How friend suggestions work: signals, filters and controls

You open a social network and, between one post and the next, a box appears: “People you may know”. In it there’s an old schoolmate, the plumber, the parent of one of your child’s friends. And, now and then, someone you’ve never met, with a lot of mutual friends.

It isn’t chance. Behind that box sits a recommendation system (software that cross-references large amounts of data to suggest what it thinks will interest you), and it works from specific signals. Understanding how friend suggestions work is useful for two reasons: knowing why certain people appear in front of you, and knowing which controls you have to decide for yourself who joins your circle.

This post lays out the technologies involved, with their real advantages and limits, without pointing to any specific platform. It is the technology side of the recommendation on connecting only with people you know: the tools help, but the choice of whom to accept remains yours.

How to read this list

First, the mechanism in a few lines. A social network builds a social graph, a map of who is connected to whom, and looks for the “gaps” in it: people you should know, according to the data, but haven’t added yet. The most common signals, weighted differently from one platform to another, are these:

1. uploaded contacts — if you’ve allowed the app to read your phone or email address book, the numbers and addresses end up on its servers and are matched against those of its members. It also works the other way round: if someone who has your number has uploaded their address book, the platform may suggest you to that person even if you’ve never uploaded anything;
2. mutual friends — the more connections you share with someone, the more likely you are to be suggested to each other;
3. networks and groups — the same school, the same stated employer, the same groups, the same events;
4. places — the town listed on your profile, tagged locations and, on some platforms and with some settings, your device’s location (for photos, see the post on turning off photo geotagging);
5. interactions — profiles you’ve visited or searched for, photos you’re both tagged in, comments under the same posts.

One consequence is worth stating straight away: a suggestion measures closeness in the data, not real acquaintance, and it says nothing about whether a person can be trusted. People who create fake profiles know this: a handful of accepted requests is enough to appear as a “likely acquaintance” to others in the same circle. It’s the mechanism behind fake profile attacks.

The technologies are organised into four functions, the same ones used in the post on how to clean up your social connections:

• prevention — deciding in advance who can find you and contact you;
• detection — noticing that a profile or a request doesn’t add up;
• response — removing, restricting, blocking, reporting;
• governance — keeping things in order over time, including for your family or a group.

For each one you’ll find the risk it reduces, its advantages, its honest limits, and how complex it is to use. Menu names vary from one social network to another; the functions are much the same.

1. Prevention technologies

Contact syncing controls

The setting that decides whether the app can upload your phone’s address book and, where available, the page that shows and deletes contacts already uploaded.

• Risk reduced: being suggested to people who have your number for one-off reasons.
• Advantages: it cuts down suggestions based on your address book, and the personal data — yours and other people’s — handed over to the platform.
• Limits: it doesn’t stop suggestions that come from address books uploaded by others; on some platforms, deleting contacts already uploaded is a separate, hard-to-find option.
• Example: you turn off address book uploading and delete the copy uploaded years ago.
• Complexity: basic.

Who can find you and who can send you requests

The options that decide whether people who know your phone number or email address can find your profile, and who can send you a friend request: everyone, friends of friends only, or no one.

• Risk reduced: requests from complete strangers, and people finding your profile from a piece of personal data.
• Advantages: it greatly reduces unwanted requests, while leaving the door open to people who share a contact with you.
• Limits: “friends of friends” is a wider filter than it looks: a single contact accepted too lightly is enough to open it up to a circle of strangers.
• Example: you set friend requests to “friends of friends” and turn off search by phone number.
• Complexity: basic.

Private account and follower approval

A private profile shows posts, stories and often your list of contacts only to people you’ve approved; on networks built around followers (people who follow your profile without you necessarily following them back), every new request goes through you.

• Risk reduced: content read by anyone, and information gathered by strangers.
• Advantages: it turns following from automatic into deliberate; it makes every new arrival in your circle visible.
• Limits: your name, profile picture and some details often remain public; anyone you’ve already accepted sees everything, and can copy or save what you post.
• Example: you switch to a private account and, from then on, every new follower has to ask your permission.
• Complexity: basic.

Restricted lists and post audiences

Groups of contacts you create yourself — “close friends”, “work”, “restricted” — and the selector that decides, post by post, who can see what.

• Risk reduced: personal information shared with contacts you barely know.
• Advantages: it lets you stay politely connected with colleagues or acquaintances without opening your private life to them; people on a restricted list usually see only public content and aren’t told.
• Limits: it needs looking after over time; one post shared with the wrong audience is enough to undo it.
• Example: you accept a request from a colleague you hardly know and put them on your restricted list.
• Complexity: intermediate.

2. Detection technologies

Profile and account information

Many platforms show context: how long the account has existed, whether it has recently changed its name, sometimes the country it’s run from, and which friends you have in common.

• Risk reduced: accepting a profile that was created recently or renamed to imitate someone else.
• Advantages: it gives you concrete evidence instead of an impression; mutual friends can be checked with a direct question, away from the social network.
• Limits: the information available varies a great deal between platforms; a fake profile patiently “aged” over time can pass this check. The details worth looking at are gathered in the post on the signs of a fake profile.
• Complexity: basic.

Verification badges

The symbol next to a name that marks an account as verified.

