Things You Should Never Post Online
From home addresses to vacation check-ins, certain types of shared information carry serious real-world consequences — here’s what to keep off public platforms.
Every day, billions of pieces of personal information are voluntarily shared across social media platforms, public forums, and messaging apps — often with little thought given to who might see them or how they might be used. The things you should never post online are not always obvious, which is precisely why so many people continue to make the same avoidable mistakes. From innocent vacation announcements to seemingly harmless birthday posts, oversharing online has become one of the most exploited vectors for identity theft, burglary, financial fraud, and reputational harm. According to the U.S. Federal Trade Commission, Americans lost more than $12.5 billion to fraud in 2024 — the highest annual figure ever recorded by the agency — and many of those schemes began with personal details shared openly on the internet. Understanding exactly which categories of information are most dangerous to share publicly is an essential part of navigating digital life safely in an era when the internet truly does not forget.
Your Home Address and Real-Time Location Data
Sharing a home address on any public-facing platform — whether in a profile bio, a Facebook post, or a community forum — gives bad actors the most direct possible entry point into your physical life. Even indirect location disclosure carries significant risk. Photographs of addressed packages, posts showing nearby street signs or recognizable landmarks, and images with embedded EXIF metadata can all reveal a precise residential location to anyone willing to look closely enough.
The risk extends well beyond generic privacy concerns. Security researchers and law enforcement agencies have documented cases in which criminals used location data extracted from social media photographs to identify and target specific properties. According to Insight Security, a UK-based security consultancy, convicted burglars have described scanning public Facebook and Instagram posts specifically to identify when homeowners announce they are away — and then using tools like Google Street View to assess entry points and security measures around those properties before committing a break-in.
Real-time check-ins at airports, restaurants, and attractions are particularly problematic because they signal not only where a person is, but where they are not — namely, at home. Posts tagging a current location or displaying the name of a hotel or resort simultaneously broadcast that an address is unoccupied, often to an audience far larger than the poster intends. Even posts shared with friends-only settings can be reshared or viewed by others through mutual connections, making privacy settings an imperfect safeguard.
A 2025 survey conducted by Léger on behalf of Allstate Insurance found that nearly one-third — 32 percent — of active Canadian social media users post about their travel plans before or during a trip, a figure that rises to 51 percent among users aged 18 to 34. The survey was conducted to examine how vacation-related posting behavior creates potential exposure to residential theft.
Financial Account Details and Sensitive Identity Markers
Posting photographs of credit cards, bank statements, or checks — even partially visible in the background of an image — exposes account numbers, routing information, and card security codes to anyone who views the content. This category of oversharing is more common than many people realize; images showing new purchases, home closing documents, tax return letters, or financial mail in the background of an unrelated photo can inadvertently include enough data to enable account fraud.
Beyond direct financial information, identity markers that seem individually harmless are frequently assembled by criminals into a usable profile. Full birthdates, Social Security numbers, mother’s maiden name, and the answers to common security questions — such as the name of a first pet or the street someone grew up on — are routinely shared in the form of viral social media games, personality quizzes, and anniversary posts. The FTC received more than 1.1 million reports of identity theft in 2024, making it one of the top categories of consumer complaints filed with the agency that year.
FTC Consumer Sentinel data. Figures represent total reported fraud losses in billions of USD.
Credit card fraud alone accounted for more than 450,000 FTC reports in 2024, with over 400,000 of those involving new fraudulent accounts opened using stolen personal information. Bank transfer and payment fraud produced even greater monetary losses, exceeding $2 billion in 2024 according to Security.org’s analysis of FTC Sentinel data. These figures underscore the degree to which seemingly small data disclosures — a birthday, a bank name, a piece of mail — can cascade into significant financial and legal consequences for victims.
Vacation Plans and Travel Announcements That Signal an Empty Home
Announcing upcoming travel on social media is among the most widely documented yet persistently common forms of digital oversharing. When a person publicly declares that they will be away from home for a week — or checks in at an international airport to signal the start of a trip — they are effectively broadcasting that their property will be unoccupied and potentially vulnerable. Law enforcement agencies have repeatedly warned against this behavior, and the correlation between social media vacation posts and residential burglaries has been documented in multiple countries.
The Bureau of Justice Statistics, a division of the U.S. Department of Justice, has reported that home burglaries are 11 percent more common during summer months than at other times of year, a period that coincides with heightened vacation activity and the increased social media posting that accompanies it. A report widely cited in insurance industry guidance additionally noted that homes without security systems are 300 percent more likely to be broken into than homes with them, compounding the risk for homeowners who advertise their absence online without other protective measures in place.
Digital photographs taken with smartphones contain exchangeable image file data — known as EXIF data — that typically includes the camera model, the date and time the photo was taken, and in many cases, the GPS coordinates of the location where the image was captured. When these photos are uploaded without stripping EXIF data, they may expose precise location information even when no location is explicitly mentioned in the post caption.
The safest approach, recommended consistently by law enforcement and cybersecurity professionals, is to delay posting travel content until after a trip has concluded and the traveler has returned home. This removes the window during which a public post would indicate that a property is vacant. Restricting social media posts to a verified, closely managed friend list can reduce — but not eliminate — exposure, since posts can still be screenshotted and shared beyond the intended audience.
Children’s Personal Information and the Risks of Sharenting
Posting photographs and personal details about children online — a practice commonly referred to as “sharenting” — raises a distinct set of privacy and safety concerns that parents often underestimate. Images of children can be harvested from social media accounts, stripped of context, and misused. Beyond imagery, specific details such as a child’s full name, date of birth, school name, or daily routine — when shared across public posts over time — create a profile that can be exploited for purposes ranging from identity theft to targeted contact by individuals with harmful intentions.
The risks associated with children’s data online have attracted increasing regulatory attention. The Federal Trade Commission finalized significant updates to the Children’s Online Privacy Protection Rule — commonly known as COPPA — in January 2025, expanding the definition of personal information to include biometric identifiers and government-issued identification numbers, and imposing stricter data minimization requirements on platforms that collect information from users under the age of 13. A September 2024 FTC staff report also found that major social media and video streaming companies had “failed to adequately protect kids and teens” and that their data collection practices exposed young users to risks including identity theft and stalking.
Child identity theft is a particularly underreported problem because it often goes undetected for years. Because children have no existing credit history, a stolen identity can be used to open accounts, apply for loans, or obtain government benefits without triggering immediate financial red flags. Parents who regularly share their children’s full names, ages, and schools online are inadvertently providing the foundational data points that make such fraud possible.
