Large language models and machine learning are still new inventions by historical standards, but in everyday culture they already feel familiar. Collectively known as “AI,” these technologies have opened a Pandora’s Box of privacy concerns.
If AI is old-hat, then social media is ancient history. Yet the privacy risks associated with social media usage have only grown since the first modern social media platforms hit the scene around 20 years ago. These risks saw a stepwise increase in recent years, as so-called AI models began to be integrated into and trained on social media platforms.
Researchers at Incogni have prepared a new social media platform privacy ranking for 2025, expanding their criteria to include LLM and so-called generative-AI training concerns. This year’s ranking also stands out for taking a more nuanced approach than previous studies, expanding its scope to the end user’s experience in gathering and analyzing privacy-related information.
The study examined the top 15 social media platforms by monthly user count and ranked them according to 14 criteria across 6 categories:
- AI integration and training
- Privacy-related regulatory transgressions
- Data collection
- User control and consent
- Transparency
- User-friendliness
The results were appropriately weighted and combined to generate an overall privacy ranking, ordering the platforms according to the extent to which they pose a privacy risk to their users.
Somewhat predictably, Meta’s offerings (Facebook, WhatsApp, Instagram, and Facebook Messenger) and ByteDance’s TikTok round out the bottom of the ranking. Surprisingly, though, less popular platforms like Discord, Pinterest, and Quora fared relatively well.
As nice as it is to have an overall ranking like this, it’s the details of analysis that prove most useful in making informed decisions about which platform to trust, if any. For example, Pinterest, positioned as highly as it is overall, might not be the best option for a user who’s particularly concerned about data collection and sharing, as this is an area in which Pinterest performed worst of all.
The correlation between a platform’s overall position and its performance in the “AI and personal data” category is generally much stronger. This category covers criteria regarding whether a platform reserves for itself the right to train its own or other entities’ so-called AI on user data and whether it offers its users a mechanism for opting out of such data usage.
Other than introducing an AI-related category of assessment criteria, researchers added a subjective dimension to their analysis. Subjective but nonetheless quantified (via, for example, the Dale-Chall formula): the “user friendliness and accessibility” criteria capture how difficult it’s likely to be for a user to parse the relevant privacy policy documentation as well as the number of discrete steps a user would need to perform in order to delete their account.
This is an important part of analysis as it helps to ground the study in a typical user’s perspective. Concepts like “user friendliness” and “accessibility” depend heavily on the extent to which actual users can reasonably be expected to gather and process the information they need to make an informed decision. A privacy policy may well contain all the right information, but if it’s impenetrable to a reader with even a college education, then it fails to perform its core function, communicating salient details to an average user.
Darius Belejevas, Head of Incogni, had this to say:
There are no mainstream social media platforms that could, by any stretch of the imagination, be considered privacy-respecting. That said, social media platforms that respect users’ privacy do exist: Mastodon, PixelFed, and the ActivityPub protocol that allows them to federate are great examples, as are projects like Nostr and Matrix. But these platforms all share a common challenge: low uptake among everyday users. In other words: the network effect.
The reality is that people want the connection and distraction that mainstream social media platforms promise. Making privacy safeguards a desirable selling point is one thing we can all do to sway the market towards a more user-friendly future. The first step to doing that is understanding the privacy risks associated with those platforms as they are now.
This study brings to the fore a phenomenon that affects many aspects of this sometimes nebulous concept of “privacy”: its increasing and accelerating complication. As new as the personal-data exploitation boom of the early 2000s was, it now, in retrospect, looks like a decidedly simpler time. Going far beyond harvesting and analyzing personal data as it’s entered into and generated through interactions with these platforms, these companies are now following users around the web, surveilling their devices, and using anything they can find or infer to train various “AI” models.
Social media platforms are no longer limited to user interactions when it comes to satisfying their seemingly bottomless desire for personal information. Once they have a user’s data, they no longer limit themselves to exploiting it for marketing purposes. Data is sold to and bought from data brokers, disseminated through LLM outputs, and put to a far greater variety of uses... all often without the user’s informed consent and sometimes even contrary to their expressed wishes.
Studies like the one that resulted in Incogni’s social media privacy ranking are both a way to get the lay of this rapidly evolving landscape and a roadmap for choosing those routes that lead to a brighter future.
The full analysis (including public dataset) can be found here.
