A weather forecast needs a place. It does not automatically need a record of everywhere you go. A shopping app needs the delivery address you give it. That is not a reason to hand it your contacts.
The awkward part of phone privacy is how ordinary the decisions look: allow a permission, accept personalization, enable a convenient backup. Each can have a legitimate purpose. Together, choices you barely remember can leave more of your life accessible than you intended.
You can change many of those choices using the phone you already own. No extra apps, subscriptions, developer settings, or replacement operating system required.
TL;DR
- Restrict what apps can access, starting with location, contacts, microphone, and photos.
- Delete the advertising ID where available and turn off unwanted Google ad personalization separately.
- Review saved account activity and Maps Timeline. Stopping future history does not automatically delete the past.
- Keep security updates and malware protection enabled; strengthen your screen lock and account recovery.
- Check what still works after each change. The aim is less unnecessary disclosure and a phone you can use.
Before you start: the menus will differ
This guide covers ordinary Android phones, with Google-specific steps for devices that include Google services. Samsung, Pixel, Xiaomi, Motorola, and other manufacturers arrange settings differently. Availability also depends on Android version, region, and account type. A work or school administrator may control some options.
Use the search box in Settings for the bold setting names below. Paths are starting points, not promises that every phone has identical menus. If an option is absent, skip it and continue. Nothing here requires installing an app to reveal a hidden switch.
The recommendations favor privacy while preserving useful security features. They reduce particular kinds of access and retention; they cannot make an online phone anonymous or recover information someone already received.
1. Start with what your apps can actually read
Open Settings → Apps → [app name] → Permissions, or search for Permission manager to review one permission across your apps. Revoke access that does not support a feature you actually use. Android also offers choices such as access only during use or a fresh permission request each time, depending on the permission and device. Google’s permission guide
Use these practical starting points:
| Permission | A reasonable choice | What to test afterward |
|---|---|---|
| Contacts | Deny unless you want contact-based features | Can you enter a recipient manually? |
| Microphone | Allow during use when voice recording or calls require it | Make a call or record a voice message |
| Camera | Allow during use for scanning, photography, or video calls | Try the feature you kept access for |
| Photos and videos | Choose individual items when the system photo picker is offered | Attach one photo without granting the whole library |
| Location | Deny, approximate, or access during use, according to purpose | Check the relevant map, forecast, or pickup feature |
These are starting points, not a verdict that every permission request is suspicious. A messaging app may have a good reason to offer contact discovery. You can still decide that convenience is not worth uploading your address book.
For location, search App location permissions. Review Allowed all the time first. Keep background access only for a feature you intentionally rely on, such as ongoing location sharing. Where available, turn Use precise location off for apps that only need your general area. Navigation and pickup services may need precision; a local forecast may work with a manually selected city. Location permission controls
Then open Privacy dashboard, if available. It shows recent permission access, including which apps used the microphone, camera, or location. Investigate access you cannot explain, but do not treat an entry by itself as proof of spying: navigation, calls, and other expected features also appear there. The dashboard is a permission history, not a complete record of information sent over the internet. Privacy dashboard documentation
Uninstall apps you no longer need. Revoking a permission limits future access through that permission; it does not send a deletion request to the developer. If an old service already holds your information, review its account deletion and data controls separately.
2. Remove an advertising identifier, then change ad personalization
These are separate controls.
On the phone: search Settings for Ads or Advertising ID. Google’s documented path is Settings → Privacy → Ads → Delete advertising ID. Choose deletion rather than a reset, which gives you another identifier. On older devices, you may only find an option to opt out of ads personalization. Google’s advertising ID documentation
Deleting the ID removes this particular advertising identifier. It does not erase advertising profiles, stop every form of tracking, or prevent a service from recognizing the account you signed into.
