The privacy settings that matter most on Android in 2026 are the ones controlling location, app permissions, and the data tied to your Google account. In order of impact: the Permission Manager and Privacy Dashboard, per-app location access, deleting your advertising ID, Private Space, and theft protection with Identity Check. Fix those five and most of the work is done.
In short: the settings that matter most
- Permission Manager: revoke camera, microphone, location and contact access apps never needed.
- Privacy Dashboard: see which apps used sensitive permissions in the last 24 hours, with a seven-day view on Android 16 and 17.
- Location: “While using the app” instead of “All the time,” approximate rather than precise, and keep Google Maps Timeline off or on a short auto-delete window.
- Advertising ID: delete it rather than just resetting it.
- Private Space: keep banking, health and dating apps in a separately locked, hidden area (Android 15+).
- Theft protection and Identity Check: stop a thief from unlocking, wiping, or reaching your accounts (Android 15+, Pixel and Samsung first).
Why Android privacy settings matter more in 2026
Three things changed since most Android privacy guides were written. Phones now hold passkeys, banking apps, digital IDs and wallet cards, so a compromised device costs more than ever. AI features increasingly want access to your screen content and activity, and Google’s own services share activity across your account by default. And while Google retired its Privacy Sandbox in October 2025, the plain advertising ID survives and remains the backbone of cross-app tracking.
One honest caveat: Android is not insecure by default — it’s permissive. It grants more access and expects you to trim, where iOS asks fewer questions up front. Most data leakage is consensual but careless: “All the time” location grants, permissions you tapped through during setup, and activity logs you never reviewed. Android 15, 16 and 17 shipped genuinely useful controls; they only help if you turn them on, because Google rarely enables the strictest option for you.
1. Audit app permissions with Permission Manager and Privacy Dashboard
The highest-value change on any Android phone is a ten-minute permission audit. Open Settings → Security & privacy → Privacy → Permission Manager (on Pixel and recent Galaxy phones; some Xiaomi, Oppo and older One UI devices keep it under Settings → Privacy or Apps — search Settings for “permission manager” if you get lost). Work through every category — Camera, Microphone, Location, Contacts, Phone, SMS — and revoke anything without an obvious job. A banking app needing location makes sense; a wallpaper app needing it does not. Almost nothing justifies “All the time.”
Then open Privacy Dashboard, which logs which apps actually used permissions in the last 24 hours (seven days on Android 16 and 17). Expect to find a weather or shopping app checking your location at 3 a.m. Revoke, restrict, or uninstall. For photos, Android 13+ can force apps through the system Photo Picker so you share only selected images; Android 16 added a “This month only” option. Apps that fight the picker and demand full library access are telling you what they want it for.
2. Lock down location — per app and at the account level
Location is the most valuable data your phone produces, so it gets its own pass. In Settings → Location → App location permissions, set every app to While using the app or Ask every time. Android 12+ also lets you grant approximate location instead of precise — fine for weather and news apps. Android 17 adds temporary precise-location grants that expire quickly, plus a status-bar indicator whenever an app reads your position.
The account side matters more than most guides admit. Google Maps Timeline (formerly Location History) moved to on-device storage in 2025, so it no longer sits on Google’s servers or answers to geofence warrants. But it stays private only if you control it: auto-delete defaults to three months, an encrypted cloud backup is optional, and you can pause the whole feature in Google Maps → profile → Your Timeline → Settings or via your account’s Data & privacy → Location history. If you don’t use Timeline, turn it off; you lose some Maps personalization, which most people won’t miss.
3. Delete your advertising ID
Cross-app tracking on Android runs through the Google Advertising ID (GAID). In Settings → Privacy → Ads (or Security & privacy → Privacy → Ads) you have two options: Reset advertising ID, which hands you a fresh identifier apps will start rebuilding a profile on, or Delete advertising ID, which blanks it entirely so apps see nothing to link. Delete, don’t reset.
Be honest about the limits. Deleting the ID stops identifier-based tracking across apps — the mechanism behind “I mentioned it, now it’s in my ads.” It does not stop Google personalizing ads for your signed-in account (turn off Personalized ads at myadcenter.google.com), and it does nothing against IP- or fingerprint-based tracking. One 2026 wrinkle: the “Ad topics” panel older guides told you to disable came from Privacy Sandbox, which Google retired in October 2025, so that control is fading away. The plain advertising ID remains the active system — which is why deleting it still matters.
4. Stop the lock screen and notifications from leaking
Two underrated exposures: notification content and lock-screen previews. Since Android 13, every app must ask before posting notifications — be strict, and prune survivors in Settings → Notifications → App notifications. Then set Settings → Security & privacy → Lock screen → Notifications to Don’t show or Hide sensitive content, so a message preview isn’t visible on a table or in a thief’s hand. Android 12+ also flashes a notice when an app reads copied clipboard text — worth watching. Android 17 can hide app names on the home screen too, for glance privacy.
