Social media and video streaming services have become so ingrained in daily life that many people are unaware of just how much personal data they're giving away – and how much of that data is being sold to third parties. A recent FTC report, "A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services," sheds light on the data practices of nine major companies: Amazon (Twitch), ByteDance (TikTok), Discord, Facebook, Reddit, Snap, Twitter, WhatsApp, and YouTube.
To gather the information, the FTC used 6(b) orders, which compelled the companies to disclose extensive internal documents, data practices, and policies related to user data collection, storage, sharing, and advertising. “The report lays out how social media and video streaming companies harvest an enormous amount of Americans’ personal data and monetize it to the tune of billions of dollars a year,” said FTC Chair Lina M. Khan.
The FTC found a twofold problem: people are often unaware of how much information is being gathered, and they rarely understand how it is being used or sold. Data isn't just used to target ads – it's shared with countless third parties, sometimes without the platforms themselves knowing exactly where it goes.
What social media knows about you
The FTC report reveals just how detailed the data profiles collected by social media platforms have become. Social media companies gather not only basic personal information – like your age, location, and the content you engage with – but also vast amounts of inferred data that most people would never suspect. This data includes everything from your household income to your relationship status and even whether you're a parent, with some platforms able to deduce the presence of young children or teenagers based on your online activity and third-party data sets.
In addition, companies integrate information collected from external sources, such as advertisers or other third-party sites, to further enhance these profiles. This way platforms are able to gather details about your activity even when you're not directly using their services.
Companies claim the data they have about you is used to deliver more personalized experiences. However, the reality is more complex, as your information is also shared or sold to third parties for profit. Disturbingly, the FTC report reveals that none of the companies surveyed could provide a comprehensive list of all the third parties with which they shared users' personal data.
Once sold or shared, your information can end up in the hands of data brokers, who might combine it with other data sets to build even more detailed profiles. This creates a heightened risk of identity theft, fraud, or unwanted surveillance.
Perhaps the most troubling risk involves the use of algorithms and AI systems to process and infer sensitive information from collected data. These systems can draw conclusions about your health status, financial situation, or even sexual orientation. This inferred information can then be used to serve targeted ads or more concerningly, potentially be sold to companies that use it for purposes you may not agree with, such as profiling or discriminatory practices.
The FTC was very clear about how the problems they found should be addressed. With a 5-0 vote, their published recommendations include:
- Congress should pass comprehensive federal privacy legislation to limit surveillance, address baseline protections, and grant consumers data rights;
- Companies should limit data collection, implement concrete and enforceable data minimization and retention policies, limit data sharing with third parties and affiliates, delete consumer data when it is no longer needed, and adopt consumer-friendly privacy policies that are clear, simple, and easily understood;
- Companies should not collect sensitive information through privacy-invasive ad tracking technologies;
- Companies should carefully examine their policies and practices regarding ad targeting based on sensitive categories;
- Companies should address the lack of user control over how their data is used by systems as well as the lack of transparency regarding how such systems are used, and also should implement more stringent testing and monitoring standards for such systems; Companies should not ignore the reality that there are child users on their platforms and should treat COPPA as representing the minimum requirements and provide additional safety measures for children;
- The Companies should recognize teens are not adults and provide them greater privacy protections; and
- Congress should pass federal privacy legislation to fill the gap in privacy protections provided by COPPA for teens over the age of 13.
Minimizing data exposure on social media platforms
One clear takeaway from the FTC report is that most people have little awareness of how much personal data they are giving away on social media. While many platforms allow some degree of customization in privacy settings, few people take the time to review or understand them. This leaves the door wide open for excessive data collection. The good news? You can take steps to minimize how much personal information is exposed.
Minimizing your exposure starts with reviewing the privacy settings on your accounts. Social media platforms like Facebook, TikTok, and YouTube offer options to limit data sharing with advertisers and third parties, but they often bury these options within layers of menus. Take the time to dig through. By setting stricter privacy controls, you can limit who can see your content and how much data these platforms share about you with advertisers.
Once you change your privacy settings, you'll enjoy some protection moving forward, however, the data that companies already have remains at risk. The FTC report found that some of the companies didn't honor users' deletion requests and they found their data collection and storage practices "woefully inadequate."
Read more: Complete Guide to Facebook Privacy
Beyond sharing outside their platforms, it's important to take control of how social media companies track you. This includes turning off location tracking, opting out of targeted ads, and restricting the types of information these platforms are allowed to collect. For instance, Facebook and Google provide options to disable ad tracking, which reduces the amount of data that can be used to target you with personalized ads.
Protecting your data beyond social media platforms
While the FTC report focuses on social media, it's important to understand that data collection doesn't stop when you leave their service. Many of these platforms track your activity across the web, gathering information from every click, search, and purchase you make.
Most tracking occurs through cookies or invisible tracking pixels embedded in websites. By using privacy-focused browsers like Brave or DuckDuckGo or a browser extension like Privacy Badger, you can block these trackers and cookies, adding an extra layer of protection. However, there are benefits to cookies, like auto log-in to your accounts and being able to leave items in your shopping cart. If you're not ready to give up the benefits of cookies, you can regularly clear your cookies and browsing history to prevent companies from building long-term data profiles based on your online activity.
Another way to limit profile building is to use a VPN (Virtual Private Network). A VPN helps anonymize your browsing activity by masking your IP address and encrypting your internet connection. While you can be tracked during a single VPN session, making your IP address makes it much harder for social media platforms, advertisers, and other third parties to track your online behavior over time.
Based on our testing, we recommend SurfShark for an inexpensive, reliable VPN that will cover all of your devices. We also like the free version of ProtonVPN if you're looking to protect just one device (just your laptop or just your phone).
Read more: How to Clear Browser Cookies
Many people unknowingly grant extensive data access to third parties when connecting apps or logging into websites using their social media accounts. These connections can expose your profile information, contacts, and even browsing history, leading to broader data sharing than you'd think.
Platforms like Facebook and Google allow you to review which apps and websites have access to your account. Disconnecting unnecessary or unused apps is a simple yet effective step to limit data exposure. And when you open new accounts, don't use another account – e.g., Facebook, Google, Apple – to log in. Create a new login, instead. A password manager, like our recommended 1Password, will greatly help facilitate this.
Final thoughts
The FTC's recent report reveals a deeply concerning reality: social media and video streaming platforms collect, share, and sell vast amounts of your data, often without your full understanding of the extent or consequences. These practices create highly detailed profiles and pose risks through third-party sharing, leaving you vulnerable to privacy invasions and security threats. However, this doesn't mean you're powerless. You can significantly reduce your data exposure by adjusting privacy settings, using tools like VPNs and privacy-focused browsers, and staying vigilant about third-party apps.
[Image credit: FTC, data harvesting concept generated by Midjourney]
For the past 20+ years, Techlicious founder Suzanne Kantra has been exploring and writing about the world’s most exciting and important science and technology issues. Prior to Techlicious, Suzanne was the Technology Editor for Martha Stewart Living Omnimedia and the Senior Technology Editor for Popular Science. Suzanne has been featured on CNN, CBS, and NBC.
