Every major social media platform is required by law — under GDPR in Europe, CCPA in California, and similar regulations in a growing number of jurisdictions — to let you download a copy of all the data they hold on you. Most people have never done it.
If you download your data from Instagram, Facebook, or TikTok, what comes back is often surprising: not just your posts and photos, but a detailed record of your behavioral history on the platform that the company has been accumulating since the day you created your account.
This piece explains what’s in those archives, why you might want to download them, and where to keep them once you do.
How to Request Your Data
The download process is largely standardized across platforms:
Instagram and Facebook (Meta): Go to Settings > Your Activity > Download your information. Select a date range (or all dates), a format (JSON is more complete; HTML is more readable), and request the download. Meta will prepare the archive and notify you by email when it’s ready — typically within a few hours for smaller accounts, up to a few days for large ones.
TikTok: Go to Settings and Privacy > Privacy > Request your data. Choose TXT or JSON format. The archive is usually ready within 4 days.
X (formerly Twitter): Go to Settings > Your account > Download an archive of your data. After an identity confirmation step, Twitter emails a link when the archive is ready.
Google (for YouTube, Google Photos, and other services): Google’s takeout.google.com lets you export data from any or all Google services simultaneously. This is among the most comprehensive download processes available.
Under GDPR and CCPA, you are legally entitled to receive this data within 30 days of a valid request. In practice, most major platforms respond much faster.
What’s Actually in Your Archive
Photos and Videos
The most intuitive content: every image and video you’ve ever posted, often in its original resolution before the platform’s compression algorithms touched it. For many people, their archive contains years of photos they may not have backed up anywhere else — images that exist only in their social media account and their phone’s camera roll (if they haven’t replaced their phone in the interim).
This alone makes downloading your archive worthwhile as a backup action.
Direct Messages
DMs are included in most platform archives, often in a JSON format that lists every conversation with timestamps and message content. This is one of the more surprising inclusions for users who assumed DMs were more private or ephemeral. If you’ve shared personal information, location details, or sensitive content over DMs, it’s all in the archive.
Search and Activity History
Platforms log what you search for. The Instagram archive includes your search history in full, organized by date. The Facebook archive includes an “Off-Facebook Activity” record — a log of websites and apps that sent data about you to Facebook using tracking pixels, even when you weren’t using Facebook at the time.
The “Off-Facebook Activity” file is one of the most revealing parts of the Facebook archive. It lists third-party websites — news sites, retailers, medical information sites, financial services — that passed information about your visits to Facebook. Most users have hundreds or thousands of entries.
Your Inferred Interests and Ad Targeting Profile
Platforms include a list of the interest categories they’ve inferred about you for advertising purposes. In the Facebook archive, this appears under “Ads and Businesses > Your Interests.” You may find categories like health conditions, political views, religious identity, or life events listed there based on your activity.
You did not explicitly disclose these. The platform inferred them from your behavior, your connections, and the third-party site visits tracked through pixels and the Facebook SDK embedded in other apps.
Location Data
Depending on your settings, the archive may include location data: where you were when you posted content, which location tags you’ve used, and in some cases, more granular location history if you granted location access to the app.
Login History
IP addresses, device types, and timestamps for every session you’ve ever logged in. This log can span years and shows the geographic history of your account access.
People You’ve Searched For
A separate log, in some archives, of specific profiles you’ve searched for — not just general searches, but searches for individual accounts. This is one of the more quietly revealing fields for many people.
Why This Data Matters
Looking at your archive is a practical exercise in understanding what data a company has on you and what they could do with it.
The exposure here runs in two directions:
What the company can see: Everything in that archive has been held by the platform. It has been subject to their privacy policy, their employees with data access, any data breaches they’ve experienced, and any legal requests from governments. The 23andMe bankruptcy illustrated what can happen to a personal data archive when a company fails — the data can be sold to new owners with different policies.
