DATA EXPOSURE: FIND INFORMATION YOU NO LONGER NEED TO PUBLISH
BEFORE YOU BEGIN
Understand the issue before you decide what to remove.
Personal information can remain visible long after you stop using an account, change a phone number, delete a post, leave a group or forget that a document was ever uploaded. Old profiles, public posts, business listings, shared files, photographs, comments, usernames, phone numbers and documents can continue to expose information about you.
The goal of a digital exposure cleanup is not to make yourself invisible on the internet. It is to reduce unnecessary public information, remove material you no longer need to publish, close old exposure points and make it harder for someone to assemble a detailed picture of you from scattered information.
A useful principle is:
FIND → DECIDE → REMOVE → RESTRICT → CHECK AGAIN
1. WHAT IS DIGITAL EXPOSURE?
Digital exposure is information about you that can be found, accessed, copied or connected by other people through digital services.
Examples include:
- Your full name
- Phone numbers
- Email addresses
- Home or work address
- Date of birth
- School or workplace
- Family relationships
- Public photographs
- Identity documents
- Signatures
- Bank or payment information
- Social-media usernames
- Old usernames
- Public comments
- Business registration or contact information
- Old advertisements
- Event registration pages
- Public cloud files
- Shared Google Drive or document links
- Online marketplace listings
- Old forum posts
- GitHub or code repositories
- Location information
- Travel plans
- Photographs containing documents or addresses
- Information visible through search-engine results
Not all exposure is harmful. Some information must be public for legitimate reasons. The question is whether the information is still necessary, whether it is accurate, who can access it and what someone could do by combining it with other information.
2. WHY OLD INFORMATION MATTERS
An old post may look harmless because you no longer think about it. An old photograph may appear insignificant because it was shared years ago. A phone number may seem harmless because many people already have it.
The risk can change when separate pieces of information are combined.
Your name + phone number + workplace + family member's name + public photograph
can tell someone much more than any one of those items alone.
A person trying to impersonate you may use publicly available information to make a message sound familiar. Someone trying to guess account-recovery information may use old personal details. A scammer may use your workplace, family relationships or previous activities to create a more convincing story.
This is why digital privacy is not only about hiding secrets. It is also about reducing unnecessary information that can be assembled into a useful profile.
3. PUBLIC DOES NOT MEAN HARMLESS
Information can be publicly visible and still deserve protection.
A phone number displayed on an old advert can attract spam or impersonation attempts.
A photograph showing your house number can reveal your location.
A school graduation post can reveal your name, school and approximate age.
A document posted to prove something may expose an address, signature or identification number.
A public business page may contain a personal phone number that is no longer used for that business.
A social-media post can reveal when you are travelling or when a property is empty.
The fact that information is already online does not mean you must continue publishing it.
4. OLD INFORMATION CAN BECOME A NEW RISK
Digital exposure changes over time.
A phone number may have been appropriate for an old business but no longer be yours.
A home address may have been posted when you lived somewhere else.
A public photograph may show children who are now older.
An old CV may contain information you no longer want publicly searchable.
A document uploaded for a one-time application may still be accessible through an old link.
A social-media account you stopped using may still contain personal details.
An old marketplace listing may still display your phone number.
The important question is:
"Do I still need this information to be public?"
If the answer is no, consider removing it, restricting it or replacing it with safer information.
5. START WITH A PERSONAL EXPOSURE INVENTORY
Do not try to clean everything at once.
Start by listing the places where information about you may exist:
- Main social-media accounts
- Old social-media accounts
- Email accounts
- Messaging profiles
- Public groups
- Business pages
- Marketplace accounts
- Job and professional profiles
- School or alumni pages
- Community websites
- Old forums
- Cloud storage
- Shared documents
- Personal websites
- Blogs
- Public repositories
- Event pages
- Old advertisements
- Online directories
- Accounts you no longer use
Then identify what information each location exposes.
A simple inventory can use:
PLATFORM → INFORMATION EXPOSED → WHO CAN SEE IT → STILL NEEDED? → ACTION
This turns a vague privacy concern into a practical cleanup process.
6. SEARCH FOR YOURSELF
One of the most useful checks is to search for information about yourself from the perspective of an ordinary member of the public.
Search combinations such as:
- Your full name
- Your name + town
- Your name + workplace
- Your name + school
- Your phone number
- Your email address
- Old usernames
- Business name + your phone number
- Your name + public documents
- Your name + old organisation
Use more than one search engine if appropriate.
