What can employers actually see about you online?
More than most people assume, and the boundary between what they can see and what they may lawfully use is where the important distinctions sit.
What is straightforwardly visible:
Anything public. Public profiles, posts, comments, photos, reviews you have written, forum contributions, and content you are tagged in that others made public.
Search results for your name, including old material and things published about you.
Professional profiles, which are intended to be seen.
Cached and archived content, which persists after deletion — the Internet Archive being the obvious example.
Your username reused across sites, which links accounts you may not have intended to connect.
Photo metadata and identifiable backgrounds, where not stripped.
What is not directly visible but is inferable: approximate location, employer history, connections, interests, and — from public posting patterns — a great deal about your habits.
What they cannot lawfully do:
Ask for your password or require you to log in and display private content. This has been legislated against in several jurisdictions and would breach data protection principles.
Use protected characteristics discovered online to discriminate. Discovering religion, pregnancy, disability, sexual orientation or age and using it in a decision is unlawful under the Equality Act regardless of where the information came from — and this is precisely why some employers have policies against informal social media screening, since it creates evidence of awareness.
Process your data without a lawful basis. Under UK GDPR, screening candidates is processing personal data, and employers should be transparent about it — most are not, which is itself a compliance gap.
Practical advice:
Search yourself, logged out and in a private window, including image search.
Audit privacy settings periodically, since platforms change defaults.
Assume anything posted is permanent.
Check what others have tagged you in.
Old accounts are the usual problem — content posted years ago on a forgotten platform.
You have data rights, including a subject access request to an employer about what they hold.