← Privacy Guides

Devices & OS

Privacy settings everyone should set on their phone

A short, once-a-year pass through the built-in privacy settings on a normal iPhone or Android phone: a strong lock, sensible app permissions, ad tracking off, and find-my turned on.

  • Low threat
  • Time 30 minutes
  • Difficulty Easy
  • Last verified

What this protects, and what it doesn't

Protects

  • Against someone who picks up your phone: a strong lock plus device encryption keeps your photos, messages and accounts out of their reach.
  • Against apps quietly collecting more than they need: location in the background, the microphone or the camera when you did not expect it.
  • Against advertising tracking that follows you between apps using the device advertising identifier.
  • Against shoulder-surfing: message and email contents no longer appear on the lock screen for anyone nearby to read.

Does not protect

  • It does not make your phone anonymous or hide it from your mobile carrier, your network, or a lawful request to the platform.
  • It does not stop a determined, well-resourced attacker. That is a High-threat problem; see the hardened-phone guides, not this one.
  • It does not remove data apps and advertisers already collected, or stop apps you grant permission to from using it.
  • It does not protect data you sync to a cloud account; that depends on that account's password and two-factor settings, covered elsewhere.

Prerequisites

  • Your own iPhone or Android phone, unlocked, with ten or fifteen quiet minutes.
  • The passcode or screen lock you use now, in case a setting asks you to confirm it.
  • Menu names move between phone models and OS versions. If a path below does not match, search your Settings app for the key word (for example "lock", "permissions" or "ads").

Step by step

  1. Set a strong lock, and a short auto-lock

    This is the one setting the rest depend on. Modern iPhones and Android phones encrypt the data stored on them, and your passcode or screen lock is the key that unlocks it, so a weak lock (or none) means the encryption protects nothing if the phone is lost or stolen. Use a six-digit PIN or, better, a longer alphanumeric password, not a four-digit code and not a pattern you trace in public.

    iPhone. Go to Settings > Face ID & Passcode (or Touch ID & Passcode, or just Passcode on older models) and tap Turn Passcode On or Change Passcode. Apple says setting a passcode automatically turns on Data Protection, which encrypts your iPhone's data with 256-bit AES. For a stronger code, tap Passcode Options and choose Custom Alphanumeric Code. On the same screen you can turn on Erase Data, which wipes the phone after 10 consecutive wrong passcode attempts (back up first, and understand that repeated attempts by a child can trigger it).

    Then shorten the auto-lock: Settings > Display & Brightness > Auto-Lock, and pick the shortest time you can live with (30 seconds or 1 minute). The shorter it is, the sooner the phone re-locks when you put it down.

    Android. Go to Settings > Security (it may be Security & privacy or Device unlock), tap Screen lock, and choose PIN or Password. Google recommends a 6-digit PIN or longer; a password is the most secure option. Storage encryption is on by default on phones that shipped with Android 10 or later, and Google states that it stops user data being read without the lock-screen credential.

    To control how soon it re-locks after the screen turns off, tap the gear next to Screen lock (on Pixel; on other phones look for "automatically lock" in the screen-lock settings), and set a short delay. The screen-off timeout itself is usually under Settings > Display > Screen timeout.

  2. Hide message and email contents on the lock screen

    By default a phone can show the text of a message or email on the lock screen, where anyone nearby can read it without unlocking the phone. Set previews to appear only after you unlock.

    iPhone. Go to Settings > Notifications > Show Previews and choose When Unlocked (or Never to never show contents). The options are Always, When Unlocked and Never. You can override this per app under each app's notification settings; not every app supports previews.

    Android. Go to Settings > Notifications > Notifications on lock screen. Turn off Show sensitive content (on Pixel this toggle is under a "Privacy" heading in the same menu) so sensitive details are hidden until you unlock, or choose to hide all notifications on the lock screen. You can still hide or show content for individual apps.

  3. Review location, microphone and camera permissions

    Apps ask for access to your location, microphone and camera. Many keep it long after they need it. Go through the apps you granted and pull back anything an app does not clearly need, and in particular stop apps using your location in the background.

    iPhone. For the microphone and camera, open Settings > Privacy & Security > Microphone and > Camera; each shows the apps that asked, with a switch to turn access off. For location, open Settings > Privacy & Security > Location Services, tap an app, and choose Never, Ask Next Time Or When I Share, While Using the App or Always. Prefer "While Using the App" and avoid "Always" unless it is genuinely needed. On the same screen, turn Precise Location off for apps that only need your rough area (weather, news), so they get an approximate location instead of your exact one. A green dot means an app is using the camera; an orange dot means the microphone.

    Android. Open Settings > Apps, pick the app, tap Permissions, then a permission, and choose Allow only while using the app, Ask every time, or Don't allow. For location you may also see Allow all the time (background) and, for many apps, a Use precise location switch you can turn off. To review everything by permission type instead of by app, go to Settings > Security & privacy > Privacy > Permission manager and open a permission to see every app that has it.

