Oversharing Online: What Your Last Ten Posts Really Say

Additional resource for the lesson “Oversharing: When Sharing Tells Too Much” — Online Privacy course

Oversharing online is rarely about sharing too much of your life. It is about the details that travel with a post without you noticing: where you are right now, what is in the background, what a ticket in the corner says. This resource turns the lesson into a gentle audit of your last ten posts, so you can keep telling your story and leave the clues out.

A. Why this matters

When you look at a photo you posted, you see the moment: the friends, the light, the mood. A stranger sees where you were, when, whether you were away from home, and anything in the frame.

None of this means sharing is a mistake. Avoiding oversharing online is not about posting less. It is about noticing what each post says beyond what you meant it to say, and deciding whether you are happy for it to say that.

This is a privacy question rather than a security one. Security is about who can get into your accounts and devices. Privacy is about what is known about you, by whom, and what you choose to let them know. A post can be perfectly secure and still tell a stranger that your flat is empty until Sunday.

What the sources say

The UK’s National Cyber Security Centre (NCSC), in its guide to using social media safely, puts the whole idea in one line: “Think about what you’re posting, and who has access to it.” It also suggests asking what your followers actually need to know, and which details are unnecessary.

The Office of the Privacy Commissioner of Canada, Canada’s federal privacy regulator, gives a concrete example: “posting pictures while overseas can let would-be burglars know when you are not at home.” Get Safe Online, a UK online-safety awareness organisation, makes the same point about holiday posts, and adds a reminder that the people who appear in your photos have a right to privacy too.

The Electronic Frontier Foundation (EFF), a digital rights organisation, explains in its Surveillance Self-Defense guide that a photo can carry metadata, hidden information that may include the time and place it was taken. It also notes that even small details, such as reflections in the image, can help pinpoint a location. Apple and Google both document how location is stored in photos and how to leave it out when you share.

B. Key concepts

Five ideas that help you read your own posts the way a stranger would.

What a post tells, not just what it shows

A post shows a scene. It also tells things: that you are away, that you go to the same gym every Tuesday, that your child’s school has a particular uniform. The telling is usually unintended.

Why it matters to you: You cannot see the extra information easily, because you look at the memory. Reading your post as a stranger would is the skill that makes the rest possible.

Real-time location announces absence

A post published while something is still happening, such as a holiday, a concert or a run, tells people where you are now. By implication, it also tells them where you are not.

Why it matters to you: “At the beach!” is a happy message. Posted publicly, live, it can also mean “the flat is empty”. Timing, not content, is what turns a memory into a notice.

Background leakage

The subject of a photo is your choice. The background often is not: a street sign, a house number, a car number plate, a name on a doorbell, a screen left open, a reflection in a window. Documents count too. Boarding pass barcodes and QR codes can contain the booking code, and in one case documented by the security journalist Brian Krebs, a booking code and a surname were enough to open the passenger’s reservation online.

Why it matters to you: A quick look at the edges of a photo before you post takes seconds and removes the details you never meant to share.

Location in photos

Many phone cameras can save where a photo was taken inside the file itself. This is called geotagging.

Apple explains that on an iPhone, location can be saved only if the Camera app has access to Location Services, and that you can change this under Settings › Privacy & Security › Location Services › Camera. When you share, the Options button in the Share Sheet lets you turn Location off for those photos. Google Photos does not include location details in links you share by default, but Google notes that people may still guess the place from landmarks in the picture.

Why it matters to you: Turning off the hidden location is a one-off setting. What the picture itself shows is something only you can check.

The two questions and the “afterwards” rule

Before you post, ask two questions. What does this really show, beyond what I want to show? And who will see it? Then apply one habit: tell the trip once you are back, the run once it is done, the event once it is over.

Why it matters to you: Same story, same photos, same pleasure in sharing. The only thing that changes is that “right now I am not at home” is not published live.

C. A practical example: Luca’s week in Greece

Luca, 36, spent a week on a Greek island and posted something nearly every day. Back home in Milan, he scrolled through his own profile as if he were someone else.

What he found:

• Day 1: a photo of his boarding pass at the gate, with the barcode and booking code clearly visible.
• Days 1 to 6: a story every day from the beach, all published live, all public.
• Day 3: a photo from the apartment balcony, with the street sign and the building number in the background.
• Day 4: a caption saying “Three more days, then back to Milan!”

Together, his posts said where he was, that his flat was empty, and when he would be back. No single post was careless. The pattern was the problem, and it only showed when he read the posts in a row.

What changed for the next trip

• Luca kept every kind of photo he likes, and stopped photographing tickets and boarding passes.
• He took a moment before each post to look at the background, and cropped out house numbers and street signs.
• He turned off location for his phone’s camera, so his photos no longer carry it in the file.
• He saved his best photos as drafts and posted them once he was home, with the same captions.

His friends still saw the trip. The difference was that nothing he posted said where he was at that moment, or that his flat was empty.

D. Try it yourself: the ten-post audit (15 minutes)

Four short steps. This is not a test, and there is nothing to feel bad about. You are looking for a pattern, because a pattern is something you can change.

Step 1 — Collect your last ten posts (2 minutes)

• Open your own profile on the platform you use most, or the two you use most.
• Note your last ten posts or stories. Archived stories count, if your platform keeps them.
• For each one, check who could see it: anyone, friends or followers, or a smaller list.

