Android gives you more privacy controls than iPhone — but it also ships with more default settings that share data you probably never agreed to. The gap between a default Android installation and a properly hardened one is larger than most guides acknowledge. This complete guide covers every setting that matters in 2026, including the new Android 16 Advanced Protection Mode and Identity Check features most articles haven’t documented yet. At Infurpose, we cover phone privacy for everyday people, not IT professionals. Samuel Smith, consumer technology writer and digital privacy researcher, audited three different Android 16 devices to build this guide: “The single biggest surprise was how many apps had ‘Allow all the time’ location access that users hadn’t consciously granted — they just tapped ‘OK’ during setup.”
Android privacy settings are system-level controls that let you manage which apps can access your location, camera, microphone, contacts, and other personal data — and see a log of how that access is being used.
Quick Answer: The most important Android privacy settings: go to Settings > Privacy > Permission Manager to review all app permissions by category, enable the Privacy Dashboard to see which apps accessed your data in the last 24 hours, and set location access to ‘While Using’ instead of ‘Always’ for all apps. These steps take about 15 minutes and dramatically reduce how much data apps collect about you.
The 5 Android Privacy Settings That Matter Most in 2026
The five highest-impact Android privacy settings are: disable ad personalization, enable Advanced Protection Mode, audit location permissions, enable Privacy Dashboard notifications, and review Device Admin Apps for anything you didn’t install.
1. Delete your Advertising ID. Settings → Google → Ads → Delete Advertising ID. This removes the unique identifier advertisers use to track you across apps. On Android 12 and later, you can delete it entirely instead of just opting out — a meaningfully stronger option.
2. Enable Advanced Protection Mode (Android 16). Settings → Security & Privacy → Advanced Protection → Enable. This restricts app installs to the Play Store, enables stricter malware scanning, and blocks sideloaded apps from accessing sensitive permissions. One tap — immediately reduces your attack surface.
3. Location permissions audit. Settings → Location → App Permissions. Every app set to “Allow all the time” is accessing your GPS location even when the app is closed. Change anything that isn’t a navigation app or emergency service to “Allow only while using” or “Don’t allow.”
4. Enable Privacy Dashboard. Settings → Privacy → Privacy Dashboard → turn on. This activates a 24-hour log showing every app that accessed your camera, microphone, location, or contacts — and when. Check it weekly for the first month.
5. Review Device Admin Apps. Settings → Security → Device Admin Apps. This is where spyware hides to prevent uninstallation. If anything appears here that you didn’t put there, investigate it immediately. Legitimate entries: Google Find My Device and (on Samsung) Samsung Knox.
Samsung note: throughout this guide, Samsung One UI paths sometimes differ from stock Android. Where they differ, the Samsung path is noted in parentheses.
Privacy Dashboard — Your 24-Hour Surveillance Log
Android’s Privacy Dashboard (Settings → Privacy → Privacy Dashboard) shows you exactly which apps accessed your location, camera, microphone, and other sensitive data in the past 24 hours, with timestamps — it’s the most powerful privacy visibility tool on any smartphone, and most Android users have never opened it.
Privacy Dashboard is available on Android 12 and later, including most Samsung One UI 4+ devices. Samsung users may find it under Settings → Privacy → Permission Manager, then tapping the Permission type to see the timeline.
What the dashboard shows: a color-coded timeline of sensor access by app, listed in reverse chronological order. Each entry shows the app name, the permission accessed (location, microphone, camera, contacts), and the exact timestamp. Tap any entry to go directly to that app’s permission settings.
What’s suspicious in the dashboard:
- Any app accessing your microphone outside of phone calls, voice searches, or music recording
- Location access from an app you haven’t opened in days or weeks
- Camera access from any app that isn’t a camera, video calling, or document scanning app
- Multiple entries from the same app within minutes, suggesting automated background collection
Samuel Smith’s finding while researching this guide: “I ran the Privacy Dashboard on my personal Android 16 device and found a social media app had accessed my microphone 23 times in 24 hours — none of those accesses corresponded to times when I had the app open. I revoked the permission, and the app still works normally.”
How to act on what you find: tap any suspicious entry → tap “Manage permission” → change the permission to a more restrictive level. You can revoke a permission directly from the Privacy Dashboard without going back to the main permissions menu.
Location Permissions Audit — Who Knows Where You Are?