• Risk reduced: mistaking an imitation for the genuine profile of a public figure, a company or an organisation.
• Advantages: on well-known accounts, it’s a quick way to tell the original from the copies.
• Limits: its meaning changes from one network to another — on some it indicates a checked identity, on others also, or mainly, a paid subscription; it says nothing about the intentions of whoever is behind the account; it’s easily imitated with an emoji in the name or profile picture. And for personal contacts, it’s almost always absent.
• Complexity: basic.

Message request filters

The separate folder for messages from people who aren’t among your contacts, often with automatic filters.

• Risk reduced: conversations started by strangers who aim to build up trust.
• Advantages: you can read and decide calmly, often without the other person knowing you’ve seen the message.
• Limits: automatic filters make mistakes in both directions; a fake profile you’ve already accepted writes straight to your main inbox.
• Complexity: basic.

3. Response technologies

Removing a contact or unfollowing

The simplest step, and often the one people put off the longest.

• Risk reduced: contacts whose origin you can’t remember who keep seeing what you post.
• Advantages: immediate; usually the other person receives no notification.
• Limits: they can send a new request; whatever they saw or saved before stays in their hands.
• Complexity: basic.

Restricting or muting

Features that reduce interaction without breaking the connection: that person’s comments become visible only to them, and their content disappears from your feed.

• Risk reduced: persistence from a contact you’d rather not remove.
• Advantages: discreet, reversible, useful when removing or blocking would cause friction.
• Limits: the contact stays in your circle and keeps seeing whatever you share with them.
• Complexity: basic.

Blocking

It stops the other person from seeing your profile, searching for you, messaging you or tagging you.

• Risk reduced: harassment, persistent contacts, fake profiles that keep coming back.
• Advantages: it shuts down communication in a single step.
• Limits: someone determined can create another profile; public content stays visible.
• Complexity: basic.

Reporting

The form for telling the platform about a fake profile or identity theft.

• Risk reduced: profiles that go on reaching other people in your circle.
• Advantages: it’s usually anonymous; it protects your contacts too, not just you.
• Limits: response times and outcomes aren’t guaranteed; it’s best to report and block, rather than relying on the report alone.
• Example: you get a request from a profile using the name and photo of a friend who’s already among your contacts: you report it, block it, and let your friend know through another channel.
• Complexity: basic.

4. Governance technologies

These become relevant when the circle isn’t only yours: a family, a group, an association.

Guided privacy check-ups

Built-in walkthroughs that review, one screen at a time, who can see your posts, who can find you and who can contact you.

• Risk reduced: settings chosen years ago and never revisited.
• Advantages: they bring together in a single path options otherwise scattered across many menus.
• Limits: they don’t cover everything; your contacts still need reviewing by hand.
• Complexity: basic.

Supervision for younger users’ accounts

Tools that let a parent see, in agreement with their child, the main settings of the child’s account.

• Risk reduced: requests from adult strangers to children and teenagers.
• Advantages: accounts belonging to minors often start with stricter settings; supervision makes changes visible.
• Limits: it works when built on conversation, not control; it’s easily sidestepped with a second account.
• Complexity: intermediate.

Training and awareness

Learning paths that explain the why, not just the how.

• Risk reduced: correct settings but hasty decisions when a request arrives.
• Advantages: it’s what makes behaviour last over time; it’s the pillar on which the Cyber Welfare Framework rests.
• Limits: it requires continuity; a one-off session has a short-lived effect.
• Complexity: basic.

Comparison table

How to choose

If you’re an individual. Requests limited to friends of friends, search by phone number turned off, address book not synced: three settings, a few minutes, and most requests from strangers disappear. A private account if you mainly use the network with friends and family.

If you also use social media for work. On professional networks, accepting people you haven’t met in person can make sense, with judgement: check through another channel anyone who asks for information straight away, and sort your contacts into lists.

If you run a group, a page or your family’s accounts. Joining questions and approval of new members, at least two administrators, agreed supervision for your children’s accounts, and a guided privacy check-up to repeat together now and then.

A rule of thumb. A suggestion is the platform’s guess, not a guarantee. No filter replaces the question that matters: “Do I really know this person, and can I confirm it away from here?”. The combination that gives the best result for the effort involved is limited requests + address book not synced + checking outside the network before accepting: you can build up from there, but below that threshold your circle tends to grow on its own.

How this connects to the Cyber Welfare Framework

Reference level: FL3 — Autonomous. This is the level at which you understand a tool well enough to use it with judgement and to find the right settings on your own.

Conclusion

Friend suggestions are neither good nor bad: they’re an inference built on data, which sometimes finds an old friend and sometimes presents you with a profile built for the purpose. Knowing how friend suggestions work means reading them for what they are and using the controls the platform already offers. Later on, the Security Measures devoted to social media privacy will cover the rest of your profile. If you’d like a sense of where to start, the digital resilience self-assessment gives you a reference point.

What to do next. Open the settings of the social network you use most, limit friend requests to friends of friends, and check whether your address book has been uploaded: if it has, delete the uploaded contacts.

Related content

• Connecting only with people you know — the recommendation this belongs to
• How to clean up your social connections — how to put these technologies into practice, in order
• Fake profile attacks — the abuses these technologies are designed against
• Signs of a fake profile — what to look out for before accepting
• Risks of accepting strangers online — what is at stake with every request you accept

Related resources

Short pieces from the Resources section, for anyone who wants to focus on a single aspect:

• Security and Privacy Settings: The Half Hour Worth Spending
• Fake Dating Apps: Recognising the Ones Built to Extract

Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.