, face, or PIN. Save the backup code X gives you somewhere safe.
Account visibility
Protect Your Posts → Consider On (Settings → Privacy and safety → Audience, media and tagging → Protect your posts)
Protected posts are only visible to your approved followers. They cannot be retweeted (only quoted by followers), do not appear in public search results, and are not indexed by search engines. This is X's equivalent of a private account.
Discoverability → Email → Off (Settings → Privacy and safety → Discoverability and contacts)
By default, people can find your X account using your email address. Turning this off prevents account discovery through your email. This is particularly relevant if your email is widely known but you prefer to keep your X presence separate.
Discoverability → Phone Number → Off (Settings → Privacy and safety → Discoverability and contacts)
Similarly, people can find your account using your phone number by default. Disabling this prevents that lookup.
About your account → Location display → Region (Settings → Privacy and safety → About your account)
The "About this account" panel on your profile shows where your account is based, at country level by default. Switching the display to region or continent shows a broader area instead, which is worth doing if your country is small or if naming it could single you out. It does not hide your location from X itself.
Location Tagging → Off (Settings → Privacy and safety → Location information → Add location to your posts)
When enabled, you can tag your location on individual posts. Turning this off removes the option, preventing accidental location disclosure. You can also delete all previous location data from the same settings page.
Chat (formerly direct messages)
Allow message requests from everyone → Off (Settings → Privacy and safety → Direct messages; the section may now be labeled Chat)
When enabled, anyone on X can send you a message request, even if you do not follow them. Turning this off restricts messages to people you follow. You may also want to disable read receipts within the same section. Since DMs became Chat in November 2025, X has been moving these controls, so if the label differs, look for the message request setting in the Chat settings.
Chat passcode → Set one you do not use elsewhere
Chat asks for a four-digit passcode before you can use encrypted messaging. Pick one that is not your phone PIN or bank PIN, and note it somewhere safe, since it is what lets you unlock your encrypted chat history on a new device. If you forget it and have no other signed-in device to reset it from, that encrypted history is lost.
Data and advertising
Grok and Third-Party Collaborators → Off (Settings → Privacy and safety → Grok & Third-party Collaborators, sometimes grouped under Data sharing and personalization)
By default, your public posts plus your inputs and results with Grok can be used to train and fine-tune Grok and other xAI models. Turning this off stops future use of your data, though thumbs up/down feedback on individual Grok replies may still be used. This toggle is not opted in by default for EU and EEA accounts.
Personalization and Data → All toggles Off (Settings → Privacy and safety → Data sharing and personalization)
This section contains multiple toggles controlling how X uses your data for personalization and ad targeting. These include: personalize based on your inferred identity, personalize based on places you have been, personalized ads, and others. Turning all of these off limits X's use of your behavioral data for content and ad customization.
Ad Preferences → Interests → Review and remove (Settings → Privacy and safety → Ads preferences → Interests)
X maintains a list of interests it has inferred from your activity. You can review this list and remove individual interests. While this does not stop data collection entirely, it cleans up the existing advertising profile.
Data Sharing with Business Partners → Off (Settings → Privacy and safety → Data sharing and personalization → Allow additional information sharing with business partners)
This controls whether X shares certain data with its advertising and business partners beyond what is needed for ad delivery.
Cookie Preferences → Decline non-essential cookies (from the cookie banner or Settings → Privacy and safety)
X uses cookies for analytics, personalization, and advertising. Declining non-essential cookies limits cross-site tracking through X's cookie infrastructure. The availability and enforcement of this depends on your region.
Grok and your images
Block modifications by Grok → On for photos of yourself or others (in the post composer, tap the edit icon on an attached image; iOS app)
Since March 2026, X's iOS app has offered a per-image option, set while uploading, that stops people from tagging Grok in a reply to edit that photo. It is a small step worth taking for photos of people, but it is narrow: it only blocks that one route, and reporters found it easy to get around. Treat it as a deterrent, not a guarantee, and think twice before posting photos of people publicly if AI edits are a concern.
Content controls
Content You See → Review (Settings → Privacy and safety → Content you see)
X offers controls for filtering content in your timeline and search results, including muting specific words, phrases, or accounts, and adjusting sensitive content settings. Configuring these according to your preferences reduces unwanted content exposure.
Trade-offs
- Protecting your posts makes them invisible to non-followers, which removes the primary public nature of X. Your posts will not appear in public search, trends, or be retweetable by others. This fundamentally changes how the platform works for you.
- Disabling discoverability by email and phone means people who know you in other contexts cannot easily find your X account, which may be desirable or undesirable depending on your situation.
- Turning off personalization means the content X surfaces in your feed and Explore tab will be less tailored to your interests.
- Restricting DMs means potential contacts, sources, or opportunities from non-followers will not be able to reach you directly.
- Removing location data from past posts is permanent and cannot be undone.
- Two-factor authentication adds a step when you sign in on a new device, and losing your second factor and backup code can lock you out.
- Showing a region instead of a country in “About this account” gives others less context about you, which some readers use to judge whether an account is authentic.
- Forgetting your Chat passcode can cost you access to encrypted message history on a new device.
- The per-image Grok block only stops one way of editing your photo, so it can give a false sense of protection if relied on alone.
- Opting out of Grok training does not delete data already used, and it does not stop X’s separate terms of service from granting broad rights to license content you post.
Who should not change these settings
- If you use X as a public platform for professional visibility, journalism, advocacy, or community building, protecting your posts would undermine that purpose. The data and advertising settings can still be adjusted independently.
- If being discoverable is important to your use of the platform - for networking, reconnecting with people, or public engagement - keeping email and phone discoverability on is reasonable.
- If you prefer a curated timeline that reflects your interests, the personalization features contribute to that experience.
- If you want to receive messages from people outside your follow list - such as sources, collaborators, or event organizers - keeping DMs open to everyone serves that need.
- If you run a public-facing account where showing your country helps people trust that you are who you say you are, keeping the country display is reasonable.
- If you actively use Grok and are not concerned about your posts contributing to its training, leaving that setting on is a reasonable choice.