Go to Settings → Location → App Permissions to see every app with location access — change any non-essential app from “Allow all the time” to “Allow only while using” or “Don’t allow.”
From experience: The setting most people overlook is “Always Allow” location access. Most apps don’t need it — and most of the time you can set them to “While Using” or “Never” without losing any functionality. The exceptions are things like Maps and Weather, where waiting for the app to figure out where you are defeats the purpose. Everything else? “While Using” is almost always enough. The reason it matters: if someone ever gets into your phone, “Always Allow” location means they know exactly where you are at all times. Probably not a concern for most people — but it’s a simple setting worth tightening anyway.
Android offers three location permission levels: “Allow all the time” (background GPS access), “Allow only while using the app” (GPS only when app is open), and “Don’t allow.” There’s a fourth option for approximate location: apps that only need your general area (weather, local news, restaurant finders) can be set to “Approximate” instead of precise GPS.
“Allow all the time” should be reserved for a very short list: navigation apps like Google Maps or Waze (so turn-by-turn works when your screen is off), Find My Device, and your phone’s emergency location service. Everything else — weather apps, news apps, shopping apps, games, social media — has no legitimate reason to know your GPS location when you’re not actively using the app.
Android 17 temporary location: Android 17 introduced a “one-time” location permission for specific tasks. Some apps now support requesting location only for a single session rather than ongoing access. If an app you’re using asks for one-time location instead of ongoing permission, that’s the better choice.
Permission auto-reset: Settings → Apps → Permission Manager → enable auto-reset for unused apps. When this is on, Android automatically revokes permissions from apps you haven’t used in 3+ months. It won’t delete the app — it just removes its permissions until you open it again.
Precise vs. Approximate location: For any app that needs a general area but not exact GPS coordinates, tap the app in Location Permissions → switch “Use precise location” off. Approximate location gives the app your general region (accurate to roughly 10 square miles) — enough for a weather app, not enough to track your specific movements.
Advanced Protection Mode and Identity Check (Android 16)
Advanced Protection Mode (Android 16) restricts app installs to the Play Store only, enables stronger malware scanning, and blocks downloads from unknown sources — enabling it takes one tap and dramatically reduces your attack surface.
To enable Advanced Protection Mode: Settings → Security & Privacy → Advanced Protection → Enable. You’ll see a summary of what it does before confirming. The mode is designed to be enabled by anyone — not just high-risk users — and the trade-off is minimal: you can’t sideload APK files, and some advanced developer settings are disabled.
What Advanced Protection Mode does specifically:
- Blocks installation of apps from outside the Play Store (sideloading)
- Enables stricter Google Play Protect scanning
- Requires enhanced verification for app installations
- Restricts certain USB debugging and developer options
Identity Check is a companion feature also introduced in Android 16: Settings → Security & Privacy → Identity Check. It requires biometric authentication to access sensitive settings when you’re outside a “trusted location.” What it protects: your Google account password change, screen lock change, adding or removing biometrics, Device Admin App settings, and factory reset initiation. This is Android’s equivalent of iPhone’s Stolen Device Protection.
If you’re running Android 16 on a Pixel 8 or later, Samsung Galaxy S24 series, or most 2024–2026 Android flagships, both features are available. Check your Android version: Settings → About Phone → Android Version.
App Permissions — The Full Audit
Go to Settings → Privacy → Permission Manager (or Settings → Apps → Permissions on some devices) to see which apps have access to your camera, microphone, contacts, and storage — and revoke anything that doesn’t need it.
The Permission Manager view lets you browse by permission type, which is more useful than going app by app. Start with the most sensitive permissions:
Camera: Should only include your native camera app, video calling apps (WhatsApp, Zoom, Google Meet), QR code scanner, and document scanning apps. Revoke from games, shopping apps, any social media app you don’t use for video, and any app whose camera use you can’t explain.
Microphone: Should only include calling apps, voice assistant apps, voice memo apps, and music apps that need mic input. A fitness tracker, recipe app, or shopping app with microphone access has no legitimate reason for it.
Contacts: Only your default phone and messaging apps, email apps, and apps where you deliberately share contacts. Revoke from games, e-commerce apps, and social media apps that already have your network on their platform.
SMS: Your default messaging app and your bank (for 2FA code reading) only. Any other app with SMS access can read your incoming text messages, including 2FA codes from other accounts.
Nearby devices (Bluetooth): Bluetooth permission allows apps to scan for nearby Bluetooth devices, which can be used for indoor location tracking. Revoke from any app that doesn’t need Bluetooth for a clear functional reason.
