A smartphone is a camera, microphone, location tracker, wallet and diary rolled into one device that goes everywhere with you. That makes it the single most valuable target for advertisers, data collectors and criminals. The good news is that both major mobile operating systems have built better privacy controls over the past several years. The bad news is that most are not turned on by default, and few people look at them. This guide collects fifteen settings and habits that make the biggest difference, grouped so you can finish in an afternoon. For platform-specific walkthroughs, see our guides on iPhone and Android privacy settings and iPhone settings to turn off now.
1. What your phone reveals
Before changing settings, it helps to know what is at stake.
- Location. Where you live, work and travel, often with precision of a few meters.
- Contacts and messages. Who you know and how often you talk.
- Photos and files. Images with embedded location and timestamps.
- Microphone and camera. Access that apps can use only with permission, but which some request without need.
- Identifiers. Advertising IDs and device identifiers that let companies link activity across apps.
- Browsing and app behavior. What you read, buy and search.
Combined, those facts can tell a detailed story. Our piece on what digital footprints can reveal shows how.
2. Part 1: Lock the device
1. Keep the system and apps updated
Updates fix security holes that attackers exploit. Turn on automatic updates for the operating system and apps.
2. Use a strong passcode and biometrics
Use at least six digits, or better, a longer alphanumeric passcode. Biometrics are convenient, but know how to disable them quickly if you need to.
3. Limit lock-screen exposure
Hide notification previews and disable access to sensitive controls from the lock screen so messages and codes are not visible to anyone nearby.
4. Enable find-my-device and remote wipe
If your phone is lost or stolen, you can lock or erase it remotely.
5. Set up two-factor authentication
Use an authenticator app or hardware key for important accounts, and consider a passkey where supported. Text message codes are better than nothing but weaker.
3. Part 2: Control what apps can access
6. Review app permissions
Open the privacy section of settings and look at who can access location, microphone, camera, contacts, photos and Bluetooth. Remove any access that is not needed for the app to work.
7. Choose “while using” for location
Avoid “always” unless an app truly needs background access, and turn off precise location for apps that only need a general area.
8. Limit photo and contact access
Grant access to selected photos instead of your whole library, and think twice before letting an app upload your contact list.
9. Delete apps you do not use
Every installed app is a possible data source and a possible vulnerability. Remove those you have not used in months. Our article on vetting apps helps you decide which to keep.
10. Download only from official stores
Avoid sideloading apps from unknown sources and be cautious of lookalike apps. See smartphone app download tips.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
4. Part 3: Cut tracking and advertising data
11. Turn off ad personalization and limit tracking
Disable or reset your advertising identifier and set apps not to track across other companies’ apps and sites where the option exists.
12. Use a privacy-minded browser and tracker blocking
Prefer a browser with built-in tracker prevention and avoid saving passwords in the browser if the device is shared.
13. Be careful on public Wi-Fi and Bluetooth
Turn off auto-join for open networks, avoid sensitive transactions on public Wi-Fi and disable Bluetooth when not in use.
5. Part 4: Protect your number and accounts
14. Guard your phone number
Your number is an identity token. Attackers use it for SIM swap fraud and password resets. Ask your carrier to add a port-out PIN, and avoid publishing your number. Remove it from broker listings using our guide to removing your phone number from the internet. Register at donotcall.gov to reduce marketing calls.
15. Use a password manager and back up safely
A manager lets you use unique passwords everywhere. Back up your data to an encrypted service you control so a lost phone is an inconvenience rather than a disaster.
6. Comparing the settings by effort and impact
| Setting | Effort | Impact |
|---|---|---|
| System updates | Low | High |
| Passcode and lock screen | Low | High |
| App permission review | Medium | High |
| Ad ID and tracking limits | Low | Medium |
| Delete unused apps | Low | Medium |
| Port-out PIN with carrier | Low | High for SIM swap risk |
| Password manager | Medium | High |
7. How to check if an app is overreaching
Look at the permissions it requests during installation and later in settings. A flashlight app does not need your contacts. A game does not need your microphone. If an app asks for more than its function requires, deny the request or find an alternative. Our guide on how to find out if your newest phone app is sharing your private data covers the tools phones provide to check data use, and mobile app privacy shows what to look for in app store listings.
8. Phone scams to watch for
Phones are also the main channel for scams: spoofed caller IDs, urgent texts about packages, fake bank alerts and impostor messages. Never share verification codes, never click links in unexpected messages and call the organization using a number you look up yourself. Report scams at reportfraud.ftc.gov and visit identitytheft.gov if your identity may be at risk. The FTC received about 3 million fraud reports in 2025, with roughly $15.9 billion in reported losses (ftc.gov).