5. Use Private Space for sensitive apps (Android 15+)
Private Space creates a genuinely separate, sandboxed area of the phone: its own lock, optionally its own Google account, and no visibility in the app drawer or recents while locked. Put banking, health, dating and crypto apps inside. Android 15 required you to lock it manually; Android 16 makes it lock automatically when the main screen locks, closing the main gotcha. Find it under Settings → Security & privacy → Private Space. Costs: extra storage, and apps inside don’t fully integrate with the main profile — notifications and sharing behave more like a second phone. If your threat model is “someone with my unlocked phone,” this beats any ad setting.
6. Turn on theft protection, Identity Check and Find Hub
Theft protection matured into a real feature set on Android 15 and 16. In Settings → Security & privacy → Theft protection you’ll find Theft Detection Lock (locks the phone when sensors detect a snatch), Offline Device Lock and Remote Lock. Samsung included these in One UI 7; there is no reason to leave them off.
Two additions matter for 2026. Identity Check (Pixel, then selected Samsung phones; Settings → Security & privacy → Identity Check) requires biometric authentication outside your trusted places before anyone can change your PIN, disable theft protection or Find Hub, open saved passwords and passkeys, or factory-reset the phone — the exact sequence a thief runs. You need a Class 3 biometric (fingerprint or face) and you mark home and work as trusted places.
Find Hub is the 2025 rebrand of Find My Device, reachable at android.com/find or via Settings → Security & privacy → Device finders (the “Allow device to be located” toggle). Android 17 adds “Mark as lost,” which locks the phone with your biometrics so even a thief who knows your passcode can’t unlock it or disable tracking. Set it up now; it’s the difference between a lost weekend and a lost identity.
7. Consider Advanced Protection mode (Android 16+)
Android 16 introduced Advanced Protection mode — Settings → Security & privacy → Advanced Protection → Device protection — a single toggle that applies Android’s strictest settings at once: sideloading blocked, USB data access disabled while locked, 2G fallback disabled, and stronger Play Protect scanning with live threat detection (expanded in Android 17). It is aimed at journalists, activists and anyone with accounts worth a targeted attack. Most people can skip it — it costs sideloading and flexibility — and it is separate from Google’s account-level Advanced Protection Program, though the two complement each other. If your account is high-value, turn both on.
Extra steps that are easy to skip and shouldn’t be
Browser and messaging
Chrome’s privacy is really your Google account’s privacy: history and activity sync unless you intervene. If that bothers you, Firefox with Enhanced Tracking Protection set to Strict, or DuckDuckGo’s browser, are honest defaults. One 2026 correction to older advice: Google abandoned third-party cookie blocking and retired Privacy Sandbox in 2025, so tracking cookies remain — a privacy browser is the only reliable answer. For messaging, choose apps with end-to-end encryption by default (Signal, or Google Messages for RCS between Android users), and enable encrypted backups in WhatsApp or Signal if you use cloud backup.
Google account controls
The device is half the picture. At myaccount.google.com, run the Privacy Checkup, then review Data & privacy: pause Web & App Activity if you don’t want search and app activity building a profile, set Timeline retention short or off, and check Gemini app activity — AI conversations are saved to your account unless you pause them. Turn off personalized ads in My Ad Center. Five minutes, and it’s the part most “private” phones still get wrong.
App hygiene
Uninstall apps you don’t use; Android auto-revokes permissions from unused apps, and an uninstalled app collects nothing. Keep Play Protect’s “Scan apps with Play Protect” on, decline sideloaded APKs from unknown sources, and re-run step 1 every few months — permissions drift as apps update. That rhythm, more than any single toggle, is what keeps a phone private.
Frequently asked questions
Which Android privacy settings should I change first in 2026?
Run the Permission Manager audit and set location to “While using the app,” delete the advertising ID, turn on theft protection (and Identity Check on Pixel or Samsung), and review Google account activity controls. Those cover the four biggest leaks: permissions, location, cross-app tracking and account data.
Does deleting the advertising ID stop all tracking?
No. It removes the identifier apps use to link activity across apps, which stops most behavioral ad targeting. Tracking via IP address, device fingerprinting and your signed-in Google account continues — which is why you should also turn off personalized ads at myadcenter.google.com.
Where does Google Maps location history go now, and how do I turn it off?
Since 2025, Timeline is stored on your device rather than Google’s servers, with auto-delete defaulting to three months. Turn it off in Google Maps → profile → Your Timeline → Settings, or pause Location history in your Google account under Data & privacy.
Which features need Android 15, 16 or 17?
Private Space, theft protection and Identity Check need Android 15 or later; the seven-day Privacy Dashboard, automatic Private Space locking and Advanced Protection mode need Android 16 or later; temporary precise-location grants, the location indicator, “Mark as lost” and the contacts picker arrive with Android 17. Android 16 is the sensible baseline in 2026, with Android 17 reaching non-Pixel phones through late 2026.
Final verdict
Android’s privacy story in 2026 is better than its reputation and worse than its marketing: the controls genuinely improved across Android 15–17, but they sit behind permissive defaults and menus that vary by manufacturer. An hour of work — permissions, location, advertising ID, theft protection and your Google account — meaningfully shrinks what your phone knows, shares, and surrenders if stolen. You don’t need a VPN or a “secure” phone to get most of the way there; you need to use the settings already on the device.
Disclosure: Some links in this post are affiliate links. If you buy through them, we may earn a commission at no extra cost to you.
Last reviewed: September 6, 2026