Also search inside the platforms you use. Search engines do not show everything that is visible within social networks, messaging groups, marketplaces or logged-in services.
The goal is not to investigate other people. Search for your own information and assess what a stranger could learn.
7. CHECK OLD SOCIAL-MEDIA ACCOUNTS
Old social accounts are easy to forget.
Look for:
- Accounts you created and stopped using
- Old Facebook pages or profiles
- Old Instagram or TikTok accounts
- Old X or other social accounts
- Old professional profiles
- Old usernames
- Public posts
- Old profile photographs
- Public contact information
- Old biography information
- Connected websites
If you no longer need an account, consider using the platform's official deletion process.
If you still need the account, review its visibility and remove information that no longer needs to be public.
Do not simply abandon an account containing valuable personal information if you can safely close or secure it.
8. REVIEW YOUR PROFILE INFORMATION
Many platforms allow you to publish more information than you realise.
Review:
- Phone number visibility
- Email visibility
- Birthday
- Current location
- Workplace
- School
- Relationship information
- Family information
- Website links
- Other social accounts
- Public contact buttons
- Profile photographs
- Old usernames
Ask:
"Would a stranger need to know this?"
If not, consider removing it or limiting who can see it.
9. REVIEW OLD POSTS, PHOTOS AND VIDEOS
Your profile is only part of your exposure.
Old posts may contain:
- Addresses
- Phone numbers
- Tickets
- Identification documents
- Bank or payment screenshots
- School information
- Workplace details
- Family information
- Children's information
- Travel plans
- Property information
- Vehicle details
- Screenshots containing notifications
- Conversations
- QR codes
- Barcodes
- Account usernames
Review older content, especially material that was originally posted for a temporary purpose.
Do not assume that a disappearing story or temporary post was never copied. Once something has been shared, someone may have saved or captured it.
10. PHOTOS CAN REVEAL MORE THAN THE PHOTO ITSELF
Before publishing a photograph, look beyond the subject.
Check the background for:
- House numbers
- Street signs
- School names
- Office names
- Vehicle registration details
- Identity documents
- Bank cards
- Receipts
- Computer screens
- Phone screens
- Whiteboards
- Addresses
- Passports or tickets
- Children's school information
A photograph can also reveal context such as where you work, where you live or where you regularly spend time.
Before posting, ask:
"What could someone learn from the background?"
11. BE CAREFUL WITH DOCUMENTS AND SCREENSHOTS
A document uploaded to prove one fact can expose many others.
Examples include:
- Identity cards
- Driver's licences
- Passports
- Certificates
- Receipts
- Bank statements
- Payment confirmations
- Invoices
- Contracts
- School documents
- Medical documents
- Utility bills
- Employment letters
Before publishing a document, identify every piece of information visible in it.
If the public only needs to see one fact, consider whether the rest of the document needs to be visible at all.
Where a document must be shared, use the legitimate service and apply appropriate protective measures where accepted.
12. OLD CLOUD FILES AND SHARED LINKS
Cloud storage can create long-lived exposure.
Review services such as:
- Google Drive
- OneDrive
- Dropbox
- iCloud
- Shared business storage
- Collaboration platforms
Check:
- Files shared publicly
- "Anyone with the link" access
- Old folders
- Old application documents
- Old CVs
- Identity documents
- Spreadsheets containing contacts
- Old business records
- Expired projects
- Shared folders belonging to former organisations
Do not assume a file is private simply because it is stored in your account.
Review the actual sharing permissions.
13. CHECK PUBLIC DOCUMENT LINKS
A common mistake is sharing a document link and forgetting about it later.
For each important shared document, ask:
- Who can access it?
- Is the link still active?
- Is public access still necessary?
- Does the document still contain personal information?
- Does the recipient still need access?
- Can access be restricted to specific people?
If the purpose has ended, remove the sharing permission or delete the file where appropriate.
14. REVIEW OLD BUSINESS AND MARKETPLACE LISTINGS
Small businesses and individuals often publish phone numbers for customers to contact them.
Over time, these numbers may become personal numbers or numbers that no longer belong to the business.
Check:
- Old Facebook business pages
- Marketplace listings
- WhatsApp business profiles
- Google business information
- Old adverts
- Classified listings
- Event promotions
- Online directories
- Posters uploaded as images
Remove or update obsolete contact information.