9. Timeline: a one-afternoon plan
| Time | Task |
|---|---|
| 15 minutes | Update system, set passcode, hide lock-screen previews |
| 30 minutes | Review permissions for every app |
| 15 minutes | Disable ad tracking, change browser settings |
| 15 minutes | Contact carrier for a port-out PIN |
| 30 minutes | Set up a password manager and two-factor authentication |
| Every quarter | Re-run the permission review and delete unused apps |
10. When to replace or reset your phone
Some situations call for more than a settings review. If your phone no longer receives security updates, replace it, because unpatched devices are the easiest for attackers to exploit. If you have installed apps from unknown sources, received a message that took you to a suspicious site and then noticed odd behavior, or discovered unfamiliar administrator apps, back up your essential data and perform a factory reset, then reinstall apps from the official store only.
Before selling or recycling a phone, sign out of all accounts, remove it from your find-my-device list and erase it. Check that encryption is on, since erasing an encrypted phone leaves nothing readable behind. Keeping this routine for every device in your household prevents old phones from becoming a quiet source of leaked data.
11. Three scenarios and what to do
Scenario 1: You share a phone with family. Use separate profiles, restrict app installs and avoid saving passwords in shared browsers.
Scenario 2: You travel or use public networks. Update before you go, use a VPN on untrusted Wi-Fi and avoid sensitive transactions on open hotspots.
Scenario 3: You think someone is monitoring you. Check for unknown apps and administrator permissions, update the system and change passwords from a different device. If you fear a partner or former partner, call the National Domestic Violence Hotline at 1-800-799-7233 before making changes that may alert them.
12. Myths and facts
| Myth | Fact |
|---|---|
| Phones are listening all the time | Apps need permission, and indicators show mic use, but review permissions anyway |
| Airplane mode is a privacy tool | It disables radios but does not control app behavior when back online |
| Factory reset fixes everything | It helps with malware but not with account compromise |
| Only old phones get hacked | New models are targeted too if updates are skipped |
| App store apps are always safe | Vetting reduces but does not eliminate risk |
13. Common mistakes
- Granting “always” location to apps that do not need it.
- Ignoring system update prompts.
- Reusing passwords across accounts.
- Giving apps access to the full photo library.
- Not setting a carrier PIN.
- Posting a phone number publicly.
14. Questions to ask yourself
Which apps would I be uncomfortable explaining to a stranger? Which apps do I use less than once a month? Who can unlock my phone, and what could they see? Which accounts would let someone reset my other passwords? Answering these tells you what to fix first.
15. How Wiperts fits
Your phone number and address do not only live on your phone; they live in broker databases too. Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. The free diagnosis shows what is public.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
16. Key takeaways
- Update the system, set a strong passcode and enable two-factor authentication.
- Review app permissions and delete apps you do not use.
- Limit ad tracking, guard your phone number and use a port-out PIN.
- Remove your number and address from data broker listings to cut scams.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
17. Frequently Asked Questions
What is the most important smartphone privacy setting?
Keeping the operating system updated and using a strong passcode come first, followed by reviewing app permissions, especially location, microphone and contacts.
Can apps listen to me through my microphone?
Apps can only use the microphone if you grant permission, and modern phones show an indicator when it is active. Review which apps have access and revoke any that do not need it.
Should I turn off location services completely?
Not necessarily. Set apps to “while using” or “ask next time”, and disable precise location for apps that only need your general area.
Is a VPN necessary on a phone?
It helps on untrusted Wi-Fi and hides your IP address from sites, but it does not stop apps from collecting data they have permission to access.
How do I stop my phone number from being sold?
Limit where you enter it, opt out of data broker listings and register at donotcall.gov to reduce marketing calls.
What should I do if I think my phone is compromised?
Update the system, remove unknown apps, change passwords from another device, enable two-factor authentication and consider a factory reset after backing up important data.
Sources
Related Reading
- Privacy Settings on iPhone and Android: What to Change Today
- iPhone Privacy Settings to Turn Off or Tighten Now
- How to Secure Your Privacy When Using Mobile Apps
- How to Vet Your Apps Before They Vet You
- Why You Should Cut Back on App Downloads
- How to Find Out If a Phone App Is Sharing Your Private Data
- How to Remove Your Phone Number From the Internet
- Which Apps Invade Your Privacy the Most? Categories to Watch
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing