Earlier this month, Instagram ditched end-to-end encryption for direct messages (DMs), fully removing the ability for private charts on its platform to be completely private.

DMs are not fully encrypted, meaning that technically speaking, Instagram and parent company Meta can choose to read your personal messages at any times.

At the time, Meta said “very few people were opting in to end-to-end encrypted messaging”, but the mode was opt-in and not on by default as it is on Meta’s other messaging apps WhatsApp and Facebook Messenger.

With the news that Instagram can now access all your DMs, consumer watchdog Which? is warning that the incredibly popular social media platform is collecting personal data in other ways perhaps unbeknownst to its users.

In a blog post, Which? reminded Instagram users that unless they stay on top of their device and app settings, “Meta may gather far more information about you than you realise.”

This is by having access to your camera roll, tracking you across the web, sharing information with advertisers and using your Instagram posts to train its AI models.

“Millions of us share updates on Instagram every day, but few of us realise we may be sharing more than we intend to,” said Lisa Barber, Which? Tech Editor.

“Depending on your privacy settings, Meta can track your activity across the web, browse the metadata of every photo in your camera roll, and even use your public posts to train AI.

“Taking just five minutes out of your day to review your privacy settings means you can ensure your private information remains confidential.”

When you first use Instagram on iPhone or Android, it has to ask for access to your camera roll to access your photos and videos. But if you’ve agreed to opt in to camera roll sharing suggestions, Which? says Instagram will automatically track the metadata of every photo on your device and then use that information to serve you content on Instagram.

You can limit what photos Instagram can scan:

• On Android, try this – go to your Settings menu, then Apps. On some phones, you might need to select App management first. Then, go to Instagram > Permissions > Photos and videos. Select Allow limited access.
• On iOS, try this – go to your Settings menu, then Apps > Instagram > Photos. Press Limited Access.

In a similar way, Meta uses tracking tools embedded in third party websites to link your browsing habits to your Instagram profile. It can then put together your interests and target you with ads.

That’s why you probably see those shoes you nearly bought the other day crop up on your timeline.

“This tracking happens in the background and is switched on by default,” Which? said. “Disconnecting it won’t delete the data Meta has already collected, but it will stop new activity from being added to your profile going forward.”

To turn off this data tap, go to Instagram then Accounts Centre > Your information and permissions > Your activity off Meta technologies > Manage future activity > Disconnect future activity.

Your physical shopping habits may even be reported back to Meta, according to Which?.

“This is because some retailers upload their customer lists, including email addresses and phone numbers, directly to Meta platforms. Meta then matches that information to your profile and uses it to serve you targeted ads, connecting your offline shopping behaviour to your online activity.”

Luckily, you can also opt out of this by going to Instagram, then Accounts Centre > Ad preferences > Manage info > Activity information from ad partners > Review setting. Select No.

Finally, Meta uses your public photos, captions and posts to train Meta AI, if you’re over 18. Meta wants to slurp up as much user data as possible to make its artificial intelligence products better, but you might not want your content to be used for this.

To turn it off, head to Instagram, then go to Privacy Centre > AI at Meta > Information you’ve shared on Meta Products. From there, you can enter your email address and submit your request.