If you run a business, consider separating business contact information from personal contact information so an old business listing does not expose your personal number unnecessarily.
15. REVIEW PUBLIC GROUPS AND COMMUNITY PAGES
Information can remain exposed inside public or large groups.
Look at:
- Public Facebook groups
- Community pages
- School groups
- Professional groups
- Forums
- Public WhatsApp or Telegram communities
- Event pages
Be careful about posting:
- Full names and phone numbers
- Home addresses
- Children's information
- Identity documents
- Financial information
- Travel plans
- Security questions
- Personal disputes containing identifying details
A group can feel private because it is familiar. That does not mean every member is trusted or that content cannot be copied.
16. CHECK YOUR USERNAMES
Old usernames can connect different accounts.
For example, if the same username appears on several platforms, someone may be able to connect:
- Your professional profile
- Your social account
- Your old forum account
- Your gaming account
- Your personal website
You do not necessarily need a different username everywhere. But understand what your current usernames reveal when combined.
Where practical, avoid exposing unnecessary connections between personal and high-value accounts.
17. REVIEW OLD EMAIL ADDRESSES
Email addresses can remain published for years.
Check whether an old email address appears on:
- Websites
- Public profiles
- Business listings
- Old CVs
- Forums
- Documents
- Social profiles
- Public contact pages
If you no longer use an email address, do not assume the exposure disappears automatically.
Where an account still matters, secure it. Where a public listing is obsolete, remove or update it.
18. LOCATION AND TRAVEL EXPOSURE
Real-time location information can create avoidable risk.
Be careful with public posts that reveal:
- That you are currently away from home
- Your exact location
- Your regular route
- Your workplace location
- Your children's school
- Hotel details
- Travel dates
- Property details
- Live event attendance
This does not mean you can never share travel or location content.
Consider whether the information needs to be posted in real time or whether it can safely be shared later.
19. CHILDREN AND FAMILY INFORMATION
Be especially deliberate about information involving children or other family members.
Avoid unnecessary public exposure of:
- Full names
- School names
- Uniform details
- Daily schedules
- Home location
- School routes
- Phone numbers
- Identity documents
- Birth details
- Live locations
A family photograph can contain more information than the caption suggests.
Before posting, look at both the subject and the background.
20. PROFESSIONAL AND CAREER INFORMATION
Professional information can be useful publicly, but old information can become unnecessary exposure.
Review:
- Old CVs
- Old job applications
- Public portfolios
- Staff directories
- Old employer pages
- Conference speaker pages
- Personal biographies
- Contact details
- Old job titles
Remove information that is no longer accurate or necessary.
Be particularly careful with public CVs containing home addresses, personal phone numbers, identity numbers or other information that a recruiter does not need.
21. PUBLIC REPOSITORIES AND TECHNICAL CONTENT
Developers and technical users should review public repositories and project pages.
Look for:
- Personal email addresses
- Phone numbers
- API keys
- Access tokens
- Credentials
- Configuration files
- Database connection strings
- Personal documents
- Internal screenshots
- Private URLs
Never publish secrets simply because a repository is intended to demonstrate your work.
If a secret has already been exposed, removing it from the visible file is not necessarily enough. Treat an exposed credential as compromised and rotate or revoke it through the legitimate service.
22. INFORMATION IN SEARCH RESULTS
Removing information from the original website does not always mean it disappears immediately from search results.
Search engines may retain indexed information for some time.
The correct sequence is usually:
- Remove or correct the information at the original source.
- Check whether the public page is still accessible.
- Where appropriate, use the search engine's official removal or outdated-content process.
- Search again later to confirm what remains visible.
Do not pay an unknown person who promises to "delete your information from Google" without independently verifying the service.
23. DELETION IS NOT THE SAME AS ERASURE EVERYWHERE
When you delete a post or account, copies may still exist.
Possible copies include:
- Screenshots
- Reposts
- Cached pages
- Search-engine indexes
- Quoted text
- Downloaded documents
- Archived pages
- Messages forwarded to others
This does not mean deletion is useless.
Deletion reduces the information available at the original source. It simply cannot guarantee that every previous copy has disappeared.
The correct goal is to reduce exposure as much as reasonably possible.
