Oversharing on social media: five sources compared

What a stranger can assemble from separate posts

Kentucky’s IT services page gives the problem a name, the “Mosaic Effect”, and describes it as small pieces of information that look harmless on their own and, put together, show a revealing picture of you or lead to assumptions about you. It quotes the university’s cybersecurity analyst, Jackie Campbell, saying that a post cannot be retracted once it is up. The page opens with the kind of posts it means: accepting a new job, moving, sharing vacation and birthday photos. Its warning is that publishing too many specific details can lead to break-ins, monetary loss or, in some cases, a risk to your safety.

Harvard Business School’s IT page shows the same effect without the name, through an example it presents about a person called Sam. Sam posts about a conference trip with the whole team, gives the exact dates away from home and office, asks people to send a direct message instead of email, then adds a photo of the boarding pass, tags the hotel and posts a group selfie in front of the office sign. A few days later Sam receives a convincing text from “your bank” that mentions the trip and asks to confirm a suspicious charge. Someone starts commenting on photos of the children, using their names. Sam’s partner gets a call from “building management” about a supposed plumbing problem in the apartment. HBS says these messages sounded credible because they used details people share freely. We treat the case as what it is, an example written to teach, and not as a documented event.

HBS then lists what each piece gave away. The exact dates showed when the home was empty. The boarding pass showed a frequent flyer number. The tagged colleagues made it easy to find an organization, a role and a work email. A public profile showed photos of the inside of a home. Birthday posts were enough to deduce a full birth date, and other posts mentioned the children’s names and school. Each piece is ordinary on its own; the harm in the HBS case comes from the pieces being used together.

CISA, in a blog post released on 1 February 2021 and now marked as archived, makes a related point about other people’s posts. It says to avoid posting information that would make you vulnerable, such as your address or information about your schedule or routine, and adds that if your connections post about you, you should make sure the combined information is not more than you would be comfortable with strangers knowing. CISA also says that with your location, hobbies, interests and friends, a malicious person could impersonate a trusted friend or convince you they have the authority to reach other personal or financial data. CISA also lists why people overshare: the internet gives a sense of anonymity, the lack of physical interaction gives a false sense of security, people write for their friends and forget that others may read it, and they want to impress. The table below sets side by side what the sources say a post can give away.

Where you are, and where you are not

Location comes up in all five sources, and each places the leak somewhere different. Kentucky’s page tells readers not to post when out of town and says never to turn on live location. Its analyst adds that vacation photos contain metadata with GPS location information, so that, in the analyst’s words, someone who is not stalking you on vacation will know your home is most likely vacant, and that it is much safer to share the photos once you are back. HBS describes real-time location tags, posts saying you are home alone this weekend, and vacation updates as things that can quietly advertise an empty home and a predictable routine. It adds that daily posts from the same running route, gym or school let a stranger map where you are and when.

The FTC’s page, which is written for young people and their families, does not use the word metadata. It says that features on your devices, such as the camera, might hold information about where you were when you took a photo, and that you can turn off location on the phone’s camera if you do not want to broadcast it. It also notes that some apps show where your friends are and also share where you are, and suggests asking whether an app needs to know where you are at all. These are two ways of describing the same worry only if you read them that way: Kentucky names the data in the photo, the FTC names the setting that feeds it. The pages we read do not say which platforms remove location data from photos when they are uploaded.

The National Cybersecurity Alliance, in an article dated 19 August 2026 about account takeovers, gives a plain example: posting to a wide audience about your vacation while you are on it could let people know you are not at home. Its advice is to make some items, including the friends list, photos, workplace and location, visible only to friends. HBS adds a point about timing, suggesting that travel photos go up after you return or go to a limited group.

Where you work, and who you are to a bank

The sources diverge most on identity. CISA stays general, talking about address, schedule and routine. Kentucky lists age, school, residence, what you enjoy doing and where, and adds that a birthday, an address and interests are the kind of identifying details that can easily be sold on the dark web. HBS goes further with work and security questions. Tagged colleagues, it says, make it easy to find someone’s organization, role and work email.

HBS also points at the questions banks and email providers use to verify you: childhood schools, first pets, street names and full birth dates. A birthday post, a throwback about the street you grew up on or a note about a first dog could, it says, give an attacker enough to reset an email, social media or even a bank account, and whoever controls your main email can use password reset links to take over almost everything else. The FTC gives a matching tip for security questions: skip the ones with answers someone could find online, such as a zip code, a birthplace or a mother’s maiden name, and treat the answers like passwords. That page speaks to young people, so we do not present it as advice about work.

