Privacy Settings Checklist for a New Phone: 2026 Edition

Unboxing a new phone takes ten minutes. Deciding what that phone is allowed to do with your data takes about half an hour more — and it is the half hour most people skip. That is a shame, because a fresh device is the easiest moment to get privacy right. Nothing is logged in yet, no app has a year of habits to mine, and the defaults are still whatever the manufacturer picked rather than whatever you drifted into. Here is the order that works, and why each step matters.

Finish the Setup Screens You Rushed

Setup wizards are not neutral. They hand you a stack of optional switches — analytics sharing, personalised recommendations, location-based suggestions, "improve our products" — bundled into a screen that looks mandatory. You can decline nearly all of it and still have a fully working phone.

If you already tapped through, go back. On iPhone, open Settings > Privacy & Security > Analytics & Improvements and turn the sharing options off. On Android, check Settings > Privacy and the Google section of Settings for usage-and-diagnostics and ads personalisation toggles. Both platforms also let you disable personalised ads from the system advertising menu, which we will get to below.

Permissions: Grant on First Use, Not in Advance

Installing an app is not the same as trusting it. Every permission prompt is a separate decision, and the answers "always" and "all photos" are almost never necessary.

• Location: choose "While using the app" instead of "Always". If an app only needs to know roughly where you are — weather, delivery estimates, local news — turn off precise location.
• Photos: use the limited or "select photos" option so an app sees only the images you hand it, not your entire camera roll.
• Contacts and calendar: very few apps genuinely need these. If a game or a shopping app asks, say no and see whether anything breaks.
• Microphone and camera: grant these only to apps that record audio or take pictures. Look for the indicator dot or pill at the top of the screen when something is using them.
• Notifications: treat this as a permission too. A news app that pings you twelve times a day is also an app that knows when you are awake.

You do not have to audit this by memory. On iPhone, turn on App Privacy Report in Settings > Privacy & Security and it will show which apps touched which sensors and which domains they contacted. On Android, the Privacy Dashboard lists location, camera, and microphone access from the last 24 hours. Review it on a Sunday evening and revoke anything that surprises you.

Turn Off Ad Tracking and Reset Your Identifier

Phones ship with an advertising identifier — a resettable string that lets ad networks stitch your activity across different apps into one profile. You cannot delete the concept, but you can break the continuity.

On iPhone: Settings > Privacy & Security > Tracking, turn off "Allow Apps to Request to Track". This stops apps from even asking. Then go to Apple Advertising and switch off personalised ads. On Android: find Ads under Settings > Privacy (or under Google > Manage your Google Account > Data & privacy > Ad settings) and choose Delete advertising ID or reset it. Older versions offer an opt-out of ad personalisation instead.

Worth knowing: none of this removes ads. What it removes is the assumption that the same identifier follows you from a shopping app to a weather app. Reset it again when you change phones, and after any long stretch where you installed a lot of new apps.

Location, Lock Screen, and the Quiet Leaks

Location deserves a second pass because it leaks in places people never check. On iPhone, open Settings > Privacy & Security > Location Services > System Services and look at items like Significant Locations (a history of places you visit often) and location-based ads. On Android, check Settings > Location > Location services for Wi-Fi and Bluetooth scanning, which can pinpoint you even when location is off.

Then handle the lock screen, which is the most overlooked privacy surface on any phone:

1. Hide message and email previews so a passer-by cannot read them.
2. Turn off lock-screen access to Control Centre, Wallet, and smart home widgets where your platform allows it.
3. Set a screen lock timeout of 30 seconds or less, with a PIN of at least six digits.
4. Turn off auto-join for open Wi-Fi networks and keep private or randomised MAC addresses enabled.

Anything visible before you unlock the phone is effectively public. Design your lock screen for the person standing next to you, not for yourself.

Backups and Sync: Decide What Leaves the Phone

Backups are a privacy setting, not just a safety feature. A backup decides which of your messages, photos, documents, and app data get copied to someone else's servers — and whether they are readable there.

Check where your backup goes and turn on encryption where it is offered. On iPhone, Settings > [your name] > iCloud > iCloud Backup controls it; Apple's Advanced Data Protection, if available in your region, extends end-to-end encryption to more categories of iCloud data. On Android, open Settings > Google > Backup and make sure your device is protected with a screen lock for encrypted backups. If you would rather keep things local, you can back up to a computer instead — just encrypt the backup file if your platform offers the option.

Then look sideways: which apps are syncing to their own clouds? Photo apps, notes apps, and messaging apps often keep their own copies regardless of your phone backup. Family sharing and shared albums can also quietly expose images you assumed were private.

If your phone holds medical records, financial documents, or scans of identity papers, treat them as you would the paper originals. For questions about what you are legally required to retain or share, or about protecting records in a specific jurisdiction, a qualified professional is the right person to ask.

The 20-Minute Audit You Repeat

New permissions get added with app updates, and settings sometimes reset after a major OS upgrade. Put a recurring reminder in your calendar — quarterly is realistic, monthly is better if you install a lot of apps.

When it comes up, do four things: open the Privacy Report or Dashboard and skim the last week, delete apps you have not opened in a month, revisit permissions for anything that added a new category, and confirm your backup and tracking toggles are still where you left them. Twenty minutes, four times a year, is a small price for knowing exactly what your phone is doing when it is sitting in your pocket.

Photo: Artist_atsite / Pixabay