Search the library

← Back to latest stories

Before You Post Holiday Travel Plans: A Privacy Pass

Share the trip without announcing an empty house. A privacy pass for photos, location tags, audience settings and out-of-office replies before you leave.

Pixel-art suitcase by a front door with a darkened window, a small padlock on the doorknob and a cream calendar page on a charcoal wall.

You do not have to stop sharing your holiday. You do have to decide who is watching, what the photos quietly say, and when the post goes up.

The timeline that does most of the work

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) states the rule in its travel tip sheet under the heading “Never click and tell”: “Do not tell the social media world that you are going to be away from your home. Disable geo-tagging and do not post your travel pictures on social media until you return from vacation.” It adds that seemingly random details, such as vacation plans, are “all criminals need to know to target you, your loved ones, and your physical belongings.” The tip sheet is a general federal guide, not a burglary study, so we make no claim about how often posts lead to break-ins. The rule is still the simplest one to follow: post when you are back, or post only to people you would trust with the house key. Asking a neighbor to watch the house and to bring in mail is our own practical addition.

Before, during and after the trip
When Do Skip
One week before Review who can see your posts; tell a neighbor; plan mail Countdown posts with dates and “we’re gone from X to Y”
Days before Check camera location settings; set audience to friends only Boarding-pass and ticket photos
During Share to a small group, such as a Close Friends list or a family chat Live location, check-ins at the airport
After Post the public album Leaving drafts you may post by accident

Check who can actually see your posts

The FTC’s April 2026 alert on scams that begin on social media recommends: “Limit who can see your posts and contacts on social media.” The same step reduces how much a stranger can learn about your schedule.

Facebook. Facebook’s help says you pick an audience in the selector under your name when you post (options include Friends, Public and Only me) and can change it later on the post itself. Changing one post does not change your default. For old posts, Limit Past Posts is under Settings & privacy > Settings > Posts; it changes past posts that people outside your friends could see, such as public ones, to Friends only. It does not touch posts with custom audiences, and Facebook says it cannot be undone with one click.

Instagram. Instagram’s help center describes a Close Friends list so that you can limit a story to chosen people, managed from Settings under “Who can see your content.” Members see a Close friends label on what you share. That makes it a good tool for sharing mid-trip with family while keeping the public feed quiet until you are home.

Photos carry a location even when you don’t add one

iPhone. Apple’s location metadata guide gives three controls. To share a photo without location, select the photos, tap the Share Sheet button, tap Options, and turn off Location; “Location Not Included” appears above the button. To stop location being recorded, go to Settings > Privacy & Security > Location Services > Camera and tap Never. To remove it from an existing photo, open it, tap More, then Adjust Info, then Adjust Location, then No Location.

Android and Google Photos. Google says that if your camera added the location, Google Photos can’t change or remove it; you need to change the location setting in the camera app, which varies by manufacturer. Google Photos can remove locations it estimated (open the photo, tap More, then Edit, then Remove location). Shared albums have a Share photo locations toggle, and with partner sharing all photos you share include location details. Photos you download and send elsewhere keep the location your device saved.

Even with location removed, people may guess where you are from landmarks, and Google says so. A beach-hotel balcony with a famous skyline is still a clue.

The other places a plan leaks

  • Out-of-office replies. They go to anyone who emails, including strangers. A judgment call: if you use one, keep it generic (“I’m delayed responding”) without dates or destination, and leave your address out of it.
  • Voicemail greetings. Same logic.
  • Packages. Delivery pile-ups mark a home as empty. Use a trusted neighbor, and set up tracking you control; see our delivery-checking guide.
  • Shared family calendars and messaging groups. Check who is in them.

Why this is more than a burglary worry

A public itinerary also feeds fake emergency calls, where a caller claims a relative is stranded abroad. The more precise the details you publish (airline, hotel, dates), the more believable the script. The routine in our family code word guide is the fallback if one lands. Posting after you return costs nothing and gives such a caller nothing to work from.

A ten-minute pass before you leave

  1. Open each social app and check the default audience.
  2. Run Limit Past Posts on Facebook if old public posts mention your routines.
  3. Set phone camera location to Never, or plan to strip it on share.
  4. Create a small list for trip photos.
  5. Ask a neighbor to pick up mail and packages.
  6. Turn off auto-posting from photo-backup apps.

What the photo shows, apart from where it was taken

Location data is one clue. A photo of your suitcases by the front door, the dining table covered in tickets, or a package left on the step is another, and no setting will remove it. Before posting anything from home in the days before you leave, ask whether it tells a stranger that the house will be empty. Photos of the trip itself carry the same question once you are away, particularly if the background shows a recognizable hotel or street.

Children, relatives and group chats

Your privacy pass is only as good as the people around you. Ask relatives not to post your itinerary, and check who is in the group chats where you discuss plans. Teenagers often post in the moment; agree on a family rule that trip photos wait until everyone is home or go only to a small list. For a house-sitter or neighbor, give a phone number and agree what counts as a reason to call.

If you already posted

You can still tighten things. On Facebook, change the post’s audience from the selector on the post, or run Limit Past Posts for older public ones. On Instagram, remove the story or move it to Close Friends if the platform lets you. Delete a check-in or location tag by editing the post. None of this recalls a screenshot someone already took, which is the reason to default to a small audience from the start.

Sources

Stay alert to new social engineering tactics.

Get occasional, practical updates on scam patterns, account abuse and safer decisions.