24. WHAT SHOULD YOU REMOVE FIRST?
Prioritise information that is:
- No longer needed
- Publicly accessible
- Highly sensitive
- Easy to combine with other information
- Connected to account recovery or identity verification
- Linked to your current location
- Linked to your family
- Linked to financial activity
- Attached to old accounts
- Attached to obsolete contact details
Examples of high-priority cleanup include a publicly visible identity document, an old CV containing a home address, a public phone number that is now personal, an old shared folder containing sensitive records, or a forgotten account containing personal information.
25. WHAT SHOULD YOU NOT REMOVE CARELESSLY?
Not every old record should be deleted immediately.
Some information may be required for:
- Legal obligations
- Tax or financial records
- Contracts
- Business operations
- Employment records
- Academic records
- Evidence of a transaction
- Account recovery
- Regulatory requirements
The aim is not indiscriminate deletion.
The aim is to understand what information exists, why it exists, who can access it and whether continued exposure is necessary.
Before deleting an important record, consider whether you need to retain it privately or whether another legitimate record-keeping requirement applies.
26. PRIVACY SETTINGS ARE NOT A ONE-TIME FIX
Privacy settings can change.
Platforms introduce new features, change default settings or create new ways to share information.
Review:
- Who can see your profile
- Who can find you by phone number or email
- Who can tag or mention you
- Who can see your posts
- Who can download or share your content
- Location permissions
- Contact synchronisation
- Connected applications
- Public search visibility
- Profile discovery
Use the platform's current official privacy controls rather than relying on old instructions from a social-media post or video.
27. THIRD-PARTY APPS AND CONNECTED SERVICES
Old applications may continue to have access to your account or information.
Review connected apps and services for important accounts.
Remove access that you no longer recognise or need.
Examples include:
- Old social-media applications
- Productivity tools
- Games
- Marketing tools
- Browser extensions
- Third-party sign-in connections
- Old business integrations
Only revoke access through the official account settings or service interface.
28. YOUR DIGITAL EXPOSURE CAN CHANGE WITHOUT YOU POSTING ANYTHING
You do not have to create a new post for your exposure to increase.
Other people may:
- Tag you
- Mention you
- Publish photographs of you
- Add your contact information to a directory
- Upload a document containing your details
- Publish event information
- Share a screenshot containing your information
You cannot control everything other people publish.
You can still monitor your name, contact details and important identifiers and request correction or removal where appropriate.
29. WHAT TO DO WHEN SOMEONE ELSE HAS PUBLISHED YOUR INFORMATION
If someone publishes your personal information without your permission:
- Identify exactly what was published.
- Save evidence before it disappears.
- Check whether the information creates an immediate security risk.
- Contact the platform or website through its official reporting process.
- Request correction or removal where appropriate.
- If the information is linked to an account or credential, secure the account.
- If the exposure involves serious harm, identity misuse or unlawful processing, consider the appropriate official reporting or data-protection channel.
Do not threaten, hack or attempt to retaliate against the person who published it.
30. A MONTHLY DIGITAL EXPOSURE CHECK
A simple recurring review can prevent exposure from accumulating.
Check:
- Social profiles
- Old accounts
- Public posts
- Public photos
- Shared documents
- Cloud links
- Business listings
- Marketplace listings
- Old CVs
- Public directories
- Usernames
- Email addresses
- Phone numbers
- Connected applications
- Location information
You do not need to perform a complete forensic investigation every month.
A short, consistent review is more useful than waiting until a problem occurs.
31. THE 15-MINUTE CLEANUP
When you do not have time for a full review, use this quick routine:
MINUTE 1–3: Search your name, phone number and main email address.
MINUTE 4–6: Check your main social profile and public contact information.
MINUTE 7–9: Check old shared files and public links.
MINUTE 10–12: Review one old account, business listing or marketplace profile.
MINUTE 13–15: Remove one unnecessary public item and review one privacy setting.
Small improvements compound over time.
32. COMMON MISTAKES
Mistake 1: "It is already online, so it does not matter."
It can still be removed from the original source and reduced from future exposure.
Mistake 2: "I deleted the post, so nobody can see it."
Someone may already have copied or redistributed it.
Mistake 3: "My profile is private, so everything is private."
Individual posts, comments, groups, tagged content and other connected services may have different visibility.
Mistake 4: "I only shared it with a group."
A large or unfamiliar group is not equivalent to a trusted private conversation.
Mistake 5: "The document is harmless because I covered the important number."
Other visible details may still identify you.
