Things You Should Never Post Online

Your Home Address and Real-Time Location Data

Sharing a home address on any public-facing platform — whether in a profile bio, a Facebook post, or a community forum — gives bad actors the most direct possible entry point into your physical life. Even indirect location disclosure carries significant risk. Photographs of addressed packages, posts showing nearby street signs or recognizable landmarks, and images with embedded EXIF metadata can all reveal a precise residential location to anyone willing to look closely enough.

The risk extends well beyond generic privacy concerns. Security researchers and law enforcement agencies have documented cases in which criminals used location data extracted from social media photographs to identify and target specific properties. According to Insight Security, a UK-based security consultancy, convicted burglars have described scanning public Facebook and Instagram posts specifically to identify when homeowners announce they are away — and then using tools like Google Street View to assess entry points and security measures around those properties before committing a break-in.

Real-time check-ins at airports, restaurants, and attractions are particularly problematic because they signal not only where a person is, but where they are not — namely, at home. Posts tagging a current location or displaying the name of a hotel or resort simultaneously broadcast that an address is unoccupied, often to an audience far larger than the poster intends. Even posts shared with friends-only settings can be reshared or viewed by others through mutual connections, making privacy settings an imperfect safeguard.

Financial Account Details and Sensitive Identity Markers

Posting photographs of credit cards, bank statements, or checks — even partially visible in the background of an image — exposes account numbers, routing information, and card security codes to anyone who views the content. This category of oversharing is more common than many people realize; images showing new purchases, home closing documents, tax return letters, or financial mail in the background of an unrelated photo can inadvertently include enough data to enable account fraud.

Beyond direct financial information, identity markers that seem individually harmless are frequently assembled by criminals into a usable profile. Full birthdates, Social Security numbers, mother’s maiden name, and the answers to common security questions — such as the name of a first pet or the street someone grew up on — are routinely shared in the form of viral social media games, personality quizzes, and anniversary posts. The FTC received more than 1.1 million reports of identity theft in 2024, making it one of the top categories of consumer complaints filed with the agency that year.

Credit card fraud alone accounted for more than 450,000 FTC reports in 2024, with over 400,000 of those involving new fraudulent accounts opened using stolen personal information. Bank transfer and payment fraud produced even greater monetary losses, exceeding $2 billion in 2024 according to Security.org’s analysis of FTC Sentinel data. These figures underscore the degree to which seemingly small data disclosures — a birthday, a bank name, a piece of mail — can cascade into significant financial and legal consequences for victims.

Vacation Plans and Travel Announcements That Signal an Empty Home

Announcing upcoming travel on social media is among the most widely documented yet persistently common forms of digital oversharing. When a person publicly declares that they will be away from home for a week — or checks in at an international airport to signal the start of a trip — they are effectively broadcasting that their property will be unoccupied and potentially vulnerable. Law enforcement agencies have repeatedly warned against this behavior, and the correlation between social media vacation posts and residential burglaries has been documented in multiple countries.

The Bureau of Justice Statistics, a division of the U.S. Department of Justice, has reported that home burglaries are 11 percent more common during summer months than at other times of year, a period that coincides with heightened vacation activity and the increased social media posting that accompanies it. A report widely cited in insurance industry guidance additionally noted that homes without security systems are 300 percent more likely to be broken into than homes with them, compounding the risk for homeowners who advertise their absence online without other protective measures in place.

The safest approach, recommended consistently by law enforcement and cybersecurity professionals, is to delay posting travel content until after a trip has concluded and the traveler has returned home. This removes the window during which a public post would indicate that a property is vacant. Restricting social media posts to a verified, closely managed friend list can reduce — but not eliminate — exposure, since posts can still be screenshotted and shared beyond the intended audience.

Children’s Personal Information and the Risks of Sharenting

Posting photographs and personal details about children online — a practice commonly referred to as “sharenting” — raises a distinct set of privacy and safety concerns that parents often underestimate. Images of children can be harvested from social media accounts, stripped of context, and misused. Beyond imagery, specific details such as a child’s full name, date of birth, school name, or daily routine — when shared across public posts over time — create a profile that can be exploited for purposes ranging from identity theft to targeted contact by individuals with harmful intentions.

The risks associated with children’s data online have attracted increasing regulatory attention. The Federal Trade Commission finalized significant updates to the Children’s Online Privacy Protection Rule — commonly known as COPPA — in January 2025, expanding the definition of personal information to include biometric identifiers and government-issued identification numbers, and imposing stricter data minimization requirements on platforms that collect information from users under the age of 13. A September 2024 FTC staff report also found that major social media and video streaming companies had “failed to adequately protect kids and teens” and that their data collection practices exposed young users to risks including identity theft and stalking.