Then there is impersonation. The National Cybersecurity Alliance says criminals do not always need to break into an account. They can create a fake profile from your publicly available name, profile photo and bio, and send requests or messages to people you know. A cloned profile cannot get into your real account, the article says, but it can damage your reputation and be used to scam others in your name. HBS adds scams tailored to what you post: fake investments that match your interests, travel scams that use your real itinerary, and approaches that start as professional, personal or romantic connections and slowly move toward requests for money or favors.

One more item comes from HBS’s page, which says close-up selfies, filters, videos and voice notes add to a biometric footprint, capturing your face from several angles and your speaking voice, and that this material can be reused in deepfakes or voice-cloning scams. It introduces this with “for example” and gives no figure for how often it happens, so we do not either.

Why a private account and a deletion are not enough

Kentucky’s page recommends a private profile and checking what others can see by viewing your profile as public. Even so, its analyst warns that if you think you are sharing only with friends, their permissions may allow others, or anyone, to follow them and see your posts. CISA says some sites’ default settings may allow anyone to see your profile, that restricted settings still leave some risk, and that options change, so settings are worth reviewing regularly. The FTC says it is impossible to completely control who sees your content, even with privacy settings or apps that delete after viewing or within 24 hours, because anybody who sees a post can take a screenshot or a recording.

On deletion, the four pages that address it agree on the outline and differ on the detail. CISA says that once information is online you cannot retract it, and that even if you remove it from a site, saved or cached versions may still exist on other people’s machines. Kentucky says a simple screen capture can copy and save a deleted post in seconds, and that stories do not disappear: a post can be retained on the company’s server, and its analyst cites Snapchat’s terms as reserving a right to keep messages. The page does not say how long, only that unviewed messages stay for a certain amount of time. The FTC says a deleted or expired post could be saved, shared and live somewhere online permanently. HBS says posts, photos and comments can be copied, screenshotted, archived and resurfaced years later even if the original is deleted.

On the other side, HBS says switching from Public to Friends, or to a small curated list, dramatically reduces exposure in many cases. That is compatible with Kentucky and the FTC: a narrower audience is a smaller exposure, not an exposure of zero. The Kentucky page also tells readers not to accept follow requests from strangers, because showing how old you are, where you go to school, where you live and what you enjoy doing and where can be dangerous.

Cutting it down, in the order that costs least

HBS opens its advice with a line that sets the tone: the goal is not to disappear from the internet. The goal, it says, is to make what you share more intentional. What follows is our own ordering of the steps the sources give, from the one that costs least to the one that takes most work; none of the sources ranks them by cost.

1. Pause before posting. HBS’s habit takes three seconds: Pause, Verify what a stranger could learn from the post, image or file, then Act. The choices are to share as is, share with less detail, change the audience, or not share. Its question is whether the post reveals where you are, where you live, what you own, who your children are, how to reach you, or internal work information.
2. Check the audience. Move from Public to Friends or a small list (HBS), and view your own profile as public to see what others see (Kentucky). The National Cybersecurity Alliance would keep the friends list, photos, workplace and location to friends only, and would leave the contact details and birthday off the profile.
3. Check location. Turn off live location (Kentucky), turn off location on the phone camera if you do not want it shown (FTC), and ask whether an app needs to know where you are.
4. Edit the picture. HBS says to zoom in and check the background before posting an image or screenshot, and to crop or blur sensitive areas with the built-in tools many phones and laptops have.
5. Post later. Kentucky and HBS both suggest sharing travel photos after you return. For children, HBS suggests private albums, initials instead of full names, and leaving out school logos, uniforms and location tags.
6. Protect the account itself. The National Cybersecurity Alliance recommends a unique password for each account, multifactor authentication with an authenticator app rather than text messages when possible, and never sharing a code.

Those steps cover what you post from now on. The sources do not explain how to delete what is already up or how to close an account, and, apart from Kentucky’s tip to view your own profile as public, the pages we read do not describe a way to check what a stranger can already find. For those jobs, our guide to old posts and profiles covers what Facebook, Instagram and X say about archiving and deleting, searching for yourself shows what a search turns up, and making a Facebook profile private walks through one platform’s audience settings. If a post has already been used against you, doxxing is the page for the first hour.

What these pages do not tell you

The pages we read do not give statistics on how many thefts or scams begin with a post, so we give none. They do not say how long data stays on a platform’s servers; Kentucky says only “a certain amount of time” for unviewed messages. HBS’s case about Sam is an example, and its deepfake paragraph is a possibility, not a measured rate. CISA’s blog post dates from 2021 and is marked as archived, and the text we read of the FTC page shows only “August 2023” at the foot, without saying whether it is a publication or an update date, so their advice may trail the platforms’ current settings, which CISA itself says change.

Everything on this page comes from the five pages named under Sources. The settings they describe are theirs to confirm on each platform’s own help pages.