For your Google account: open My Ad Center in your existing browser. Check the account shown, then set Personalized ads to Off. Repeat for other Google accounts you use. This changes Google’s ad personalization; ads can still appear, and other advertising companies have their own controls. How Google’s ad personalization works
There is no need to assume that every free app sells everything it can access. There is also no need to provide a reusable advertising identifier just because an app is free.
A warning about older guides: Google announced the retirement of several Privacy Sandbox technologies in October 2025, including Topics and Protected Audience on Android. Instructions insisting that everyone must find the same three “Ad privacy” switches may no longer match your device. Do not confuse those controls with advertising ID deletion or account-level personalization. Google’s retirement announcement
3. Decide how much history your Google account should keep
Open My Activity and check the profile icon before changing anything. Review the activity controls for that account.
Google is gradually changing its Search settings: you may see Search Services History or Web & App Activity. Review the controls your account presents, including YouTube History. Current account activity controls
For unwanted history, choose Turn off. To remove existing records too, follow Turn off and delete activity, where offered, or use the separate deletion controls. Read the confirmation before deleting anything you value.
If history is useful, review auto-delete instead of retaining it indefinitely. Expect to lose older activity and some personalization. Confirm your choices on the activity page afterward.
Some account activity is outside My Activity. These controls also do not govern another company’s app or delete your cloud files.
4. Separate location access, travel history, and sharing with people
“Location” covers several different decisions. An app using your position for directions, Maps keeping a travel history, and a person seeing your live location are not the same setting.
If you use Google Maps, review Timeline in your Google account’s activity controls. Turn it off if you do not want a record of visits and routes. Google says Timeline is off by default, so first check whether you ever enabled it. Current Timeline data is saved on devices, with an optional encrypted backup on Google’s servers. Timeline storage and controls
If you want previous routes removed, review deletion in Maps Timeline too, including other devices and any backups. Turning Timeline off does not automatically remove old records, stop live location sharing, or prevent location information from being saved through other enabled account activity settings. Manage Timeline data
Check Location sharing separately and remove recipients who no longer need to see where you are.
For an optional further reduction, open Settings → Location → Location services and review Location Accuracy, Wi-Fi scanning, and Bluetooth scanning. These help positioning. Turning them off may reduce location speed or accuracy, especially indoors; test navigation before keeping the change. Even with device location off, an IP address can still reveal a general area. Android location services
Avoid indiscriminately switching off every location-related feature. Emergency location and finding a lost phone serve different purposes from retaining a travel diary.
5. Reduce optional reporting and review cloud uploads
Search Settings for Usage & diagnostics and turn it off if you do not want to contribute that optional reporting to Google. Google says disabling it does not prevent essential services such as Android updates. It also does not control data collected independently by apps. Usage and diagnostics documentation
Your manufacturer may offer additional usage reporting, recommendations, or personalization controls. Read their descriptions and disable optional collection you do not want. A setting labeled “personalization” is not, by itself, evidence that all processing happens in the cloud.
If Google Photos is already on your phone, open profile icon → Photos settings → Backup. Check both the destination account and which device folders are included. Keep backup if its recovery value matters to you; turn it off if you do not want future automatic uploads. Turning backup off does not remove photos already stored in the account. Google Photos backup settings
Before deleting cloud copies, read the deletion behavior carefully and preserve anything you want to keep. If you choose local-only storage, arrange another copy of important files. A lost phone should not take the only copy of your photographs with it.
6. Close the browser’s separate privacy gaps
An app permission review does not replace a browser settings review.
If you use Chrome, open Settings → Site settings → Third-party cookies and select Block third-party cookies, where available. Some embedded content or sign-in flows can break. If a necessary site stops working, use a narrow exception rather than removing the protection everywhere. This reduces one tracking mechanism; sites can still recognize your login and activity on their own services. Chrome cookie controls
Review the browser’s Site settings for location, microphone, camera, and notifications too. Remove grants to sites you no longer use. Website notification permission is particularly easy to approve without wanting a lasting relationship with the site. Chrome site permissions
If you use another browser, review its equivalent built-in privacy controls. You do not need to install Chrome for this guide.
