How to Protect Your Privacy on Your Phone

The three changes that protect the most privacy for the least effort are: switching per-app location from "Always" to "While Using," turning off the cross-app advertising identifier, and using a 6-digit-or-longer passcode with notification previews hidden. Everything else is refinement. This guide walks through the exact toggles on iPhone (iOS) and Android, explains why each one matters, and names the mistakes that quietly undo the work.

What actually leaks from a phone#

Your phone doesn't broadcast your diary. What it leaks is more mundane and more valuable: a persistent advertising ID, precise GPS coordinates, your list of installed apps, coarse network location, and whatever sensor access you've handed to third parties. On iOS that ad identifier is the IDFA; on Android it's the Google Advertising ID (GAID, also called AAID). Both are resettable numbers that let ad networks stitch your behavior across otherwise unrelated apps into a single profile.

The collection rarely comes from Apple or Google directly. It rides in on the SDKs bundled inside free apps — analytics and ad libraries from companies you've never installed anything from, tucked inside a game or a flashlight. That's how a weather app ends up selling location data: the app is the delivery vehicle, the SDK is the passenger.

The 15-minute permission audit#

On iPhone#

Open Settings > Privacy & Security. This screen is organized by data type rather than by app, which is the fast way to audit.

1. Tap Location Services and go app by app. Set anything that isn't navigation or ride-hailing to "While Using the App." Turn off "Precise Location" for apps that only need your city — weather, news, most shopping. Precise is GPS-accurate; the alternative hands over roughly a several-mile radius.
2. Back out and tap Tracking. Turn off "Allow Apps to Request to Track." That is App Tracking Transparency, and it blocks apps from reading the IDFA.
3. Tap Camera, then Microphone, and revoke anything whose access surprises you.
4. Open App Privacy Report near the bottom of the Privacy screen. Enable it once and check back in a week: it logs which apps touched your camera, mic, and location, and which domains they contacted in the background — the receipts.

On Android#

Paths differ slightly between stock Pixel and Samsung's One UI, but the destinations match. Open Settings > Security & privacy > Privacy (or Settings > Privacy on older builds).

1. Tap Permission manager. Unlike iOS, this is grouped by permission — open Location and you see every app that holds it. Set non-navigation apps to "Allow only while using the app" or "Ask every time." On Android 12 and later, switch off "Use precise location" for apps that only need a general area.
2. Open Privacy dashboard for a 24-hour timeline of which apps used location, camera, and microphone, and exactly when.
3. Repeat the sweep for Camera, Microphone, Contacts, and Phone, revoking every mismatch.

Android auto-revokes permissions from apps you haven't opened in a few months (since Android 11), and iOS can offload unused apps entirely. Don't lean on either — delete apps you don't use, because an installed app is a standing permission even while it sleeps.

Cut off the advertising ID#

Trimming permissions limits what sensors apps reach; killing the ad ID limits the profile built from your behavior once they're inside.

• iPhone: the Tracking toggle above already blocks the IDFA. Also open Settings > Privacy & Security > Apple Advertising and turn off "Personalized Ads."
• Android 12 and later: Settings > Security & privacy > More privacy settings > Ads (or Settings > Google > Ads), then tap "Delete advertising ID." This replaces your GAID with a string of zeros, so apps requesting it get nothing back. On older Android you can only reset it, not delete it.

If you're on an iPhone with iCloud+, iCloud Private Relay (Settings > your name > iCloud > Private Relay) hides your IP address and Safari browsing from your network and from the sites you visit. It's a meaningful extra layer, though narrower than a full VPN.

The lock screen is the part people get wrong#

All the permission work above is moot if anyone who picks up the phone can open it. Start with the passcode itself.

Set a 6-digit passcode at minimum; an alphanumeric one is stronger still. iPhone: Settings > Face ID & Passcode > Change Passcode > Passcode Options > Custom Alphanumeric Code. Android: Settings > Security & privacy > Screen lock > Password or PIN. Avoid swipe patterns — they're short and readable from finger smudges — and obvious codes like 0000 or a birth year.

Then close the two gaps almost everyone leaves open:

• Notification previews. A locked phone that still shows message text (or a 2FA code) on the lock screen is a live leak. iPhone: Settings > Notifications > Show Previews > When Unlocked, or Never. Android: Settings > Notifications > lock screen, then "Hide sensitive content."
• Auto-lock timing. iPhone: Settings > Display & Brightness > Auto-Lock — choose 30 seconds or 1 minute, not 5. Android: Settings > Display > Screen timeout, plus "Lock after screen timeout" in the screen-lock settings.

One nuance worth knowing: in many places a memorized passcode gets more legal protection than a face or fingerprint, which can be used on you more easily. iPhone's Face ID & Passcode screen also has an Erase Data option that wipes the phone after 10 failed attempts, and holding the side button plus a volume button forces a passcode prompt and temporarily disables Face ID.

Location: the trade-off that actually matters#

"Always" versus "While Using" is the single highest-leverage location choice on the phone. Background (Always) access is what lets an app quietly assemble a movement history while it's closed; "While Using" cuts that off without hurting normal use. Reserve Always for turn-by-turn navigation or a genuine tracking need like Find My.

Precise versus approximate is the second lever. A restaurant finder benefits from GPS-precise location; a weather or news app works fine with approximate — iOS "Precise Location" off, Android's approximate toggle on — which reports a wide radius instead of your doorstep.

Finally, deal with the history that may already exist. At myactivity.google.com you can turn off Web & App Activity and Location History (now surfaced as Timeline) and set auto-delete to 3 months. Apple's stored equivalent lives at Settings > Privacy & Security > Location Services > System Services > Significant Locations, where you can review and clear it.

Common mistakes#

• Leaving new apps on "Always" or "Allow all the time" because that's the default the prompt nudges you toward.
• Granting Precise location to apps that only need a general area.
• Trusting a 4-digit PIN or a swipe pattern as a real lock.
• Hiding nothing on the lock screen, so previews expose messages and one-time codes.
• Doing the audit once. New installs and OS updates reset assumptions — recheck every few months.
• Assuming free is free. If there's no subscription, your data usually funds the app.

FAQ#

Does turning off location actually stop all tracking?#

No. It stops GPS-based location, but apps can still infer where you are from your IP address and from nearby Wi-Fi and Bluetooth signals. On both platforms, disable Wi-Fi scanning and Bluetooth scanning (Android lists these under Location), and turn on a private or randomized Wi-Fi MAC address per network to break the indirect trail.

Are biometrics less secure than a passcode?#

For everyday use they're both convenient and hard to spoof. The real difference is situational and legal: a face or fingerprint can be applied to your phone more easily than a memorized code can be extracted from you. Keep biometrics for daily unlocking, but treat the passcode as the true backstop — a device restart always forces one.

Should I use a VPN for phone privacy?#

A VPN masks your IP and hides traffic from your carrier or a public Wi-Fi network, which genuinely helps on untrusted connections. It does nothing about app permissions or the advertising ID, and a sketchy free VPN can be worse than none since it sees all your traffic. Fix permissions first, then treat a reputable paid VPN as a supplement.

How often should I redo this?#

A full pass takes about 15 minutes and holds up for months. Recheck permissions whenever you install something new, glance at the App Privacy Report or Privacy dashboard every few weeks, and do a fuller sweep after major OS updates, which occasionally add or reset settings.