Permission auto-reset: In the Permission Manager, look for the “Remove permissions if app isn’t used” option and enable it. This automatically revokes sensitive permissions from apps you haven’t opened in months.
Samsung path: Settings → Privacy → Permission Manager, then browse by permission type the same way.
Google Account Privacy Settings (This Is as Important as Your Phone Settings)
Your Google account privacy settings at myaccount.google.com control what Google stores about you, which devices have access to your account, and how your activity is used for ad targeting — and these settings are completely separate from your phone’s settings.
Web & App Activity: myaccount.google.com → Data & Privacy → Web & App Activity → set auto-delete to 3 months. This limits how far back Google’s activity log goes.
Location History: same page → Location History → OFF (or auto-delete 3 months). Google maintains a separate location history through its own services, distinct from your phone’s location settings. Turning this off prevents Google’s Timeline from logging your physical movements.
YouTube History: myaccount.google.com → Data & Privacy → YouTube History → auto-delete 3 months.
Ad Personalization: myaccount.google.com → Data & Privacy → Ad Settings → turn off “Personalized ads.” This stops Google from using your activity data to target ads across its network.
Review authorized apps: myaccount.google.com → Security → Third-party apps with Google account access. You may find apps you installed years ago that still have access to your Google account data. Remove any you no longer use.
Connected devices: myaccount.google.com → Security → Your devices. Any device you don’t recognize should be removed and your password changed immediately.
For the strongest Google account protection, a hardware security key like the YubiKey 5 NFC taps against the back of your Android phone via NFC — no phishing attack can bypass a physical key. Even if someone has your Google password, they can’t log in without the physical device.
Google Play Protect and Safe Browsing
Enable Google Play Protect (Settings → Security → Google Play Protect) and Enhanced Safe Browsing in Chrome to protect against malicious apps and phishing links — but understand Play Protect’s limitations before relying on it as your only defense.
Play Protect: Settings → Security → Google Play Protect → ensure scanning is on. Play Protect scans your installed apps continuously and alerts you if it detects something malicious.
Play Protect limitation: Independent testing by organizations like AV-Comparatives consistently shows that Play Protect detects a significantly lower percentage of advanced stalkerware and spyware than dedicated security apps. For a monthly second opinion, run Malwarebytes Mobile Security (free tier available).
Enhanced Safe Browsing in Chrome: Chrome → Settings → Privacy and Security → Safe Browsing → Enhanced Protection. This checks URLs in real-time against Google’s list of dangerous sites, including phishing pages targeting your Google or banking credentials.
Unknown sources: Settings → Apps → Special App Access → Install Unknown Apps. Verify that nothing has permission to install apps from outside the Play Store. If you enabled sideloading for a specific app and forgot about it, revoke it here.
Device Admin Apps — The Spyware Hiding Spot
Device Admin Apps (Settings → Security → Device Admin Apps) is where spyware hides to prevent uninstallation — any app in this list that you didn’t deliberately put there is a serious red flag requiring immediate investigation.
Device Admin access lets an app enforce device policies and resist uninstallation through normal means. Legitimate apps in the Device Admin list: Google Find My Device, your corporate MDM (if this is a work device), and Samsung Knox (Samsung devices only). That’s it.
If you see anything else — an app with a generic name like “Phone Manager,” “System Service,” “Device Security,” or an app you don’t recognize — that’s a serious concern. This step is the one most spy app removal guides skip — and it’s precisely why many people find they can’t uninstall suspected spyware through the normal Apps menu.
How to remove a suspicious Device Admin app: tap the app → tap “Deactivate” → then go to Settings → Apps → find the app → Uninstall. If the Uninstall button is greyed out, return to Device Admin and confirm the admin access is fully revoked before trying again.
When using public USB charging ports, pair this protection with a USB-C data blocker plugged between your cable and the port — it blocks all data transfer while still allowing charging, eliminating juice jacking risk entirely.
Lock Screen, Biometrics, and Bluetooth Privacy
Set your Android lock screen to hide notification content, use fingerprint or face unlock for sensitive actions, and disable Bluetooth and Wi-Fi auto-connect to unknown networks.
Lock screen notification content: Settings → Notifications → Lock screen → “Don’t show any notifications” or “Show content only when unlocked.” The “Show all notification content” default means anyone glancing at your phone can read your text previews, email subjects, and app notifications without unlocking anything.