Child identity theft is a particularly underreported problem because it often goes undetected for years. Because children have no existing credit history, a stolen identity can be used to open accounts, apply for loans, or obtain government benefits without triggering immediate financial red flags. Parents who regularly share their children’s full names, ages, and schools online are inadvertently providing the foundational data points that make such fraud possible.

Workplace Grievances, Confidential Information, and Professional Complaints

Venting about a workplace online — whether about a difficult manager, a frustrating policy, or a specific incident involving colleagues — can have lasting professional and legal consequences. Posts that identify an employer or describe internal situations in identifiable terms can violate employment agreements, breach confidentiality clauses, and in some industries, contravene regulatory requirements. Employees who share protected business information, client details, or proprietary processes on public platforms may face disciplinary action up to and including termination, regardless of whether the post was intended as a harmless expression of frustration.

Healthcare is one of the sectors most heavily governed in this area. The Health Insurance Portability and Accountability Act — HIPAA — prohibits the unauthorized disclosure of protected health information, and social media posts by healthcare workers have generated enforcement actions, nursing board suspensions, and financial penalties for their employers. In 2025, Cadia Healthcare agreed to pay $182,000 to settle federal allegations that the organization had disclosed protected health information on its social media account without obtaining required patient authorizations, according to reporting by the HIPAA Journal. In a separate 2025 incident, a Florida nurse who livestreamed a medication administration procedure on TikTok was terminated and referred to the state’s Board of Nursing, which subsequently suspended her license.

Beyond regulated industries, the reputational risk of professional oversharing affects workers in nearly every field. Screenshots of employer criticism, internal complaints, or colleague conflicts shared in semi-public online groups regularly surface in hiring processes, performance reviews, and litigation. Courts in multiple jurisdictions have upheld the use of publicly accessible social media content as evidence in employment disputes, demonstrating that the expectation of informal digital communication does not insulate posts from legal scrutiny.

Passwords, Security Questions, and Authentication Credentials

The explicit sharing of passwords or login credentials online may seem too obvious to address, but the broader category of information that enables unauthorized account access is far more subtle. Social media quizzes and chain posts frequently ask users to share the name of the street they grew up on, their mother’s maiden name, the make of their first car, or the name of their childhood pet. These are not merely nostalgic exercises — they are, in many cases, the exact questions used by financial institutions, email providers, and government agencies to verify identity and reset account access.

SIM-swapping is one attack vector that leverages publicly available personal details to compromise account security. In a SIM-swap attack, a criminal contacts a mobile carrier, impersonates the account holder using information gathered from social media, and requests that the phone number be transferred to a device under the attacker’s control. Once accomplished, the attacker can intercept two-factor authentication codes and gain entry to banking, email, and other accounts linked to that phone number. The Federal Bureau of Investigation has issued public warnings about SIM-swapping and has noted that victims have reported losses in the millions of dollars from individual incidents.

Posting a photograph of a new payment card — even one showing only part of the card number — or sharing the name of a bank alongside other identifying personal information creates a mosaic that is more useful to a fraudster than any single piece of data in isolation. Security professionals consistently advise treating all financial account identifiers as confidential and avoiding any public discussion of the institutions, card types, or account formats associated with personal finances.

Sensitive Personal Opinions and Content That Creates Lasting Digital Records

Social media platforms archive content in ways that can make it retrievable long after the original post has been deleted by the user. Screenshots, web archives, and third-party data aggregators routinely capture and preserve content that the poster believed was temporary or limited in reach. Opinions expressed during moments of anger, photographs shared carelessly, or statements made in the context of a specific moment can resurface years later in professional, legal, or personal contexts with consequences the poster did not foresee at the time of posting.

Employers routinely review the public social media activity of job applicants and current employees. Statements about political views, legal disputes, personal relationships, or lifestyle choices — while protected by free expression principles in many contexts — can factor into hiring decisions, promotion considerations, and termination proceedings in ways that are difficult to contest or document. The digital permanence of social media content makes the decision to post a judgment call with a potentially long horizon, extending well beyond the immediate moment of sharing.

The aggregation problem — in which individually innocuous pieces of information combine to form a detailed and exploitable personal profile — applies to online content just as it does to data held by third parties. A person who separately posts their employer, their neighborhood, their daily commute route, their vehicle, and their gym schedule has collectively provided enough information for a determined individual to monitor their physical movements, even if no single post was intended to convey sensitive information. Awareness of this cumulative exposure is as important as avoiding any single category of sensitive content.

Frequently Asked Questions About Online Oversharing