What anyone who obtained the archive could see about you: Your downloaded archive is a concentrated personal dossier. DMs, location history, behavioral patterns, inferred personal attributes — all in one place. If someone obtained your archive (by breaching your email, by accessing your device, or by any other means), they would have extensive information about you.
The Problem With Where People Store Their Archives
After downloading their data, most people either:
- Leave the ZIP file in their Downloads folder, unprotected
- Upload it back to Google Drive or Dropbox
- Don’t do anything with it
Option 1 is an unprotected plaintext dossier sitting on their computer. If they use the same device at work, share a computer, or have their laptop stolen, the archive is exposed.
Option 2 means taking detailed personal data and moving it from one platform back to another. If you downloaded your Instagram archive because you’re concerned about Meta’s data practices, storing it in Google Drive means your personal data is now in Google’s hands instead. The privacy gain is minimal.
Option 3 means the archive sits forgotten and eventually becomes a problem if the email link to download it expires.
The archive deserves the same treatment as other sensitive personal documents: encrypted storage in a location you control, under a service whose business model doesn’t depend on analyzing your content.
How to Actually Secure Your Archive
Step 1: Encrypt it before storing
At minimum, compress the archive into an encrypted ZIP or 7z file with a strong password before copying it anywhere. This means even if someone gains access to your storage, they can’t read the contents without the password.
On Mac: zip -er secure-archive.zip your-data-folder/
On Windows: Use 7-Zip with AES-256 encryption.
Step 2: Store in a privacy-respecting cloud service
The right cloud storage for your social media archive is a service that:
- Does not scan or analyze content for advertising
- Is not itself a social or data-analytics company
- Is GDPR/CCPA compliant
- Uses encryption at rest
Services built on subscription business models — where the product is storage, not your data — have structural incentives aligned with keeping your content private.
daftei, for instance, uses AES-256 at rest and TLS 1.3 in transit, and has a policy of never selling data or training AI on user content. Proton Drive uses zero-knowledge encryption so even the provider cannot read your files. Either is a better choice than uploading your archive back to a major platform.
Step 3: Keep a local encrypted copy
Store a copy on an encrypted external drive as well. The 2-3-1 backup principle: at least two copies, in at least two different locations, one of which is offline.
Step 4: Delete the unencrypted original
Once you’ve secured encrypted copies, delete the original downloaded ZIP from your Downloads folder and empty the trash. There’s no reason to keep an unencrypted copy sitting around.
What to Do With the Data You Find
Photos you haven’t backed up: Download the full-resolution versions from the photos folder in your archive and add them to your personal photo backup storage. Social media compression is destructive — the versions in your archive may be higher quality than what’s currently visible in the app.
DM conversations you want to keep: These are harder, since they’re typically in JSON format. Tools exist to convert Signal, Telegram, and social media JSON exports into readable HTML. If there are DM conversations worth preserving — a conversation with someone who has since passed away, important personal records discussed over DM — extract those now, while you’re in the archive.
Your ad interest profile: You can request deletion of your ad interests in most platforms’ settings. This doesn’t delete your behavioral data, but it removes the explicit interest categories used for targeting. It’s worth doing.
The Off-Facebook Activity (or equivalent): Most platforms now allow you to disconnect off-platform tracking data from your account. In Facebook’s settings, you can clear and disconnect off-Facebook activity. This won’t prevent future tracking, but it resets the historical behavioral record.
The Habit Worth Building
Downloading your social media archive once is useful. Making it an annual practice is better.
Your account accumulates data continuously. An archive from two years ago doesn’t include the photos you posted last summer, the DM conversations you’ve had since, or the behavioral history that’s accumulated.
Annual archive downloads — stored securely, reviewed briefly, then archived — give you a standing record of what each platform holds on you and a backup of content you’ve posted there. It takes about ten minutes per platform, once the archive is ready.
The data exists whether or not you download it. The download just gives you a copy. Given everything in these archives, that copy is worth having somewhere you control.