Mistake 6: "The account is old, so nobody can access it."
An old account may still contain personal information and may have weak or outdated security.
Mistake 7: "I will delete everything."
Some records may be legitimately necessary. Review before deleting.
Mistake 8: "I changed my privacy settings once."
Privacy settings and platform features change. Periodic review is safer.
33. WHEN EXPOSURE BECOMES AN ACCOUNT-SECURITY PROBLEM
Some information is not merely private. It can contribute to account compromise.
If exposed information includes:
- Passwords
- Recovery codes
- OTPs
- API keys
- Access tokens
- Security answers
- Wallet recovery phrases
treat the situation as a security incident, not merely a privacy issue.
Use the official service to change, revoke or replace the exposed secret.
For credentials and tokens, removal from a public page does not make the original secret safe again.
34. WHEN EXPOSURE BECOMES A FINANCIAL RISK
If public information is being used to impersonate you, contact financial institutions through official channels and monitor relevant accounts.
Be cautious about follow-up messages that use information you previously published.
A scammer who already knows your name, bank, workplace or family details may sound more convincing because some of their information is genuine.
Do not treat familiarity as proof.
35. WHEN EXPOSURE BECOMES AN IDENTITY-THEFT RISK
If sensitive identity information or documents have been exposed, document exactly what was disclosed.
Record:
- What information was exposed
- Where it appeared
- When you discovered it
- Who may have accessed it
- Whether it was removed
- What follow-up actions you took
Watch for unexpected account activity, unusual verification requests, suspicious calls and messages that use your real personal information.
Where an affected organisation has an official incident or support process, use it.
36. A BETTER WAY TO THINK ABOUT PRIVACY
Privacy is not about having nothing online.
It is about maintaining control over unnecessary exposure.
A healthy digital presence can include:
- Information you intentionally publish
- Information that serves a legitimate purpose
- Information you periodically review
- Information protected by appropriate access controls
- Information you remove when it is no longer needed
The objective is not zero exposure.
The objective is deliberate exposure.
37. THE DIGITAL EXPOSURE DECISION TEST
Before publishing or keeping something public, ask:
- PURPOSE
Why does this need to be public?
- AUDIENCE
Who actually needs to see it?
- NECESSITY
Does every detail need to be visible?
- COMBINATION
What could someone learn by combining this with information already online?
- DURATION
Will I still be comfortable with this information being public in one year?
- REVERSIBILITY
If someone copies it today, can I realistically take it back?
- SECURITY
Could this information help someone impersonate me, locate me or access an account?
If the answer raises concern, reduce the exposure before publishing.
38. THE CLEANUP ROUTINE
Use this sequence whenever you review your digital exposure:
FIND Search for information about yourself.
CLASSIFY Separate information that is public, private, sensitive, obsolete or necessary.
PRIORITISE Start with information that creates the greatest unnecessary exposure.
REMOVE Delete obsolete posts, documents, accounts or listings where appropriate.
RESTRICT Change visibility and sharing permissions where deletion is not necessary.
SECURE Protect accounts and rotate exposed credentials or secrets.
CHECK Search again and verify that the exposure has actually reduced.
REPEAT Review periodically because digital exposure changes over time.
39. FINAL CHECKLIST
Before finishing a digital exposure cleanup, ask:
[ ] Have I searched for my own name, phone number and email address?
[ ] Have I checked old social-media accounts?
[ ] Have I reviewed public profile information?
[ ] Have I checked old posts, photographs and videos?
[ ] Have I looked for public identity documents or sensitive screenshots?
[ ] Have I reviewed cloud files and shared links?
[ ] Have I checked old business and marketplace listings?
[ ] Have I reviewed public groups and community pages?
[ ] Have I checked old usernames?
[ ] Have I reviewed old CVs and professional pages?
[ ] Have I checked connected applications and services?
[ ] Have I reviewed location and family information?
[ ] Have I removed information that no longer needs to be public?
[ ] Have I restricted information that should not be publicly visible?
[ ] Have I secured any exposed credentials or secrets?
[ ] Have I checked again after making the changes?
40. FINAL PRINCIPLE
You do not need to disappear from the internet to protect your privacy.
You need to know what is exposed, why it is exposed, who can access it and whether it still needs to be there.
Remove what you no longer need to publish.
Restrict what does not need to be public.
Protect what could be used against you.
Retain what you legitimately need.