A new social media privacy ranking highlights stark differences in how platforms handle user data, with researchers from data privacy platform Incogni finding Facebook to have the weakest privacy practices.

The study found Facebook, Instagram, YouTube, Facebook Messenger, and Discord to have problematic data retention practices, as they keep personal data for 180 days after accounts are deleted by users.

The analysis found that Reddit is the most privacy-conscious platform, followed by Snapchat and Pinterest. Facebook, Facebook Messenger, and LinkedIn were identified as having the weakest privacy practices.

Length of Time Platforms Keep Users’ Data After Account Has Been Deleted

The study found that Facebook, Instagram, YouTube, Facebook Messenger and Discord all keep users’ data for 180 days after they have deleted their accounts.

It means social platforms could be holding onto personal photos, videos, messages, financial information and health details many months after users believe they have cut ties with the service.

The research raises questions about what social media platforms do with that data and more tangibly, exposes users to data breach or unwanted exposure risks long after they’ve removed themselves from a platform.

WhatsApp, Reddit and Twitch keep users’ data for 90 days, Snapchat holds it for 60 days, while TikTok and X (formerly Twitter) delete data after 30 days. Encrypted messaging service Telegram keeps data for the shortest amount of time at just one day.

How difficult is it to delete an account?

Deleting a social media account should be a relatively easy thing to do for a user once they decide that they no longer wish to use a platform. Yet users of some platforms, including Facebook, YouTube, Instagram and Facebook Messenger, need to make six clicks to delete their account.

Clicks Needed to Delete an Account

Data Breaches

While social media has become indispensable for many people, the platforms pose significant privacy and data security risks.

Since 2012, LinkedIn has experienced four data breaches, followed by X and Facebook with two each. Livestreaming service Twitch had one data breach over the same period.

Government fines, which reflect the platforms’ failures to meet legal requirements, were also assessed by Incogni. Facebook has received eight fines since 2011, while WhatsApp has been fined five times. X and TikTok have both received four fines.

YouTube, Instagram, Facebook Messenger, Snapchat, Pinterest and Twitch have all been fined at least once.

Darius Belejevas, data privacy expert and head of Incogni, comments: “Social media platforms facilitate rich and meaningful interactions but they also pose significant privacy and data security risks.

Recommended reading

• Ofcom Introduces Over 40 New Online Safety Measures
• Instagram Testing New Tools to Combat Sextortion
• Children First See Violent Online Content at Primary School Age

“Users will be shocked to discover that some social media platforms hold onto their data for six months after they have deleted their account.

“It raises big questions about what happens to that data, whether it is being sold to third parties and if people could be unknowingly caught up in data breaches long after they thought they’d severed connections with a platform.

“Our ranking provides an important glimpse into how highly social media platforms value their users’ privacy and whether they are doing enough to keep data secure.”