On August 6, Meta launched a new feature on Instagram. Little did they know of what would follow: a full-blown media scandal. At its core, this new Instagram scandal is about privacy and security.
With media from the New York Times to Forbes reporting that Instagram was putting its users’ security at risk, we decided to jump on the story and figure out what’s going on. To make sure we got things right, we called in the tech experts. What follows is the lowdown on the new Instagram scandal.
Is the new Instagram Map feature dangerous for users?
Instagram’s official press release page for the new Map location-sharing feature allows users to share their location with whoever they choose. The press release specifically states the following:
“Location sharing is off unless you opt in.”
It then goes on to say that users pick who to share their location with and have control over the experience.
“You choose who you share your location with: friends (followers you follow back), Close Friends, Only selected friends, or no one,” Meta said.
The company then goes on to explain other technical details regarding how to use this new feature.
However, on social media, some users began posting comments that the feature was enabled by default, and a media wildfire ignited.
Was the Instagram feature enabled by default from the start?
So, what gives? Was the feature enabled by default? Is the feature dangerous for users’ security? How about parents? Should we worry? To get some answers, here are the experts.
“Instagram rolled out its ‘Friend Map’ feature on August 6, 2025, but they kept location sharing turned off by default,” Fergal Glynn, AI Security Advocate and Chief Marketing Officer at Mindgard, told Moonlock.
Users have to go through several consent screens to turn it on, Glynn said.
“Meta has clarified this by saying, ‘To start, location sharing is completely off,’ and that it requires “double consent by design,” Glynn added.
We also spoke to Amit Weigman, Director of Solution Engineering at Cyberint, part of Check Point Software Technologies, who researched Instagram’s new Map feature in depth. Weigman said he looked into the default opt-in status and the risks it poses.
“In short, the feature has always been off by default, but opting in still creates serious digital, physical, and commercial risks,” Weigman said. Weigman then spoke about the risks of the feature, but we will get into that later in this report.
Experts explain the confusion regarding the Instagram Map feature
Dan Saltman, CEO at Redact.dev, also joined us for the conversation.
“Officially, the feature was off by default,” Saltman said. “Some users were confused because they saw themselves on the Map (which doesn’t mean their location is being shared with people).”
So, there you have it, folks. Experts answered that question and have put the doubt to rest. The feature is disabled by default and has always been disabled by default.
This means users have to tap on their screens several times before Instagram shares their location. Even when they do decide to share their location, they are in control of who they share it with. But does this mean that the feature is safe and poses no risks for users? Let’s answer that question in the following sections.
If the feature is off by default, does it still pose risks?
Users’ security and privacy online depend on how well-versed they are in using their technology. But in the modern world, how do you strike a balance between sharing and oversharing?
To add to this already complicated equation, we have cybercriminals, scammers, and other criminals who use digital tools to commit crimes. Naturally, that is a concern for everyone.
“Many users misunderstand sharing controls or bow to peer pressure, leading to oversharing,” Weigman said, answering the user awareness element of the question.
But Weigman seemed more concerned about the cybercriminal aspect of things.
“Location histories stored on Meta’s servers are valuable to attackers and could be exploited in a breach,” he said. “Location storage inside the app creates a new attack surface for credential theft and physical targeting.”
Location histories stored on Meta’s servers are valuable to attackers and could be exploited in a breach.
Amit Weigman, Director of Solution Engineering at Cyberint, part of Check Point Software Technologies
Glynn from Mindguard agreed that risks still exist when the feature is off. “The main issue is that even if you haven’t enabled the new location sharing, the old location-tagged Stories and posts still appear on the Map for 24 hours after posting,” he said.
This has confused many users who found their tagged content on the Map and thought that their live location was being shared. If you’ve previously given Instagram location permissions for other features, that location data could be potentially used in ways that users don’t understand fully, Glynn explained.
What users should do to stay safe when using Instagram’s Map feature
Saltman told us that users should be aware of 3 big risks:
- Accidental opt-ins or broad sharing: People can tap through settings mindlessly, especially if they’re prompted to do so. Opt-in needs to be explicit, user-driven, and only available after the user has been fully informed of what the feature does.
- Pattern of life exposure: This applies to all location tags (stories, posts, or the Instagram Map). This data can be used to infer your daily routine and regular physical locations. This can, in turn, be leveraged to target you or your loved ones with physical crime or cybercrime.
- Stalking and coercive control: Location sharing raises the risks for vulnerable users trying to escape domestic violence, bullying, or harassment.
Other simple steps users can take include checking their Instagram Map settings by going to DMs > Map > Settings and ensuring that location sharing is set to “No one,” Glynn from Mindguard told us.
“Check your device’s location permissions allowed for Instagram in your phone settings and consider setting it as ‘Never’ or ‘While using app only,’” he added.
Users should also be mindful when adding location tags to Stories, as these will appear on the Map for 24 hours. And regularly review who you follow and who follows you. This feature only works between mutual followers.
How to turn Instagram’s Map sharing off completely
If you are still unsure how to use the Instagram Map feature, you can always turn it completely off.
To do that:
- Go to Messages > Map icon > Gear/settings.
- Set location sharing to No One.
You can also Disable location sharing. To do that:
- Go to Device Settings > Apps/Privacy & Security > Location Permissions.
- Select Don’t Allow.
How does this feature compare with Apple’s Find My location feature?
We wanted to know how this new Instagram feature compares with Apple’s Find My location-sharing feature, which Mac and iPhone users are quite familiar with.
Saltman from Redact.dev told us that the 2 features are different beasts.
“Find My is built for private sharing and device finding with end-to-end encryption,” Saltman explained. “Not even Apple can read the data.”
In contrast, “Instagram Map lives inside an ad-supported social media platform with a history of surveilling its users,” he warned.
Apple’s Find My feature, which has no marketing element embedded into it, is therefore safer, Saltman said. It is a “more privacy-focused option for people who want to share their location with trusted contacts.”
Final thoughts
The lowdown seems clear. The new feature has always been disabled by default.
Instagram does allow users to control their own privacy and security. Despite this, risks still exist. Cybersecurity awareness is vital, and users need to fully understand how these technology features work to be responsible for their own digital security.
This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Meta Platforms, Inc. Instagram and Threads are trademarks of Meta Platforms, Inc.