Step 2 — Read them as a stranger would (8 minutes)

• For each post, write one line on what it shows, and one line on what it tells.
• Mark it with any of these four flags that apply:
• L — live location: published while you were still there.
• R — routine: a place or time that repeats, such as a gym, a school gate or a regular café.
• D — document: a ticket, boarding pass, badge, letter or screen with readable details.
• B — background: a house number, street sign, number plate, reflection or open screen.

Step 3 — Look for the pattern (2 minutes)

• Count the flags. Is there one that comes up more than the others?
• That habit, not any single post, is what your audit has found.
• If no flag repeats, that is a useful finding too: your habits already work for you.

Step 4 — Make one decision (3 minutes)

Choose one of these. One is enough.

• Adopt the “afterwards” rule for anything that shows where you are now.
• Turn off location for your phone’s camera. On an iPhone this is under Settings › Privacy & Security › Location Services › Camera; on other phones, look in the camera app’s settings for a location option.
• Change the audience of, or remove, the one post that told the most.

Already covered in the Online Security course

Hide Photos on Your Phone: What the Built-In Options Do
It covers the photos you keep on your device, and how to keep them out of sight when someone else picks up your phone.

E. Videos, articles and further resources

Institutional sources first, then platform documentation and one example of what a document in a photo can reveal. All in English.

Institutional sources

NCSC (UK) — Social Media: how to use it safely
A short guide from the UK’s National Cyber Security Centre on thinking about what you post, who can see it, and managing your digital footprint.
https://www.ncsc.gov.uk/guidance/social-media-how-to-use-it-safely

Office of the Privacy Commissioner of Canada — Your privacy and social media
Practical tips from a national data protection authority, including limiting identifying details and not sharing your location.
https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/online-privacy/social-media/02_05_d_74_sn/

Get Safe Online — Be aware of what you share
UK awareness advice on holiday posts, location settings and respecting the privacy of the people in your photos.
https://www.getsafeonline.org/whatdoyoushare/

EFF Surveillance Self-Defense — Protecting Yourself on Social Networks
How privacy settings, photo metadata and small visual details shape what a post reveals.
https://ssd.eff.org/module/protecting-yourself-social-networks

Platform documentation

Apple Support — Manage location metadata in Photos
How to stop the iPhone camera saving location, and how to leave location out when you share a photo.
https://support.apple.com/guide/personal-safety/manage-location-metadata-in-photos-ips0d7a5df82/web

Google Photos Help — How Google Photos protects your location data
What location information is, and is not, included when you share photos from Google Photos.
https://support.google.com/photos/answer/11190100?hl=en

What a document in a photo can reveal

Krebs on Security — Why It’s Still A Bad Idea to Post or Trash Your Airline Boarding Pass
A security journalist’s account of what a boarding pass barcode contains and what a booking code can open.
https://krebsonsecurity.com/2017/08/why-its-still-a-bad-idea-to-post-or-trash-your-airline-boarding-pass/

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Secure Behaviour pillar at level FL2 – Beginner: it turns the lesson’s insight into a habit you can repeat before every post.

Skills

• Reading a post for what it tells, not only for what it shows.
• Spotting the four flags in your own posts: live location, routine, document, background.
• Turning off location in your camera and leaving it out when you share.

Awareness

• Understanding that timing, not content, is what turns a holiday photo into a notice that you are away.
• Knowing that a photo can carry hidden location data, and that the picture itself can reveal a place.
• Recognising that the people in your posts have their own privacy choices to make.

Secure Behaviour

• Asking the two questions before posting: what does this really show, and who will see it?
• Posting “afterwards” for anything that reveals where you are now.
• Checking the edges of a photo, and leaving out tickets and documents.

G. Questions to sit with

• Which of your ten posts told the most, and did anything about it surprise you?
• Is there someone who appears in your posts more than they might choose to? Would you ask them how they feel about it?
• Which upcoming trip or event will be your first chance to try the “afterwards” rule?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Timing and location

• R32 — Turn off photo geotagging, so your photos do not carry the place they were taken.
• R12 — Turn off Bluetooth and location when you do not need them, so fewer apps know where you are in real time.
• The “afterwards” rule — publish when you are back, not while you are away. This is a habit from the course rather than a database recommendation.

Minimum commitment: decide now that your next trip or event will be shared once it is over.

2. What is in the picture, and who sees it

• R24 — Think twice before posting photos with QR codes, such as tickets, boarding passes and badges: the code can hold more than it shows.
• R23 — Connect only with people you know, so the audience for your everyday posts is one you have chosen.

Minimum commitment: change the audience of, or remove, the one post that told the most in your audit.

In short

• Oversharing online is about what a post tells, not how often you post.
• A live post can announce that you are away. The same post, shared afterwards, tells the same story.
• Check the background, leave out tickets and documents, and turn off location in your camera.
• Ask two questions before posting: what does this really show, and who will see it?

Related resources in this course

• Your Digital Footprint: Map the Data Traces of One Ordinary Day
• Social Media Privacy Settings: A 10-Minute Visibility Check
• Privacy Dashboard: What ‘Free’ Services Know About You

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.