Incognito is useful for keeping a browsing session out of the browser’s normal local history. Websites and their services can still collect data, and signing into an account identifies you to that service. Treat it as a local privacy feature, not an invisibility switch. What Incognito does
7. Protect the information still on the phone
Consider a simple theft scenario: someone sees your PIN, then takes your unlocked phone. Advertising preferences will not stop them from opening your email. That requires a different set of controls.
Use a unique PIN of at least six digits, or a strong password. Avoid birthdays and reused codes. Set a short automatic lock delay and use supported biometrics for everyday unlocking so you expose the PIN less often. Android screen-lock guidance
Search for Theft protection, commonly under Settings → Google → All services. Enable supported options such as Theft Detection Lock and Offline Device Lock. If Identity Check is available, review its setup: it requires biometrics for specified sensitive actions outside trusted places. These features have device requirements and detection limits; they do not guarantee a theft will be recognized. Android theft protection
Search for Notifications on lock screen. Hide sensitive content, or hide lock-screen notifications entirely if that suits you. Then lock the phone and send yourself a message from another device. Check what a person holding the locked phone can actually read. Lock-screen notification controls
Finally, open your Google account security settings. Review signed-in devices and recovery details, and enable 2-Step Verification if you have not already. Keep recovery options accessible if this phone disappears. Google’s account security guidance
A passkey, where supported, lets you sign in using your device’s unlock mechanism and resists phishing. Create one only on a device you control: someone who can unlock that device may be able to use it to sign in. Google passkey guidance
8. Keep the protections that make privacy possible
Search Settings for Software update and Google Play system update. Install available updates and restart when required. You can usually inspect Android and security update information under About phone → Android version. Update availability depends on the manufacturer and model. If security support has ended, privacy settings cannot supply the missing patches. Android update guidance
In Play Store → profile icon → Play Protect → Settings, keep Scan apps with Play Protect enabled. This protection does involve data sharing with Google. The separate Improve harmful app detection option allows unknown apps to be submitted to Google; review that choice with its purpose in mind. My recommendation for an ordinary user is to retain malware protection rather than disable it during a privacy cleanup. A clean scan is not a guarantee that an app collects only what you would approve. What Play Protect checks and shares
Also resist requests to bypass restricted settings for an app delivered through an unexpected message. Accessibility access can let an app read screen content and interact with other apps on your behalf. Legitimate accessibility tools need that capability; an unsolicited “delivery update” deserves no such trust. Android’s restricted-settings guidance
Keep Find Hub configured if you want lost-device recovery. Review its settings deliberately and make sure you can reach your account without the missing phone. Turning off useful recovery features has a real cost if the device is stolen. Prepare for a lost Android device
Check the result, not just the switches
After making changes, use the phone normally. Test navigation, messaging, calls, photo attachments, and any feature whose permissions you changed. Restore only the access needed for a function you choose to keep.
You should be able to answer these questions:
- Which apps still have background location access, and why?
- Have I removed the advertising ID where available and checked the correct account’s ad preferences?
- Which histories am I still saving, and did I handle existing records separately?
- Which photos or folders are being uploaded, and to which account?
- Can someone read private messages on my locked screen?
- Can I recover my account if this phone is lost?
Revisit the relevant setting when you install an app, enable a new feature, or replace the phone. Your next permission prompt should be a decision you understand, not another tap you forget.
Related Posts
- Jolla Phone in 2026: Privacy Phone or Threat Model Correction? — what changing the operating system can and cannot solve.
Sources and scope
Product behavior and menu guidance were checked against the official documentation linked beside each section on September 17, 2026. This is a settings guide based on documented behavior, not a hands-on test of every manufacturer’s Android build. Menu labels and account controls can change independently of operating-system updates.