  4. Turn off ad personalisation and limit the advertising ID

    Your phone carries an advertising identifier that lets advertisers link what you do across different apps. You can stop personalised ads and cut off, or reset, that identifier.

    iPhone. Turn off Apple's own personalised ads at Settings > Privacy & Security > Apple Advertising by switching off Personalized Ads (this covers the App Store, Apple News and Stocks). Then, to stop other apps asking to follow you between apps and websites, go to Settings > Privacy & Security > Tracking and turn off Allow Apps to Request to Track; every app is then treated as if you asked it not to track. (Apple notes the Personalized Ads toggle may be missing for minors, managed accounts, or regions where Apple does not serve ads.)

    Android. Go to Settings > Privacy > Ads and tap Delete advertising ID (apps then receive a string of zeros instead of your ID), or Reset advertising ID to swap it for a fresh one. On older Android the path is Settings > Privacy > Advanced > Ads, then turn on Opt out of Ads Personalization. Separately, in the Google settings you can turn off interest-based Google ads under Google > Ads. Resetting or deleting the ID does not stop all ads; you may still see ads based on other signals.

  5. Turn on find-my so you can lock or wipe a lost phone

    If the phone is lost or stolen, find-my lets you locate it, play a sound, lock it with a message, or erase it remotely. It needs your lock (previous step) and location switched on.

    iPhone. Go to Settings > [your name] > Find My > Find My iPhone and turn it on. Also turn on the Find My network (lets you locate the iPhone for a while even after it is turned off or offline) and Send Last Location (sends the location when the battery gets critically low). Make sure Location Services is on (Settings > Privacy & Security > Location Services) so it shows on a map.

    Android. This is Find My Device (now also called Find Hub). Google's requirements: the phone is signed in to your Google Account, with Location on, Find My Device on, and Store recent location on so it can be found even when offline; a screen lock must be set. Look under Settings > Security & privacy for the Find My Device switch. To be able to lock or erase a lost phone remotely, Google advises turning on 2-Step Verification and keeping backup codes somewhere safe, since the phone itself may be your second factor. You then locate it from the Find Hub app on another device or in a browser.

  6. See what your apps are actually doing

    Once the obvious permissions are tidied, the phone can show you what apps really accessed, so you can catch the ones that do more than you expected.

    iPhone. Turn on App Privacy Report at Settings > Privacy & Security > App Privacy Report. From then on it records, for the past 7 days, how often and when apps used your location, camera, microphone, contacts and so on, and which domains they contacted. The data is encrypted and kept only on your device. In the same Privacy & Security screen you can also tap a data type (Location, Contacts, Photos, and so on) to see exactly which apps have access to it, and turn any off.

    Android. Use the Permission manager (Settings > Security & privacy > Privacy > Permission manager): open a permission such as Location, Camera or Microphone to see which apps have it and change each one. Many Android versions also show recent camera, microphone and location use in a privacy dashboard in the same menu.

  7. Optional: keep sensitive apps behind a second lock

    If you lend your phone or hand it over at a border or checkpoint, you may want some apps hidden and separately locked.

    Android (15 and later): Private space. Go to Settings > Security & privacy > Private space (under "Privacy"), authenticate, and set it up with its own lock (you can reuse your screen lock or set a different one). Apps you install into it live in a separate, encrypted space; when you lock the private space it collapses and its apps disappear from the app list and search. You can also turn on Hide private space when it's locked so even the container is not visible. Note Google's caveat: this cannot always hide the existence of a private space from someone who installs apps on your phone or connects it to a computer.

    iPhone. iOS has no exact equivalent of Private space, but you have already done the most useful parts above: a strong lock, hidden lock-screen previews, and the App Privacy Report. If you need to hide individual apps, recent iOS versions let you move an app to a locked, hidden folder in the App Library that requires Face ID or your passcode to open.

Common mistakes

  • Setting find-my or notification previews but leaving a four-digit PIN or a pattern as the lock, so the encryption behind them is easy to defeat.
  • Leaving location on "Always" for apps that only need it while open, so they track you in the background.
  • Resetting or deleting the advertising ID and assuming all ad tracking has stopped; it only breaks the cross-app identifier.
  • Turning off Location Services entirely to stop tracking, which also stops find-my from locating a lost phone.
  • Treating this as a one-time job. New apps ask for new permissions, so repeat the pass once or twice a year.

Going further

Do this pass again after any big phone update, since menu names and defaults change. If your threat model is higher than everyday (you are a journalist, an activist, or a likely target), the everyday settings here are the floor, not the ceiling: look at the hardened-device guides for iOS Lockdown Mode and for GrapheneOS, and at the communications guides for moving your messaging and email onto tools that leak less. Before you share a photo, strip the location and camera details from it first.

Paths were verified on 2026-10-10 against Apple's current iPhone User Guide and Apple Platform Security, and Google's Android Help, Google Account Help and the Android Open Source Project. Private space requires Android 15 or later; App Privacy Report and app-tracking controls require recent iOS. Exact labels vary by model and OS version.