Biometric authentication: Settings → Security → Biometrics — add fingerprint unlock if you haven’t already. Fingerprint is more reliable than face unlock on most Android devices, especially in low light. Identity Check (Android 16) builds on biometrics to require your face or fingerprint for sensitive settings changes.
Screen lock timeout: Settings → Display → Screen Timeout → set to 30 seconds or 1 minute maximum.
Bluetooth: Turn off when not actively using it. Settings → Connected Devices → Bluetooth → toggle off. Bluetooth can be used to track your proximity and location even without a direct connection.
Wi-Fi auto-connect: Settings → Network & Internet → Wi-Fi → Wi-Fi Preferences → disable “Connect to open networks.” This prevents your Android from automatically joining public Wi-Fi hotspots you’ve never authenticated on.
USB debugging: If you’re not a developer: Settings → Developer Options → USB Debugging → OFF. USB debugging allows a computer to interact with your phone’s file system over a USB cable — most everyday users never need it.
Your Android Privacy Audit Checklist (Monthly, 8 Minutes)
Run this checklist once a month — new app installs and Android updates routinely reset permissions you’ve already changed.
- ☐ Privacy Dashboard: no unexpected mic, camera, or location access in past 24 hours
- ☐ Location: no unrecognized “Allow all the time” apps in Location Permissions
- ☐ Device Admin Apps: only Google Find My Device and Samsung Knox (if Samsung)
- ☐ Google account: no unknown devices at myaccount.google.com → Security
- ☐ Play Protect: enabled and last scan is recent
- ☐ Web & App Activity: auto-delete set to 3 months (myaccount.google.com)
- ☐ Ad Personalization: disabled in Google account settings
- ☐ Install Unknown Apps: nothing has this permission
- ☐ Bluetooth & Wi-Fi: auto-connect to open networks is OFF
- ☐ Android OS: updated to latest security patch
For deeper coverage of securing your phone accounts, detecting spy apps, and choosing the right VPN for Android, explore the full guide library at Infurpose.
Related: Detect Spy Apps on Android | Is Your Phone Hacked? | Secure Your Smartphone
Frequently Asked Questions
What Android privacy settings should I change first?
Start with these three in order: (1) Settings → Privacy → Privacy Dashboard — review the last 24 hours for unexpected sensor access; (2) Settings → Location → App Permissions — revoke any “Allow all the time” apps that don’t need background location; (3) Settings → Security → Device Admin Apps — investigate and remove anything you didn’t put there. These three cover the most serious exposure on most Android devices and take under 10 minutes total.
Does Android share my data with Google by default?
Yes. By default, Android sends usage analytics, crash data, and diagnostics to Google, and your Google account tracks Web & App Activity, Location History, and YouTube History. To address the device side: Settings → Privacy → Usage & Diagnostics → disable. To address the account side: go to myaccount.google.com → Data & Privacy → Web & App Activity and Location History, and either turn them off or set auto-delete to 3 months. Both are separate actions that each need to be done once.
What is Android’s Privacy Dashboard and how do I use it?
Privacy Dashboard is a log of every app that accessed your location, camera, microphone, and other sensors in the past 24 hours, shown in a timeline with timestamps. Go to Settings → Privacy → Privacy Dashboard. Tap any entry to see which app accessed the sensor and when. Tap “Manage permission” from that view to revoke access. Samsung users may find this under Settings → Privacy → Permission Manager.
Is Google Play Protect enough to protect my Android from spyware?
Play Protect is a good baseline but not sufficient for detecting advanced stalkerware. Independent testing by AV-Comparatives consistently shows that dedicated mobile security apps (Malwarebytes, Bitdefender Mobile) detect significantly more stalkerware than Play Protect alone. Keep Play Protect enabled as your primary layer, and run a Malwarebytes scan monthly for a second opinion. Also check Device Admin Apps and the Privacy Dashboard regularly — those two settings reveal spyware that even security apps can miss.
How do I stop apps from accessing my location in the background on Android?
Go to Settings → Location → App Permissions and change every app that doesn’t need 24/7 background location from “Allow all the time” to “Allow only while using the app.” For a specific app: Settings → Apps → [app name] → Permissions → Location → change to “While using.” Additionally, enable Permission Auto-Reset (Settings → Apps → Permission Manager) so Android automatically revokes location permissions from apps you haven’t used in a few months.