Facebook

Is Facebook safe?

Facebook is safe in the narrow sense: it will not infect your phone, and since December 2023 your personal Messenger chats are end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary by default. In every other sense it is a weak app for privacy. Meta tracks you for advertising across apps and websites, it has paid the largest privacy penalties on record in both the US and the EU, and the scam ads in your feed are a problem its own staff tried to measure. We score it 37/100, a little below Instagram.

What Facebook collects

Facebook's App Store privacy label is the same as Instagram's, and it is about as long as these labels get. Contact info, identifiers and "other data" are used to track you across other companies' apps and websites. Linked to your identity are 14 categories: health and fitness, purchases, financial info, location, contact info, contacts, user content, search history, browsing history, identifiers, usage data, sensitive info, diagnostics and other data. Nothing is listed as not linked to you.

Facebook also receives data about what you do outside it, from websites and apps that use Meta's pixel and SDK. Accounts Center lets you see and disconnect that "off-Meta activity" and download a copy of your information, but ads stay personalised. Only in the EU and UK can you pay for an ad-free subscription or choose less personalised ads.

A record of fines

Few companies have a privacy record like this one:

Date	Regulator	Penalty	Finding
July 2019	US FTC	$5 billion	Broke a 2012 order by deceiving users about control of their data, including sharing friends' data with app developers
November 2022	Irish DPC	€265 million	Search and contact-import tools let data be scraped, breaching data protection by design
May 2023	Irish DPC	€1.2 billion	Transfers of European users' data to the US without adequate protection
December 2024	Irish DPC	€251 million	2018 breach in which attackers stole access tokens for about 29 million accounts

The FTC order runs for 20 years. It created an independent privacy committee on Meta's board and requires the chief executive to certify compliance every quarter, with personal liability for false statements. The €1.2 billion decision is still the largest GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary fine ever issued.

The 2018 breach and the 2021 leak of scraped profiles are the security events most users will have been touched by. Phone numbers from that scraped data still feed spam texts and phishing calls years later.

Scam ads and Marketplace fraud

Scams are the risk you are most likely to meet on Facebook. In November 2025 Reuters reported on internal Meta documents that estimated about 10% of the company's 2024 revenue, roughly $16 billion, came from ads for scams and banned goods, and that users were shown about 15 billion "higher risk" scam ads a day. The documents said Meta banned advertisers only when its systems were at least 95% sure of fraud. Meta called the estimate "rough and overly-inclusive" and said it removed more than 134 million scam ads in 2025.

The patterns are familiar: fake celebrity investment ads, cheap goods that never arrive, and "recovery" services that promise to get your money back. On Marketplace, watch for overpayment tricks, requests for a verification code (which hands over your account), and buyers who want to move to WhatsApp or Telegram.

Facebook and younger users

Teenagers use Facebook less than Instagram or TikTok, but the legal cases cover both Meta apps. The New Mexico jury verdict in March 2026 concerned child safety on Instagram and Facebook. In Europe, the Commission found in preliminary findings on 10 July 2026 that infinite scroll, autoplay and personalised recommendations on both apps breach the Digital Services Act, and that teen time limits "can be easily dismissed". In April 2026 it had already issued preliminary findings on Meta's checks for under-13s. Meta disputes both. A final decision could bring a fine of up to 6% of global turnover.

How to make Facebook safer

1. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary in Accounts Center > Password and security, with an authenticator app or passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary rather than SMS.
2. Run the Privacy Checkup and set future posts, your friends list and your phone number lookup to Friends or Only me.
3. In Accounts Center, review "Your activity off Meta technologies", clear the history and disconnect future activity.
4. Never type a login code or password after clicking a link in a message, even from a friend whose account may have been taken over.
5. Treat any ad that promises investment returns or a celebrity tip as a scam, and report it.

How we scored it

Regulatory record (8) sits below Instagram (15) and TikTok (18), after more than €1.7 billion in Irish GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary fines and the $5 billion FTC penalty. Privacy (22) reflects tracking and broad collection. Security (52) gets credit for default encrypted Messenger chats but loses points for a breach history. For messaging, Meta's WhatsApp is the safer choice.